EU AI Act high-risk checker
Are you the provider or a deployer?
The provider develops an AI system or places it on the market; a deployer uses it under its own authority. Your answer changes which obligations apply to you — it never changes the classification itself.
How high-risk classification works under the EU AI Act
There are two routes into the high-risk category, both in Art. 6 of Regulation (EU) 2024/1689. The first is the product gate of Art. 6(1): a system that “is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I” — machinery, medical devices, vehicles, toys and the rest of the EU product-law stack — is high-risk where that product requires third-party conformity assessment. The second is the list route of Art. 6(2): “AI systems referred to in Annex III shall be considered to be high-risk.” What matters on this route is the intended use of the system, not the sophistication of the technology behind it.
Art. 6(3) then opens a narrow derogation: an Annex III system “shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons”, available only where one of four conditions holds — a narrow procedural task, improving a previously completed human activity, pattern detection that does not replace human assessment, or a preparatory task. One override forecloses all four: an Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”. A provider that relies on the derogation must document its assessment before placing the system on the market (Art. 6(4)) and register it under Art. 49(2).
The dates that decide urgency
The original Art. 5 prohibitions have applied since 2 February 2025 (the omnibus amendment adds two further prohibitions from 2 December 2026), and the Art. 50 transparency duties apply from 2 August 2026. The high-risk regime was postponed by the 2026 Digital Omnibus amendment (Parliament 16 June, Council 29 June 2026, signed 8 July 2026): stand-alone Annex III systems apply from 2 December 2027, and high-risk systems embedded in Annex I products from 2 August 2028. For high-risk systems already on the market before their date, Art. 111(2) pulls them into scope upon a significant change in design — and requires systems intended for use by public authorities to comply by 2 August 2030 regardless of design changes. The Commission's classification guidelines under Art. 6 remain the reference point for borderline calls.
What Annex III covers
Annex III lists eight areas of intended use. In summary: biometrics; critical infrastructure; education and vocational training; employment, workers management and access to self-employment; access to essential private and public services, including creditworthiness; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. The annex operates at the level of specific use cases within each area — recruitment screening, for example, sits in point 4(a): “AI systems intended to be used for the recruitment or selection of natural persons”.
A high-risk verdict lands differently by role. Providers carry the heavy stack — risk management (Art. 9), the Art. 16 duties from quality management through conformity assessment (Art. 43), CE marking and registration. Deployers carry the Art. 26 duties: operating per the instructions for use, competent human oversight, log retention, and informing the people the system is used on. Our sample readiness assessment shows the full walk — role, classification, obligation register — exactly as a paid engagement produces it, and you can scope an AI Act readiness assessment for your real system.
Common Annex III questions, answered
Are recruitment and hiring AI systems high-risk under the EU AI Act?
In most cases, yes. Annex III point 4(a) lists “AI systems intended to be used for the recruitment or selection of natural persons” — CV screening, application filtering and candidate scoring sit in that wording — and under Art. 6(2) Annex III systems are considered high-risk. The Art. 6(3) derogation can lift the classification for narrow procedural or preparatory tasks, but it is unavailable wherever the system performs profiling of natural persons, which most recruitment screening does. The high-risk obligations for stand-alone Annex III systems apply from 2 December 2027.
Is AI for workers management, promotion or termination decisions high-risk?
Alongside recruitment, Annex III point 4 covers AI used for decisions affecting the terms of work-related relationships — promotion and termination, task allocation based on individual behaviour or personal traits or characteristics, and monitoring and evaluating the performance and behaviour of people in those relationships (our summary of point 4(b)). The same walk applies: Art. 6(2) classifies the system as high-risk, the Art. 6(3) derogation is closed where the system profiles natural persons, and a provider relying on the derogation must document its assessment before placing the system on the market (Art. 6(4)).
Is credit scoring or creditworthiness assessment high-risk under the AI Act?
Yes. Annex III point 5(b) covers “AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score”, with an exception for AI used to detect financial fraud (our summary of the point's carve-out). Deployers of high-risk point 5(b) systems additionally owe a fundamental-rights impact assessment under Art. 27(1) before first use.
When do the EU AI Act high-risk obligations apply?
The original Art. 5 prohibitions have applied since 2 February 2025 (the 2026 Digital Omnibus amendment adds two further prohibitions from 2 December 2026), and the Art. 50 transparency duties apply from 2 August 2026. The same omnibus amendment, signed 8 July 2026, postponed the high-risk regime: stand-alone Annex III systems comply from 2 December 2027, and high-risk systems embedded in Annex I products from 2 August 2028. A system already on the market before its date is pulled into scope on a significant change in design (Art. 111(2)); systems intended for use by public authorities must comply by 2 August 2030 regardless of design changes.
Provision links point at the Official Journal text of Regulation (EU) 2024/1689 on EUR-Lex. Quoted spans match the provision rows fetched from the Ansvar gateway for the published sample assessment; summaries are marked as ours.