EU AI Act high-risk checker
Are you the provider or a deployer?
The provider develops an AI system or places it on the market; a deployer uses it under its own authority. Your answer changes which obligations apply to you — it never changes the classification itself.
How high-risk classification works under the EU AI Act
There are two routes into the high-risk category, both in Art. 6 of Regulation (EU) 2024/1689. The first is the product gate of Art. 6(1): a system that “is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I” — machinery, medical devices, vehicles, toys and the rest of the EU product-law stack — is high-risk where that product requires third-party conformity assessment. The second is the list route of Art. 6(2): “AI systems referred to in Annex III shall be considered to be high-risk.” What matters on this route is the intended use of the system, not the sophistication of the technology behind it.
Art. 6(3) then opens a narrow derogation: an Annex III system “shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons”, available only where one of four conditions holds — a narrow procedural task, improving a previously completed human activity, pattern detection that does not replace human assessment, or a preparatory task. One override forecloses all four: an Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”. A provider that relies on the derogation must document its assessment before placing the system on the market (Art. 6(4)) and register it under Art. 49(2).
Two dates decide urgency
The Art. 5 prohibitions have applied since 2 February 2025. The general high-risk regime applies from 2 August 2026. For high-risk systems already on the market before that date, Art. 111(2) pulls them into scope upon a significant change in design — and requires systems intended for use by public authorities to comply by 2 August 2030 regardless of design changes. The Commission's classification guidelines under Art. 6 were due “no later than 2 February 2026” and are the reference point for borderline calls.
What Annex III covers
Annex III lists eight areas of intended use. In summary: biometrics; critical infrastructure; education and vocational training; employment, workers management and access to self-employment; access to essential private and public services, including creditworthiness; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. The annex operates at the level of specific use cases within each area — recruitment screening, for example, sits in point 4(a): “AI systems intended to be used for the recruitment or selection of natural persons”.
A high-risk verdict lands differently by role. Providers carry the heavy stack — risk management (Art. 9), the Art. 16 duties from quality management through conformity assessment (Art. 43), CE marking and registration. Deployers carry the Art. 26 duties: operating per the instructions for use, competent human oversight, log retention, and informing the people the system is used on. Our sample readiness assessment shows the full walk — role, classification, obligation register — exactly as a paid engagement produces it, and you can scope an AI Act readiness assessment for your real system.
Provision links point at the Official Journal text of Regulation (EU) 2024/1689 on EUR-Lex. Quoted spans match the provision rows fetched from the Ansvar gateway for the published sample assessment; summaries are marked as ours.