High-risk AI system

Article 6 of the EU AI Act defines two routes to high-risk status. The first covers AI that is a product, or a safety component of a product, already governed by EU harmonization law and requiring third-party conformity assessment, such as medical devices or machinery. The second covers uses listed in Annex III, including biometrics, critical infrastructure, education, employment, access to essential services such as credit and insurance, law enforcement, migration and the administration of justice. An Annex III system may escape the classification if it performs only a narrow or preparatory task and does not materially influence decisions, but systems that profile people remain high-risk.

Providers of high-risk systems must run a risk management system, govern training data, keep technical documentation and logs, design for human oversight, achieve appropriate accuracy and robustness, pass a conformity assessment and affix CE marking. Deployers must use the system according to instructions, assign competent human oversight and, in certain cases, carry out a fundamental rights impact assessment.