Image AI-generated. All text is human-written.
Before any AI governance framework can be built, one question has to be answered first: is your AI system “high-risk” under the EU AI Act?
That single question determines everything that follows — which obligations apply, how much documentation you need, whether a conformity assessment is required, and how exposed your organization is to enforcement. Yet most organizations skip straight to writing policies, appointing committees, or buying compliance software without ever settling this foundational classification. The result is governance built on a guess, which tends to collapse the moment a regulator, auditor, or customer asks for the classification rationale behind it.
The Two Routes to “High-Risk”
The EU AI Act doesn’t classify AI systems as high-risk based on vague notions of danger. It uses two specific, legally defined pathways, both set out in Article 6.
Route 1: Annex I — Safety Components
An AI system is high-risk if it is used as a safety component of a product — or is itself a product — that falls under existing EU product safety legislation listed in Annex I (covering areas like machinery, medical devices, toys, lifts, and vehicles), and that product is required to undergo third-party conformity assessment. As of mid-2026, a further carve-out under Article 6(1a) excludes AI systems used solely for non-safety-related aspects such as user assistance, performance optimization, or convenience from qualifying as safety components in the first place.
Route 2: Annex III — Use-Case Domains
Separately, an AI system is high-risk if its intended use falls within one of the specific use-case categories listed in Annex III. These cover areas including biometric identification, management of critical infrastructure, education and vocational training, employment and worker management, access to essential services, law enforcement, migration and border control, and the administration of justice.
Importantly, landing in an Annex III category does not automatically make a system high-risk. Article 6(3) provides a narrow set of exemptions: a system is not high-risk if it performs only a narrow procedural task, merely improves the result of a previously completed human activity, detects patterns without replacing or influencing human decision-making, or performs a purely preparatory task — provided it doesn’t otherwise materially influence the outcome of a decision affecting health, safety, or fundamental rights. Providers who rely on this exemption must document their reasoning before placing the system on the market, and that assessment can be challenged by regulators.
Why the Classification Step Gets Skipped
The three inputs required to answer the classification question properly are:
- Annex I safety component analysis — does the system sit inside a regulated product category, and does that product require third-party conformity assessment?
- Annex III domain mapping — does the system’s intended purpose (not just its actual current use) fall within one of the listed high-risk domains?
- Documented classification rationale — a written record of the assessment and its conclusion, which providers are expected to produce regardless of whether they conclude the system is high-risk or not.
Each of these requires legal and technical judgment, not just a checklist. That’s precisely why organizations tend to defer it — it’s slower and more uncomfortable than jumping straight to writing an AI policy. But a governance program built without this step doesn’t actually know what it’s governing. Policies get written for a risk tier that may be wrong, documentation gets built to the wrong standard, and the whole structure has to be redone once the classification question is finally forced — usually by a regulator, auditor, or enterprise customer’s due diligence team.
The Timeline Has Moved
One detail worth knowing if you’re planning around this: the compliance deadlines for high-risk obligations have been pushed back. Following the “Digital Omnibus on AI” (Regulation (EU) 2026/1744, in force since 27 July 2026), the timeline is now:
- 2 December 2027 — compliance obligations apply to stand-alone high-risk systems classified via Annex III
- 2 August 2028 — compliance obligations apply to high-risk systems classified via Annex I
This is later than the originally planned August 2026 date. The European Commission has also published draft guidelines (open for stakeholder feedback through 23 June 2026) offering practical, worked examples of what does and doesn’t qualify as high-risk under each Annex — a useful reference once finalized, though it will remain non-binding interpretive guidance rather than law.
The extended runway is not a reason to wait. It’s an argument for doing the classification work properly now, while there’s time to correct course before enforcement begins, rather than scrambling once deadlines are close.
Where to Start
Getting the classification question right requires walking through the same structured logic regulators and courts will eventually apply: Does the system sit inside an Annex I product category? Does its intended purpose match an Annex III use case? If so, does one of the Article 6(3) exemptions genuinely apply — and can that be defended in writing?
Getting this foundation right is what makes everything built on top of it — policies, documentation, technical safeguards — actually hold up.
EU AI Act Compliance Disclaimer
This article is provided for general informational and educational purposes only and should not be considered legal, regulatory, or compliance advice. The EU AI Act is evolving, and its requirements can vary depending on the organisation, AI system, role, and specific use case. For professional advice and guidance on EU AI Act compliance, visit www.exclevelai.eu.