Is Your AI System High-Risk Under the EU AI Act?

The Short Answer: High-Risk Is About What Your AI Decides

The EU AI Act saves its heaviest obligations for one tier: high-risk. Land there, and you owe risk management, data governance, technical documentation, human oversight, and the list keeps going. Stay out of it, and the load is far lighter. This is the classification that decides your workload.

Two questions settle it. First, does your AI operate in one of the areas the Act lists in Annex III? Second, even if it does, does it qualify for the narrow exemption in Article 6(3) that pulls some systems back out? Most teams know the first question and have never heard of the second.

You can answer both in about 90 seconds. Run the free risk check and you will see your tier, with the reasoning behind it. No signup needed to see your result.

Check if your AI is high-risk (90 seconds)

Step One: Is Your AI in an Annex III Area?

Annex III lists the uses the Act treats as high-risk. The ones that turn up most in small and mid-sized businesses:

• Employment and HR: recruitment, CV screening, candidate ranking, promotion and termination calls, task allocation, performance monitoring.
• Access to essential services: credit scoring and creditworthiness, risk pricing for health and life insurance, eligibility for public benefits.
• Education: admissions, scoring exams or assignments, proctoring during tests.
• Biometrics: remote identification, biometric categorisation, and emotion recognition, where the law permits them at all.

The full list also covers critical infrastructure, law enforcement, migration and border control, and the administration of justice. For most companies, those first four are where the risk sits.

If your AI is nowhere near any of these, it is almost certainly limited or minimal risk, and your job is short. If it sits inside one, keep reading, because you are not automatically high-risk.

Step Two: The Exemption Almost Nobody Mentions (Article 6(3))

Here is the part the scare-pieces skip. Being in an Annex III area does not make you high-risk on its own. Article 6(3) says an Annex III system is not high-risk when it barely shapes the outcome of a decision. To qualify, it has to meet at least one of these:

• it performs a narrow procedural task,
• it improves the result of a task a human already finished,
• it detects patterns or deviations from earlier decisions without replacing the human's own assessment,
• it performs a preparatory task for an assessment.

There is one hard limit. If your system profiles people, it is always high-risk, exemption or not.

And there is a string attached. If you decide your Annex III system is not high-risk, Article 6(4) says you have to document that assessment before the system goes to market, and register it. The exemption is real, but it is not a shrug. You have to show your work.

High-Risk or Not: A Few Real Cases

The line is finer than most teams expect, which is exactly why guessing is the expensive move. The risk check walks the same logic and hands you a documented answer.

Get your tier with the reasoning

What High-Risk Actually Demands

If your system is high-risk, the obligations are real. As the provider, you would:

• run a risk management system (Article 9) and govern your training data (Article 10),
• produce technical documentation (Article 11) and keep automatic logs (Article 12),
• build in human oversight (Article 14) and meet accuracy and security targets (Article 15),
• pass a conformity assessment and register the system before it goes live.

Deployers of high-risk systems carry their own duties under Article 26. Get it wrong and the penalties bite. Most breaches of these obligations reach €15 million or 3% of global turnover. For SMEs, the Act charges the lower of the two. See our full fines and penalties breakdown.

This is the work the December 2, 2027 deadline is about. It is also why knowing your tier early pays off: the gap between "high-risk" and "not" is the gap between months of work and an afternoon.

Your Next 90 Seconds

1. Classify. The risk check returns your tier and the Annex III or Article 6(3) reasoning behind it.
2. Close the gaps. If you are high-risk, AI Comply HQ™ maps the obligations and drafts the documentation. A consultant charges €10,000 or more for the same scoping. Our plans start at $97 a month, and the check is free.
3. Stay ready. One dashboard tracks every system, every deadline.

Start your free 7-day trial

Frequently Asked Questions

What makes an AI system high-risk? It sits in an Annex III area and does not qualify for the Article 6(3) exemption. Systems that profile people are always high-risk.

Is being listed in Annex III enough on its own? No. Article 6(3) can pull a system back out if it only plays a narrow or supporting role. But you have to document that judgment under Article 6(4).

We think our system is exempt. Is there anything to do? Yes. Document the Article 6(3) assessment before you go to market, and register the system. The exemption still comes with a paper trail.

What does a high-risk system actually require? Risk management, data governance, technical documentation, human oversight, accuracy and security measures, a conformity assessment, and registration.

For more, see whether small companies have to comply, how to tell if you are a provider or a deployer, what an AI chatbot owes, and our breakdown of prohibited practices.

Update: The Digital Omnibus Is Now Law (September 27, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed:

• High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
• Two new bans start December 2, 2026 (Article 5). AI that makes intimate images of real people without their consent will be banned. So will AI that makes child sexual abuse material.
• The AI literacy duty changed (Article 4). You must take steps to support your team's AI literacy. The law no longer asks for a set level of skill.

What did not change:

• The bans that started on February 2, 2025 still apply.
• Rules for the large models behind tools like ChatGPT (general-purpose AI models) have applied since August 2, 2025. So have the penalty rules.
• Transparency duties, like telling people they are talking to an AI (Article 50), have applied since August 2, 2026. Generative AI already on the market before then has until December 2, 2026 to mark its output as AI-made (Article 111(4)).

To see which dates apply to you, run the free 90-second risk check. For every date in one place, see our EU AI Act timeline.