Two routes into the high-risk category
Article 6 of Regulation (EU) 2024/1689 creates two separate paths. Under Article 6(1), an AI system is high-risk if it is a product, or a safety component of a product, covered by the EU harmonisation legislation listed in Annex I and that product must undergo a third-party conformity assessment. Think of AI inside medical devices, machinery, toys, lifts, radio equipment or vehicles. If you already work with a notified body for the product, the AI component is pulled into that process.
Under Article 6(2), a system is high-risk if it is used in one of the areas listed in Annex III. This is the route most software companies need to examine, because it is defined by the use case, not by the technology. A simple logistic regression that decides on loan applications can be high-risk, while a large language model that drafts marketing copy is not.
Note the timing difference: Annex III obligations were scheduled to apply from 2 August 2026 and Annex I product obligations from 2 August 2027. A digital omnibus proposal from late 2025 would push back some of these dates, so confirm the current legal status before planning around a delay.
Annex III areas 1 to 4: biometrics, infrastructure, education, employment
The first four areas cover systems that many SMEs either sell or buy without realising the classification consequences.
- Biometrics: remote biometric identification systems (not simple verification that a person is who they claim to be), biometric categorisation based on sensitive or protected attributes, and emotion recognition systems, where permitted by law.
- Critical infrastructure: AI used as a safety component in managing and operating critical digital infrastructure, road traffic, or the supply of water, gas, heating and electricity.
- Education and vocational training: systems that decide admission, evaluate learning outcomes, assess the appropriate level of education a person can access, or monitor and detect prohibited behaviour of students during tests.
- Employment and workers management: recruitment and selection, including targeted job ads and filtering or ranking applications; decisions on promotion, termination and task allocation based on behaviour or personal traits; and monitoring or evaluating employee performance.
Annex III areas 5 to 8: services, law enforcement, migration, justice
Area 5 is the one fintechs, insurers and public-sector suppliers meet most often. The last three areas mainly affect vendors to public authorities.
- Access to essential private and public services: eligibility for public benefits and healthcare services, creditworthiness assessment and credit scoring of natural persons (systems for detecting financial fraud are excluded), risk assessment and pricing for life and health insurance, and evaluating, classifying and prioritising emergency calls and patient triage.
- Law enforcement: for example assessing the risk of a person becoming a victim or offender, polygraph-type tools, and evaluating the reliability of evidence.
- Migration, asylum and border control: risk assessments of people entering the EU, assistance in examining applications for asylum, visas and residence permits.
- Administration of justice and democratic processes: tools assisting judicial authorities in researching and interpreting facts and law, and systems intended to influence the outcome of elections or voting behaviour.
Check your readiness for free
10–15 minutes, no account needed: readiness score, gap report and AI recommendations.
The Article 6(3) exception and why profiling closes it
Not every system that touches an Annex III area is high-risk. Article 6(3) lets a provider conclude that a system does not pose a significant risk of harm when it only performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns or deviations without replacing or influencing a human assessment without proper review, or performs a preparatory task for an assessment relevant to an Annex III use.
Examples that can fit: a tool that converts unstructured CVs into a standard format without ranking anyone, a grammar checker for teacher feedback, or a dashboard that flags when a credit officer's decisions deviate from past patterns for later human review. The exception never applies if the system performs profiling of natural persons. A model that builds a score of a candidate's personality or predicts their reliability stays high-risk regardless of how small it is.
Using the exception has a paper trail. Under Article 6(4), the provider must document its assessment before placing the system on the market and provide that documentation to authorities on request, and it must still register the system in the EU database under Article 49(2). The Commission was tasked with publishing guidelines and practical examples for this classification; check the latest version, because it is the reference an authority will use.
A five-question classification test
Run each system from your AI inventory through these questions in order and record the answers with a date and the name of the person who made the call. The record matters as much as the conclusion.
- Is it a prohibited practice under Article 5? If yes, stop: it cannot be used.
- Is it a safety component of, or itself, a product under Annex I that needs third-party conformity assessment? If yes, it is high-risk via Article 6(1).
- Does its intended purpose fall into one of the Annex III use cases? If no, check Article 50 transparency duties and move on.
- Does it profile natural persons? If yes, it is high-risk with no exception.
- Does one of the four Article 6(3) conditions genuinely apply? If yes, document the reasoning and register; if not, it is high-risk.
Common classification mistakes
The most frequent error is classifying the technology instead of the use. Teams say the system is just a ranking algorithm or just a chatbot, while the Act cares about what the output is used for. A second error is relying on the vendor's marketing statement that a product is AI Act compliant: if you deploy a general tool for an Annex III purpose that the vendor did not intend, Article 25 may turn you into the provider.
A third error is ignoring internal HR tools. Performance analytics, shift allocation based on behavioural data and automated CV screening are all in Annex III area 4, and employers are often the provider because they built or configured the system themselves. Finally, many companies forget that classification is not permanent. A new feature, a new customer segment or a new intended purpose can move a system into the high-risk category and should trigger a reassessment through change management.
What follows if the answer is yes
A high-risk classification triggers the provider requirements of Articles 8 to 17: a risk management system, data governance, Annex IV technical documentation, logging, instructions for use, human oversight, accuracy and robustness, cybersecurity and a quality management system, followed by conformity assessment, CE marking and registration. Deployers take on Article 26 duties, including competent human oversight, log retention and informing affected people, and in some cases a fundamental rights impact assessment.
Building these capabilities from scratch is easier inside a management system that already handles risk, documentation and audits. ISO/IEC 42001 is designed for that purpose and pairs well with an existing ISO 27001 programme. A free self-assessment on baltum.ai shows how far your current AI governance is from an ISO 42001 baseline that supports high-risk obligations.
Frequently asked questions
Is a customer service chatbot high-risk?
Usually not. A chatbot answering product questions is not in Annex III, but it carries the Article 50 duty to tell users they are talking to an AI system unless that is obvious. It would become high-risk if it were used, for example, to decide eligibility for public benefits or to triage emergency calls.
Is fraud detection in payments high-risk?
Annex III point 5(b) explicitly excludes AI systems used for detecting financial fraud from the creditworthiness category. Such systems can still raise data protection questions under the GDPR, especially where automated decisions affect customers.
We buy an HR screening tool from a vendor. Are we provider or deployer?
If you use it as intended under the vendor's name, you are a deployer and the vendor is the provider. If you rebrand it, substantially modify it or use it for a high-risk purpose the vendor did not intend, Article 25 can make you the provider with full obligations.
Can the Commission change the Annex III list?
Yes. Article 7 empowers the Commission to add or modify use cases through delegated acts within the eight areas, and to remove use cases that no longer pose significant risk. Review the current Annex III text when you reassess your systems.
Check your readiness for free
10–15 minutes, no account needed: readiness score, gap report and AI recommendations.
Sources
This article is for general information and is not legal advice. baltum.ai is independent software, not a certification body.