High-risk AI system

A system is high-risk in two ways (Article 6): because it is a safety component of a regulated product (machinery, toys, medical devices…, listed in Annex I), or because it is used in one of the areas in Annex III, such as recruitment, credit scoring or education.

There is an exception: an Annex III system is not high-risk if it poses no significant risk (for example, if it only performs a preparatory task). Whoever relies on the exception must document it. But if the system performs profiling of individuals, it is always high-risk.

Obligations include risk management, data governance, technical documentation, automatic logs, human oversight, accuracy and cybersecurity. After the Digital Omnibus, they apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).