The EU AI Act regulates high-risk AI through two main classification routes: AI used in certain regulated products, and AI used in specified areas such as employment, education, essential services, law enforcement and biometrics. If a system qualifies, its operators face obligations covering risk management, data governance, documentation, human oversight, performance, monitoring and, where applicable, conformity assessment. The exact duties depend on the system’s route and the operator’s role. A 2026 amendment sets different start dates for specified high-risk requirements: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
How the Act decides whether an AI system is high-risk
The classification question comes before the compliance checklist. Under Regulation (EU) 2024/1689, commonly called the AI Act, a system can qualify as high-risk through either a product-related route in Article 6(1) and Annex I, or a use-case route in Article 6(2) and Annex III. A system’s label, the fact that it uses AI, or its presence in a particular industry does not by itself settle the question. The provider must assess the statutory conditions that apply to the system and its intended use. Read the Regulation (EU) 2024/1689 text on EUR-Lex.
As an Amazon Associate I earn from qualifying purchases.
Route 1: AI built into a regulated product
Article 6(1) covers an AI system that is intended to be used as a safety component of a product, or is itself a product, where two conditions are met: the product is covered by Union harmonisation legislation listed in Annex I, and that legislation requires the product to undergo a third-party conformity assessment. This route connects AI Act duties with an existing product-safety and conformity framework. It is not enough that a product is regulated in some general sense; the relevant Annex I legislation and third-party assessment condition matter.
Route 2: AI used in a listed area
Article 6(2) and Annex III identify specified uses that may qualify as high-risk. The areas listed include:
#1 Best Overall
- Biometrics.
- Critical infrastructure.
- Education and vocational training.
- Employment, workers management and access to self-employment.
- Access to and enjoyment of essential private services and essential public services and benefits.
- Law enforcement.
- Migration, asylum and border control.
- Administration of justice and democratic processes.
Classification depends on the relevant Annex III description and the Article 6 conditions, not merely on the sector in which a tool happens to be used. A general-purpose administrative tool used by an employer, for example, cannot be declared high-risk or non-high-risk solely from that description; the intended use and statutory wording must be examined.
The Annex III exception and profiling rule
An Annex III system may be excluded from the high-risk classification if it does not pose a significant risk of harm to health, safety or fundamental rights, including because it does not materially influence the outcome of decision-making. Where a provider relies on this exception, it must document its assessment before placing the system on the market or putting it into service. The applicable Annex III provision treats systems that perform profiling of natural persons as high-risk. The exception therefore is not a blanket sector exemption, nor a reason to skip the classification analysis. The specific provision and the system’s actual function need to be considered.
A practical classification workflow
Providers should make the classification decision before market placement or putting the system into service. A defensible process begins with the system as intended to be used, rather than a broad product category or marketing description.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Describe the system and its intended purpose. Record what the AI does, who is expected to use it, and the purpose for which it is offered or deployed. The Act’s routes turn on intended use and specific statutory conditions.
- Check the product route. Determine whether the AI is itself a product or a safety component of one; identify whether the product is covered by legislation listed in Annex I; and check whether that legislation requires third-party conformity assessment.
- Check the use-case route. Compare the intended use with the actual descriptions in Annex III. Do not treat a broad industry match as conclusive.
- Assess any Annex III exception. If the provider concludes that the exception applies, document why the system does not pose a significant risk of harm, including whether it materially influences a decision’s outcome. Consider the applicable profiling provision.
- Record the result and its basis. Preserve the classification rationale and the evidence used, including the intended purpose and any exception analysis. For an Annex III exception, the Act requires documentation before market placement or putting into service.
- Revisit the decision when facts change. A changed intended purpose or use can affect which route applies. Check the current legal text and applicable sector rules rather than relying indefinitely on an old classification note.
This workflow is a way to organize the legal analysis, not a substitute for the conditions in Article 6, Annex I and Annex III. The relevant product legislation may also affect how the system is assessed.
What high-risk classification requires
Chapter III establishes connected controls intended to address risks across a high-risk system’s lifecycle. The obligations are role-specific: providers, deployers, importers, distributors and product manufacturers do not all have the same responsibilities. The framework below describes the main subjects, not every legal requirement or exception.
| Control area | What it addresses | Practical significance |
|---|---|---|
| Risk management | A continuous process for identifying and addressing risks over the system lifecycle. | Risk analysis is not confined to initial development; the provider must have a system for managing risks as the product and its use evolve. |
| Data governance | Data practices appropriate to the system’s purpose and risks. | Data handling is part of the compliance design, not a separate issue to consider only after deployment. |
| Technical documentation and records | Information that supports assessment and traceability. | Operators need records that let relevant parties understand and assess the system and its compliance. |
| Information for deployers | Clear information and instructions, including capabilities and limitations. | Deployers need to know what the system can and cannot do to use it appropriately. |
| Human oversight | Measures suited to the system and its use. | Oversight arrangements must fit the particular system and context rather than exist only on paper. |
| Accuracy, robustness and cybersecurity | Appropriate performance and resilience characteristics. | These are distinct but related properties to address in system design and operation. |
| Quality management and post-market monitoring | Provider arrangements for quality and for monitoring after market placement. | Compliance includes arrangements beyond the point at which the system is first made available. |
| Conformity assessment and registration | Applicable assessment and registration steps. | Which steps apply depends on the route and relevant rules; they should not be assumed identical for every high-risk system. |
The Act’s requirements are not a single generic “AI audit.” They form a set of connected obligations, and the system’s classification route and operator roles determine which provisions apply. In particular, the product route is tied to product-sector legislation, while Annex III classification is tied to listed uses and their statutory conditions.
