High-risk AI system
What it means
What makes an AI system high-risk?
A high-risk AI system is one the EU AI Act classifies as carrying its heaviest legal duties. That happens either because it is a safety component of a regulated product, or because it serves a listed purpose such as hiring, credit scoring or law enforcement. A narrow exemption can apply.
A system reaches the category one of two ways. Article 6(1) covers the first: a safety component of a product already regulated under EU product-safety law, or that product itself. Medical devices and machinery are examples. That product-safety law already requires third-party conformity assessment.
Annex III covers the second: eight listed use-case areas, among them biometric identification, employment decisions, credit scoring and law enforcement. Article 6(2) makes a system high-risk just by falling into one of those areas, with no product-safety law involved at all.
A system inside Annex III can still escape the label under Article 6(3), for four narrow reasons. One is a limited procedural task, such as reformatting an application into a standard template. Another is improving a human decision already made, such as tidying a report's wording without changing its recommendation.
A third is detecting a deviation without replacing human judgement, such as flagging an unusual transaction for a fraud analyst to review. The fourth is a preparatory task ahead of someone else's assessment, such as gathering a loan applicant's documents before a human underwriter looks at them. None of the four applies to profiling: a system that profiles individual people is high-risk regardless.
Published · Updated
In practice
Why it comes up
It is the first question every other AI Act obligation depends on. A customer’s legal team or an investor’s due diligence checklist asks it before anything else about the system. A board hears it phrased more simply, as “are we in the category that gets the heavy paperwork, and who decided.” Getting the classification wrong either way has a real cost, either missed obligations or needless process on a system that never required it.
What to do about it
Run the classification test on each system separately, not on the company as a whole. One product can be high-risk while another, built the same month, is not. Write the decision down, including the reasoning for a not-high-risk conclusion, since an authority can ask to see it later. This classification is exactly what the AI readiness and risk assessment produces for every system in the inventory, not just the ones already suspected.
Sources and neighbours
Sources
- Article 6 - Classification Rules for High-Risk AI Systems
eur-lex.europa.eu
- NIST AI Risk Management Framework
nist.gov
Concerns