An AI system is high-risk under the EU AI Act if it is a safety component of a regulated product (Annex I route) or its use falls in one of eight Annex III areas, from biometrics to justice. Check your use case against the list below, then check the Article 6(3) exemption.
Two routes into high-risk
Article 6 sets out two paths. Article 6(1) covers AI that is a safety component of, or is itself, a product under Annex I harmonisation laws that needs third-party conformity assessment. That applies from 2 August 2028. Article 6(2) covers use cases listed in Annex III, applying from 2 December 2027 per the pages we read.
The Annex III checklist
Ask whether your system is used for any of the following.
- Biometrics: remote identification, sorting people by sensitive traits, or emotion recognition. Simple identity verification is excluded.
- Critical infrastructure: safety components in digital infrastructure, road traffic, or supply of water, gas, heating or electricity.
- Education and training: deciding admission or placement, grading outcomes, judging the level of education a person can access, or monitoring students for cheating in tests.
- Employment and worker management: recruiting, screening CVs, evaluating candidates, promotion or dismissal decisions, task allocation, or monitoring performance.
- Essential services: judging eligibility for public benefits, scoring creditworthiness (fraud detection excluded), pricing life and health insurance, or triaging emergency calls.
- Law enforcement: assessing risk of offending or victimisation, polygraph-style tools, evaluating evidence reliability, or profiling.
- Migration, asylum and border control: risk assessments of travellers, reviewing visa, asylum or residence applications, and some identification uses.
- Justice and democratic processes: helping judicial authorities research facts and apply the law, or AI meant to influence elections or voting behaviour.
If your use is not on this list and not an Annex I safety component, it is not high-risk under Article 6. Other duties, such as transparency, may still apply.
Context beats technology
The same model can be high-risk in one product and not in another. A language model summarising meeting notes is not in the list. The same model ranking job applicants is in area 4. Classify the use, not the model.
Check the exemption
Even an Annex III system can fall outside high-risk if it poses no significant risk to health, safety or fundamental rights, for example by handling a narrow procedural task. Profiling of natural persons always stays high-risk. The details are in a separate post on the Article 6(3) exemption.
Keep the record
For every system, store a one page classification note: use, Annex III area or none, reasoning, date, owner. If you conclude a system is not high-risk under the exemption, Article 6(4) requires the provider to document that assessment before market placement.
Quick check
Is a customer support chatbot high-risk?
Not by itself, since it is not an Annex III use. Article 50 transparency duties may apply. If it were used to assess benefit eligibility, that would change the answer.
Does Annex III apply from August 2026?
No. After the AI Omnibus, the high-risk obligations for Annex III uses apply from 2 December 2027.
Sources
- AI Act Annex III, high-risk use cases
- AI Act Article 6, classification rules
- European Commission, AI Act regulatory framework
Last reviewed: 19 October 2026.
