EU AI Act High-Risk AI Systems: The Article 6 Tests, Annex III, and the Article 6(3) Exception

How do you tell if an AI system is high-risk under the EU AI Act?

An AI system is high-risk under the EU AI Act if it meets one of two tests in Article 6. Under Article 6(1), it is intended to be used as a safety component of a product, or is itself a product, covered by the EU product laws listed in Annex I, and that product must undergo a third-party conformity assessment. Under Article 6(2), its intended purpose matches a use case listed in Annex III, unless the provider can show under Article 6(3) that it poses no significant risk of harm to the health, safety, or fundamental rights of natural persons and meets one of four listed conditions, and the system does not profile natural persons.

Both tests turn on intended purpose, not on the technology. The Act defines intended purpose as the use the provider intends, including the specific context and conditions of use, as specified in the instructions for use, promotional or sales materials and statements, and the technical documentation (Article 3(12)). The same underlying model can power a marketing tool that is not high-risk and a hiring tool that is. A deployer that changes the intended purpose of a system that was not high-risk so that it becomes high-risk is treated as its provider (Article 25(1)(c)).

This page stops at classification. The EU AI Act compliance checklist lists the duties that follow a high-risk answer, role by role.

What is the Annex I product route under Article 6(1)?

Article 6(1) has two conditions, and both must be met. The AI system must be intended to be used as a safety component of a product, or be itself a product, covered by the Union harmonisation legislation listed in Annex I. And that product must be required to undergo a third-party conformity assessment under that legislation before it is placed on the market or put into service.

Annex I has two parts. Section A lists New Legislative Framework laws, such as those on toys, lifts, radio equipment, pressure equipment, personal protective equipment, medical devices, and in vitro diagnostic medical devices. Section B lists other laws, including those on civil aviation, motor vehicles, agricultural and forestry vehicles, marine equipment, and rail. The Digital Omnibus moved machinery from Section A to Section B (Regulation (EU) 2026/1744, Article 1(41)).

The split decides how much of the Act applies. For AI systems classified as high-risk under Article 6(1) that relate to Annex I Section B products, including machinery, only Article 6(1), Article 60a, and Articles 102 to 112 apply (Article 2(2)). Articles 57 to 59 on AI regulatory sandboxes apply to those systems only in so far as the high-risk requirements have been integrated into the sectoral law (Article 2(2)). Articles 102 to 109 require the Commission to take the Chapter III, Section 2 requirements into account when it adopts measures on AI systems under those sectoral laws, and Regulation (EU) 2026/1744 requires delegated acts adding AI health and safety requirements to the Machinery Regulation, reflecting Chapter III, Section 2 and Articles 17, 19, 72, and 73 of the AI Act, to apply by August 2, 2028 (Article 3). AI in Annex I Section A products carries the full high-risk regime.

The Omnibus also narrowed what counts as a safety component. AI systems used solely for non-safety aspects of user assistance, performance optimisation, service efficiency, automation, convenience, or quality control do not qualify, unless their failure or malfunctioning would endanger health and safety (new Article 6(1a) and (1b)). A product that needs a third-party conformity assessment solely because of risks other than health and safety, such as radio spectrum or electromagnetic interference that does not affect health and safety, does not meet the second condition (new Article 6(1c)).

Recital 20 of the Omnibus adds that Article 6(1) does not by itself force a product into a notified body procedure where the Annex I Section A law allows a route based on harmonised standards. Amended Article 43(3) lets the manufacturer use that route only if it has also applied harmonised standards or, where applicable, common specifications covering all the Chapter III, Section 2 requirements.

Which uses does Annex III list?

Annex III lists use cases under eight area headings, and a system is caught only if its intended purpose matches a listed point, not merely the heading. Biometrics, law enforcement, and migration are listed “in so far as their use is permitted under relevant Union or national law,” so a listing does not make a use lawful (recital 63). The Digital Omnibus did not change Annex III.