Rank #3
Who has obligations, and why role matters
Compliance planning should identify each operator’s role rather than treating every organization around a system as the same kind of responsible party. The provider is central to the high-risk framework described in Chapter III, including risk-management, quality-management and post-market monitoring arrangements. Providers also need to supply technical documentation and information for deployers where the applicable provisions require it.
Deployers use the system in an operational setting and need the provider’s instructions and information about capabilities and limitations. Importers and distributors have separate roles in the supply chain, while a product manufacturer may have responsibilities connected to the product framework. The exact duties cannot be derived from a company’s job title alone: the relevant provisions, the system’s route and the organization’s actual role must be checked. The Act’s obligations should therefore be mapped to the actors involved before responsibilities are assigned internally.
A useful compliance record links each requirement to a named responsible function, the evidence that demonstrates how it is addressed, and the relevant system or use. This is an implementation approach, not a claim that one particular record format is prescribed for all operators.
When the high-risk rules apply
Regulation (EU) 2026/1744, the 2026 amendment to the AI Act, changes the schedule for specified obligations in Chapter III, Sections 1, 2 and 3. It sets separate dates by classification route:
| High-risk route | Specified Chapter III Sections 1–3 obligations apply from | Legal reference |
|---|---|---|
| Article 6(2), Annex III use-case systems | 2 December 2027 | Regulation (EU) 2026/1744 |
| Article 6(1), Annex I product-related systems | 2 August 2028 | Regulation (EU) 2026/1744 |
Those dates apply to the specified sections and routes; they are not a universal postponement of every AI Act duty. EUR-Lex’s official summary identifies 2 August 2026 as the Act’s general application date and notes separate exceptions and staged dates. Accordingly, an organization should not infer that it can wait until its high-risk date to address every requirement that might apply to it. Check the relevant provision and schedule for the obligation in question. EUR-Lex: Rules for trustworthy artificial intelligence in the EU.
The amending regulation gives the legislature’s stated rationale for changing the schedule: timely support instruments—including guidance, relevant standards, common specifications and codes of practice—are important to facilitate compliance and reduce the risk of divergent interpretation and uneven application across Member States. That is the regulation’s institutional explanation, not a guarantee that every support instrument will be available by a particular date.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to prepare without assuming every detail is settled
Organizations can begin with classification and governance work that remains useful even as supporting materials develop. The first priority is to identify systems that may fall within either route, because role assignments, technical records and implementation planning depend on that answer.
- Inventory systems by intended purpose. Include the use case and the actors involved, not only a vendor name or internal software category.
- Separate the two classification routes. Record whether the analysis concerns Annex I product legislation or an Annex III use case, and document the conditions that lead to the conclusion.
- Assign role-specific owners. Identify which organization is provider, deployer, importer, distributor or product manufacturer in the relevant arrangement.
- Map controls to evidence. For risk management, data governance, technical documentation, instructions, human oversight, performance, quality and monitoring, decide who maintains the relevant materials and processes.
- Track the applicable date by obligation. Use the amended dates for the specified Chapter III Sections 1–3 obligations, while checking the rest of the Act’s schedule separately.
- Review the consolidated legal text and current Commission materials. The regulation and supporting guidance are update-sensitive, so legal or operational decisions should be checked against the current text and relevant materials.
There is no reliable basis in the cited legal sources for stating a universal cost of compliance, a count of affected organizations, a measured risk reduction, or an enforcement outcome statistic. Those figures should not be inferred from the requirements or dates.
Common classification and timing mistakes
- Assuming every AI system in a listed sector is high-risk. Annex III has specific descriptions and conditions; assess the actual intended use rather than using the sector label as a shortcut.
- Treating the Annex III exception as automatic. The provider must assess and document the exception before market placement or putting the system into service when relying on it.
- Ignoring profiling. The applicable Annex III provision treats systems performing profiling of natural persons as high-risk.
- Applying one deadline to both routes. The specified Chapter III Sections 1–3 obligations have different dates for Annex III and Annex I systems.
- Reading a high-risk date as a blanket delay. The 2026 amendment’s dates do not postpone every obligation under the Act.
- Assigning every duty to the provider by default. Responsibilities are role-specific and may involve other supply-chain or deployment actors.
Which legal sources to check
For classification and the underlying obligations, consult the text of Regulation (EU) 2024/1689, especially Article 6, Annex I, Annex III and the applicable Chapter III provisions. For the amended dates, consult Regulation (EU) 2026/1744. EUR-Lex’s official summary of the EU AI rules is a helpful orientation, but it does not replace the legal text when determining whether a particular system or duty is covered.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
