Understand how the EU AI Act classifies high-risk AI, what Annex III covers and why businesses should assess intended purpose before reaching a conclusion.
High-risk is a legal classification, not a synonym for risky
An AI system can present meaningful business risk without meeting the AI Act definition of a high-risk AI system. Conversely, certain systems can fall within the high-risk framework because of their intended purpose and the regulatory categories set out in the Act.
Businesses should avoid declaring a system high-risk or not high-risk from a product label alone. Classification should be documented against Article 6, the relevant annexes and the system's intended use.
Where high-risk classification can arise
The Act includes a route for certain safety components of regulated products and a separate route for use cases listed in Annex III. Annex III includes specified uses across areas such as biometrics, critical infrastructure, education, employment, access to certain essential services, law enforcement, migration and the administration of justice.
The categories contain detail, conditions and exclusions. A tool touching one of these business functions is therefore a reason to assess, not a reason to automatically announce a classification.
What businesses should record
- The system's intended purpose and the decision or process it supports.
- The organisation's role in relation to the system and any changes it makes to intended purpose.
- The people affected and the significance of the output.
- The relevant Article 6 route, Annex I or Annex III category and any applicable exclusion.
- Provider documentation and the evidence supporting the classification conclusion.
- The current application date for the relevant obligation, taking account of the 2026 amendments.
Why current dates matter
The AI Omnibus changed transition timing for some high-risk requirements. Older explainers may still show superseded dates. The Commission's current AI Act page states that Annex III high-risk rules in certain sensitive areas now have an extended transition period to 2 December 2027 and product-related Annex I rules to 2 August 2028.
Blanche perspective
Use a two-stage process: screen quickly for potentially relevant categories, then perform a documented classification assessment where a trigger is present. That avoids both complacency and unnecessary over-classification.
Sources
Primary and authoritative sources used for this Insight.