Annex III high-risk use cases, Regulation (EU) 2024/1689 as consolidated on July 27, 2026

Area	Examples listed	Common edge cases
1. Biometrics	(a) Remote biometric identification; (b) biometric categorisation according to sensitive or protected attributes inferred from the data; (c) emotion recognition	Biometric verification whose sole purpose is to confirm a person is who they claim to be is excluded. Recital 54 also excludes systems used solely to enable cybersecurity and personal data protection measures. Emotion recognition at work or in education is prohibited under Article 5, except for medical or safety reasons
2. Critical infrastructure	Safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating, or electricity	Only safety components are listed. Recital 55 says components used solely for cybersecurity do not qualify and gives monitoring water pressure and fire alarm control in cloud computing centres as examples that may. These systems register at national level (Article 49(5))
3. Education and vocational training	(a) Access, admission, or assignment to institutions; (b) evaluating learning outcomes, including to steer learning; (c) assessing the appropriate level of education a person will receive or access; (d) monitoring and detecting prohibited behaviour during tests	Recital 53 gives a tool that checks after the fact whether a teacher deviated from their own grading pattern as an example of the pattern-detection condition in Article 6(3)(c). The Commission’s May 2026 review found that self-taught learning tools do not in most cases pose risks equivalent to or greater than the listed uses
4. Employment, workers’ management, and access to self-employment	(a) Recruitment or selection, in particular targeted job advertisements, analysing and filtering applications, and evaluating candidates; (b) decisions affecting terms of work-related relationships, promotion, or termination, allocating tasks based on individual behaviour or personal traits, and monitoring and evaluating performance and behaviour	Recital 57 says work-related relationships should include persons providing services through platforms. Task allocation is listed only where it is based on individual behaviour or personal traits or characteristics
5. Essential private and public services and benefits	(a) Eligibility for essential public assistance benefits and services, including healthcare, and granting, reducing, revoking, or reclaiming them, by or on behalf of public authorities; (b) creditworthiness evaluation or credit scoring of natural persons; (c) risk assessment and pricing for natural persons in life and health insurance; (d) evaluating and classifying emergency calls, dispatching emergency first response services, and emergency healthcare patient triage	Point 5(b) excludes systems used to detect financial fraud, and recital 58 excludes systems provided for by Union law for prudential purposes to calculate credit institutions’ and insurers’ capital requirements. Point 5(b) names natural persons, and point 5(c) names only life and health insurance. The Commission’s May 2026 review recorded stakeholder requests to cover tenant screening and other insurance lines, and the review proposed no change to Annex III
6. Law enforcement	By or on behalf of law enforcement authorities, or Union bodies supporting them: (a) assessing the risk of a person becoming a victim; (b) polygraphs and similar tools; (c) evaluating the reliability of evidence; (d) assessing the risk of offending or re-offending not solely on the basis of profiling, or assessing personality traits or past criminal behaviour; (e) profiling in detection, investigation, or prosecution	Predicting an individual’s risk of committing a crime based solely on profiling or on assessing personality traits is prohibited under Article 5(1)(d), except for systems that support a human assessment already based on objective and verifiable facts directly linked to a criminal activity. Recital 59 says systems for administrative proceedings by tax and customs authorities, and by financial intelligence units under anti-money laundering law, should not be classified as high-risk law enforcement systems
7. Migration, asylum, and border control management	By or on behalf of competent public authorities or Union bodies: (a) polygraphs and similar tools; (b) assessing security, irregular migration, or health risks posed by a person entering or who has entered a Member State; (c) assisting the examination of asylum, visa, and residence permit applications and complaints; (d) detecting, recognising, or identifying persons	Verification of travel documents is excluded from point 7(d). Systems under points 1, 6, and 7 in the areas of law enforcement, migration, asylum, and border control management register in a secure non-public section of the EU database (Article 49(4))
8. Administration of justice and democratic processes	(a) Assisting a judicial authority in researching and interpreting facts and the law and applying the law to facts, or similar use in alternative dispute resolution; (b) influencing the outcome of an election or referendum or voting behaviour	Recital 61 excludes purely ancillary administrative activities, such as anonymising judicial decisions, and treats alternative dispute resolution as covered when its outcomes produce legal effects for the parties. Point 8(b) excludes tools whose output people are not directly exposed to, such as campaign logistics

When is an Annex III system not high-risk under Article 6(3)?

An Annex III system is not high-risk where it does not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons, including by not materially influencing the outcome of decision making, and at least one of four conditions is fulfilled (Article 6(3)). Recital 53 explains that a system does not materially influence the outcome if it does not have an impact on the substance, and thereby the outcome, of decision making, whether human or automated.

