Is your AI system high-risk under the EU AI Act?
High-risk is the heaviest tier short of banned, and it is the one most organisations get wrong in both directions. Some assume they are caught when a narrow exception lets them out. Others assume they are safe when their hiring or credit tool sits squarely in Annex III. Work through the three steps for a grounded read, the article behind it, and what you would owe if the answer is yes.
Check your system
Three questions, based on Article 6 and Annex III. This is guidance, not legal advice, and the exception in step 3 needs documented justification to rely on.
The eight Annex III areas
Systems whose intended purpose falls in these areas are presumed high-risk under Article 6(2), subject to the Article 6(3) exception.
Remote biometric identification (not simple verification), biometric categorisation by sensitive attributes, and emotion recognition.
Safety components in the management of critical digital infrastructure, road traffic, and the supply of water, gas, heating, and electricity.
Admission decisions, assessment of learning outcomes, steering the level of education a person receives, and exam-monitoring for prohibited behaviour.
Recruitment and selection, decisions on promotion or termination, task allocation, and monitoring or evaluating performance.
Eligibility for public assistance benefits [5(a)], creditworthiness and credit scoring [5(b)], risk assessment and pricing in life and health insurance [5(c)], and emergency call dispatch and triage [5(d)].
Risk assessments, polygraph-style tools, evidence reliability, and profiling in the course of detecting, investigating, or prosecuting offences.
Risk assessments, application examination, and detection tools used by competent authorities.
Assisting a judicial authority in researching and interpreting facts and law, and influencing the outcome of elections or voting behaviour.
If you are high-risk, this is what you owe
The seven core provider requirements sit in Articles 9 to 15, before the system reaches the market.
Plus conformity assessment (Art. 43), the EU declaration of conformity and CE marking (Art. 47 and 48), and registration in the EU database (Art. 49), before 2 August 2026.
Common questions
Keep going
Matched to where this left you.
When does this apply to me?The full timeline and a deadline checker for your system.Find your date →
High-risk templatesRisk management, data governance, and technical documentation.Browse templates →
Classification newsGuidance and enforcement on the high-risk list.Read the digests →
Run this across every system in your inventory
The tool checks one system. Members get a saved classification register for your whole AI estate, the Article 6(3) exception justification template, and the Annex IV documentation pack. The free checker stays free.