Two routes to high-risk
Under Article 6, a system is high-risk if it is a safety component of, or itself, a product covered by the EU legislation in Annex I that needs third-party conformity assessment, or if it is used for a purpose listed in Annex III. The amended text clarifies that systems used only for non-safety tasks such as user assistance, efficiency, comfort or quality control are not safety components, unless failures can endanger health and safety.
The eight areas in Annex III
- Biometrics (remote identification, categorisation by sensitive traits, emotion recognition; pure identity verification is excluded).
- Critical infrastructure (safety components).
- Education and vocational training (admission, assessing learning outcomes, placement, monitoring during tests).
- Employment (recruitment and selection, decisions about work relationships, task allocation, performance monitoring).
- Access to essential private and public services (public benefits, creditworthiness except fraud detection, risk and pricing in life and health insurance, emergency calls and triage).
- Law enforcement.
- Migration, asylum and border control.
- Administration of justice and democratic processes.
See Annex III for the exact wording.
The exception in Article 6(3)
A system in an Annex III area is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, and it meets one of four conditions: it performs a narrow procedural task, improves the result of a human activity already completed, detects patterns without replacing human assessment, or performs a preparatory task. An Annex III system that profiles people is always high-risk. A provider who relies on the exception must document the assessment before placing the system on the market and register it.
When the rules apply
Under the consolidated text shown on the AI Act Service Desk (checked 12 October 2026), the rules for high-risk systems listed in Annex III apply from 2 December 2027, and for systems covered by Annex I from 2 August 2028. The Service Desk FAQ still describes these changes as a proposal, so check the current text before you plan around a date.
If it is high-risk
Start with the data: Article 10 sets requirements for training, validation and test data, and Annex IV asks for documentation of it. See the Article 10 checklist and the data section of the technical documentation. This guide is general information, not legal advice.