The four Article 6(3) conditions, with the examples in recital 53

Condition	Article	Examples the Act gives
The system is intended to perform a narrow procedural task	6(3)(a)	Turning unstructured data into structured data, sorting incoming documents into categories, detecting duplicates among a large number of applications
The system is intended to improve the result of a previously completed human activity	6(3)(b)	Improving the language of previously drafted documents, such as professional tone, academic style, or brand messaging
The system is intended to detect decision-making patterns or deviations from prior patterns and is not meant to replace or influence the previously completed human assessment without proper human review	6(3)(c)	Checking after the fact whether a teacher deviated from their own grading pattern, to flag inconsistencies
The system is intended to perform a preparatory task to an assessment relevant to an Annex III use case	6(3)(d)	File handling such as indexing, searching, text and speech processing, linking data to other sources, and translating initial documents

Notwithstanding the four conditions, an Annex III system is always high-risk where it performs profiling of natural persons (Article 6(3), third subparagraph). Profiling has the GDPR meaning: any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements (Article 3(52), referring to Article 4(4) of Regulation (EU) 2016/679). A resume screener that ranks candidates by predicted performance at work fits that definition.

The conditions are tested against intended purpose, so they may not survive a change in use. A document sorter that a deployer repurposes to reject applicants is no longer performing a narrow procedural task, and Article 25(1)(c) may make that deployer its provider.

What must a provider do when it relies on Article 6(3)?

A provider that considers an Annex III system not high-risk must document its assessment before placing the system on the market or putting it into service, and must provide that documentation to national competent authorities on request (Article 6(4)). It must also register itself and the system in the EU database before placing it on the market or putting it into service (Article 49(2)). Article 6(4) applies from December 2, 2027, because amended Article 113(c) delays Chapter III, Section 1, which contains Article 6, except Article 6(5). Article 49 sits in Chapter III, Section 5, outside that delay, but Article 49(2) applies only to a system the provider has concluded is not high-risk under Article 6(3), and Article 6(3) itself applies from December 2, 2027.

The Omnibus shortened what that registration must contain. Annex VIII, Section B no longer asks for a short summary of the grounds for the conclusion or for the Member States where the system is available (Regulation (EU) 2026/1744, Article 1(42)). The provider still states the Article 6(3) condition it relies on and the intended purpose, and recital 22 of the Omnibus confirms the documentation duty stays.

Where a market surveillance authority has sufficient reason to consider that a system classified as non-high-risk is high-risk, it must evaluate the classification against the Article 6(3) conditions and the Commission guidelines, and, if it finds the system high-risk, it must require the provider to bring the system into compliance and take appropriate corrective action within a period it may prescribe (Article 80(1) and (2)). A provider that fails to do so within the period set, or that misclassified the system to circumvent the Chapter III, Section 2 requirements, is subject to fines under Article 99 (Article 80(4) and (7)).

Has the Commission published its high-risk classification guidelines?

Not in final form. Article 6(5) required the Commission, after consulting the European Artificial Intelligence Board, to provide guidelines on the practical implementation of Article 6 by February 2, 2026, with a comprehensive list of practical examples of high-risk and non-high-risk use cases. The Commission published draft guidelines for consultation on May 19, 2026. As of October 26, 2026, the Commission’s AI Act Service Desk still described them as draft guidelines open for feedback “before their formal adoption by the Commission.”

Amended Article 113(c) excludes Article 6(5) from the delay of Chapter III, Sections 1 to 3, so the guideline deadline did not move. A draft does not bind anyone, and a provider’s Article 6(4) file should rest on the text of Article 6 and Annex III.

Can the Commission change the Annex III list?

Yes, by delegated act, within limits. Under Article 7(1), the Commission may add or modify Annex III use cases where the systems are intended to be used in one of the eight listed areas and pose a risk of harm to health and safety, or an adverse impact on fundamental rights, equivalent to or greater than the risk posed by systems already listed. Article 7(2) sets the criteria it must weigh, including the intended purpose, the extent of use, whether special categories of personal data are processed, the degree of autonomy, how far affected persons depend on the outcome, including whether they can reasonably opt out, and whether outcomes are easily corrected or reversed. Under Article 7(3), it may remove a use case that no longer poses any significant risks, if removal does not decrease the overall level of protection. Article 6(6) and (7) give a parallel power to add, modify, or delete the Article 6(3) conditions.

A delegated act enters into force only if neither the European Parliament nor the Council objects within three months of notification, extendable by three months (Article 97(6)). Article 7 cannot add a new area heading. The Commission must report on the need to extend existing area headings or add new ones by August 2, 2028 and every four years after (Article 112(2)).

Article 112(1) requires the Commission to assess once a year whether Annex III needs amending. Its report of May 20, 2026 (COM(2026) 234) proposed no change to Annex III. It flagged several uses for further monitoring, including AI companions and mental-support chatbots, point 5 uses such as tenant screening and insurance other than life and health, debt collection, wider critical infrastructure uses, and political disinformation. A search of the Publications Office records on October 26, 2026 found no delegated act amending Annex III.

