High-risk AI: classification and obligations
Two routes lead into the high-risk category: through products that already undergo conformity assessment, and through the use cases listed in the annex. Both have to be assessed separately.
Classification is not a matter of taste and not a self-assessment made in the abstract. It follows a fixed path, and it has to be documented even where it comes out against the high-risk category.
The two routes in
Through the product
- The system is a safety component of a regulated product
- Or it is such a product itself
- This presupposes third-party conformity assessment under other Union law
- Typical for machinery, medical devices and vehicles
Through the use case
- The annex lists the areas covered, among them employment and education
- Selection, promotion and evaluation of performance and conduct are covered
- It attaches to the purpose of use, not to the technology
- The same tool can therefore be classified differently depending on use
The assessment path
Step 1: Rule out prohibited practices
First settle whether the intended use is permitted at all. Some practices are prohibited, such as inferring emotions in the workplace outside narrow exceptions.
Step 2: Assess both routes
The product route and the annex areas have to be considered separately. A system can be caught by one and not the other.
Step 3: Assess and document the exception
Where the use falls into an annex area, assess whether it nonetheless poses no significant risk. That assessment has to be documented.
Step 4: Determine the role
Only with the role of provider or deployer is it settled which obligations apply and which records you have to keep.
The dates
The AI Act entered into force on 1 August 2024 and applies in stages. The prohibited practices and the AI literacy duty have applied since 2 February 2025, the main body of the regulation since 2 August 2026. High-risk systems have dates of their own.
02.02.2025
Prohibited practices
Systems meeting a prohibition had to be shut down by that day, or adjusted so that they no longer met it.
02.08.2026
Main body of the regulation
Market surveillance and the general transparency rules. Technical marking under Art. 50 AI Act follows on 2 December 2026.
02.12.2027
Annex III
The context-based high-risk systems, for instance in employment, education and creditworthiness. The Digital Omnibus moved this from 2 August 2026.
02.08.2028
Product-related systems
High-risk systems that are products or safety components, together with the duties of the actors involved. 2 August 2027 was previously foreseen.
How we support you
We carry out the classification along this path, record the reasoning in writing and derive the set of obligations from it. Where the assessment comes out against the high-risk category, the documentation matters just as much, because it is your answer when the question is asked later.
Unclear how your system is classified?
We run the classification and document the reasoning.
Request a classificationFrequently asked questions
How does a system end up in the high-risk category?
Either as a safety component of a product that already undergoes conformity assessment under other Union legislation, or through the use cases listed in the annex, among them employment, education, creditworthiness and certain areas of public administration. The second route is more often overlooked, because it attaches to the purpose of use rather than to the product.
Are there exceptions within the annex areas?
Yes. A system used in one of those areas does not count as high-risk where it poses no significant risk to health, safety or fundamental rights, for instance because it performs only a narrow procedural task or merely prepares a human assessment. Anyone relying on that has to document the assessment.
From when do the obligations for high-risk systems apply?
In stages, and the Digital Omnibus has moved the dates. For the context-based systems in Annex III the requirements apply from 2 December 2027, where 2 August 2026 was originally foreseen. For high-risk systems that are products or safety components of products they apply from 2 August 2028 instead of 2 August 2027. The shift is justified by the need for the technical standards to be available in time. It is no reason to wait, because preparing a conformity procedure takes longer than the time that remains.
We calculate a score. Is that already a decision?
It can be. On 7 December 2023 the Court of Justice of the European Union held that the automated production of a probability value on a person's future ability to meet payment obligations is already an automated decision within the meaning of Article 22(1) GDPR, provided that whether a third party enters into, performs or terminates a contract depends decisively on that value (C-634/21). The score thus moves from preparation into the decision itself. Classification under the AI Act stands alongside that and does not replace the assessment.
What follows from the classification?
For providers an extensive programme covering risk management, data quality, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity, plus conformity assessment. For deployers considerably less, but not nothing: use in accordance with the instructions, suitable oversight, retention of logs and informing those affected.