What does high-risk status trigger?

A provider of a high-risk system takes on the requirements in Articles 8 to 15 (risk management, data governance, technical documentation, logging, transparency, human oversight, and accuracy, robustness, and cybersecurity), the provider obligations in Article 16, a quality management system under Article 17, a conformity assessment under Article 43, an EU declaration of conformity under Article 47, CE marking under Article 48, and, for Annex III systems, registration under Article 49(1), with point 2 systems registered at national level. For Annex III points 2 to 8 the conformity assessment is internal control under Annex VI (Article 43(2)). A system that is covered by Annex I Section A legislation and also falls within an Annex III category follows the sectoral conformity assessment procedure (Article 43(3) as amended).

For deployers, Article 26 sets the operating duties. Article 27 adds a fundamental rights impact assessment before deploying a high-risk system under Article 6(2), that is, an Annex III system, for deployers that are bodies governed by public law or private entities providing public services, and for deployers of systems under Annex III points 5(b) and 5(c), creditworthiness evaluation and credit scoring, and risk assessment and pricing in life and health insurance. It does not apply to critical infrastructure systems under point 2. The EU AI Act compliance checklist lists each of these duties with its article number.

When do the high-risk rules apply after the Digital Omnibus?

Under Regulation (EU) 2026/1744, the high-risk rules apply from December 2, 2027 for stand-alone Annex III systems and from August 2, 2028 for AI in Annex I Section A regulated products (amended Article 113(c)). For AI systems classified as high-risk under Article 6(1) that relate to Annex I Section B products, including machinery, only Article 6(1), Article 60a, and Articles 102 to 112 apply (Article 2(2)).

A high-risk system placed on the market or put into service before the applicable date is covered only if its design changes significantly from that date, but providers and deployers of high-risk systems intended to be used by public authorities must comply by August 2, 2030 (Article 111(2)). The Article 5 prohibitions have applied since February 2, 2025, except the two practices the Omnibus added in Article 5(1)(ba) and (bb), which apply from December 2, 2026 (amended Article 113(a)), so the opening question for any system is whether it is banned.

How do you classify an AI system, step by step?

Run these questions in order for each system and record the article behind each answer.

1. Is the system within the Act’s reach? Check whether it is placed on the market or put into service in the EU, used by a deployer established or located in the EU, or produces output used in the EU, and whether an Article 2 exclusion applies, such as exclusive military, defence, or national security use (Article 2).
2. Is it a prohibited practice under Article 5? If so, classification does not matter; the practice is banned.
3. Is it a safety component of, or itself, a product under Annex I legislation that requires a third-party conformity assessment, applying the limits in Article 6(1a) to (1c)? If it is, the system is high-risk under Article 6(1). Check next whether the product law is in Annex I Section A or Section B, because Article 2(2) limits the Act for Section B.
4. Does its intended purpose match a specific Annex III point, read with that point’s own exclusions? If not, it is not high-risk under Article 6(2), though Article 50 transparency duties may still apply.
5. If it matches an Annex III point, does it profile natural persons? If it does, it is high-risk, and Article 6(3) is not available.
6. Does one of the four Article 6(3) conditions apply, and does the system pose no significant risk of harm to the health, safety, or fundamental rights of natural persons, including by not materially influencing the outcome of decision making? If yes, document the assessment and register under Article 49(2). If no, the system is high-risk. Revisit the answer whenever the intended purpose changes.

Which industries does Annex III reach?

Point 5(c) reaches life and health insurers that use AI to assess risk for or price individuals (see the insurers page), and point 5(b) reaches lenders that score the creditworthiness of individuals (see the banks and credit unions page). Employers meet point 4 through hiring, promotion, termination, task allocation, and performance monitoring tools, which the employers page covers. Annex III does not name law firm practice: point 8(a) reaches tools intended for judicial authorities and alternative dispute resolution, as the law firms page explains.

Hospitals meet both routes. An AI medical device or in vitro diagnostic device is a product under Annex I Section A, so it is high-risk under Article 6(1) where that law requires a third-party conformity assessment. Points 5(a) and 5(d) cover public eligibility decisions for healthcare services and emergency healthcare patient triage. The hospitals page covers the vendor questions, and the manufacturers page covers the Annex I product route. Schools and training providers come under point 3, whose four uses are set out in the table above.

How this fits the other guides: this page is the classification spoke of the EU AI Act compliance guide.

This guide is general information as of October 2026, not legal advice. Confirm each classification against the consolidated text of Regulation (EU) 2024/1689, the Commission’s guidelines once adopted, and with EU counsel.