High-Risk AI Systems Under the EU AI Act
High-risk doesn't mean banned - it means the AI Act's heaviest compliance load: risk management, data governance, documentation, human oversight, and conformity assessment before the system reaches the market.
9+ Years of Compliance Expertise
End-to-End Execution
An AI system is classified as high-risk if it falls into one of eight categories listed in Annex III - spanning biometric identification, employment, education, essential services, law enforcement, migration, and the administration of justice - or if it's a safety component of a product already regulated under EU product-safety law (Annex I). High-risk status triggers detailed obligations before the system can be placed on the EU market, most of which fall on the provider rather than the deployer. Following the 2026 Digital Omnibus amendment, the compliance deadline for Annex III systems is now 2 December 2027, not the original 2 August 2026.
- What Makes a System "High-Risk"There are two routes into high-risk classification. The first is Annex
III: a fixed list of use-cases the Act treats as inherently high-stakes,
regardless of the underlying technology. The second is Annex I: an AI
system that functions as a safety component of a product already subject
to EU product-safety legislation (machinery, medical devices, toys, and
similar), where that legislation already requires third-party conformity
assessment.
The 8 Annex III Categories
- Biometric identification and categorisationReal-time and post-hoc remote biometric identification systems, and AI that categorises people using sensitive biometric-derived characteristics.
- Critical infrastructureAI used as a safety component in the management of road traffic, water, gas, heating, or electricity supply.
- Education and vocational trainingAI determining access to educational institutions, allocating students, or assessing performance in ways that affect their opportunities.
- Employment and worker managementAI for recruitment screening, promotion or termination decisions, performance evaluation, and employee monitoring.
- Essential private and public servicesAI for creditworthiness assessment, insurance risk and pricing, eligibility for public benefits, and emergency-dispatch decisions.
- Law enforcementAI for individual risk assessment, evidence reliability evaluation, profiling, and crime-pattern prediction.
- Migration, asylum, and border controlAI assessing asylum applications, verifying travel documents, and detecting irregular migration patterns.
- Administration of justice and democratic processesAI researching or interpreting facts and law in judicial proceedings, and AI capable of influencing elections or voting behaviour.
What Providers Must Do Before Market Placement
Register the system in the EU public database for high-risk AI systems
Maintain a quality management system covering compliance procedures, technical standards, and risk management
Run a risk management process across the system's lifecycle — identify foreseeable risks, mitigate them, and feed in post-market monitoring data
Govern training, validation, and testing data for quality and bias, using representative, error-free datasets where feasible
Produce technical documentation before market placement and keep automatic event logs for traceability throughout the system's life
Provide deployers with clear instructions, accuracy figures, and information needed for effective human oversight
Design the system for adequate accuracy, robustness, and cybersecurity, and be able to demonstrate this to authorities on request
Complete a conformity assessment and issue an EU declaration of conformity with CE marking before placing the system on the market
Report serious incidents to national market surveillance authorities once a causal link to the system is established
- A Note on Conformity AssessmentMost Annex III systems can follow the internal-control route: the provider
assesses its own conformity against its quality management system and
technical documentation. Some categories — remote biometric identification
in particular — typically require an independent (notified body)
assessment instead. Which route applies is worth confirming early, since
it materially changes the compliance timeline.
What's Included
Determining whether your AI system falls under Annex III or Annex I, and which specific category applies
Gap assessment against the provider obligations above - risk management, data governance, documentation, human oversight
Structuring the technical file and EU database registration
Advising on which conformity assessment route applies to your system
Question 1 of 8
Check Your AI Compliance Score
Frequently Asked Questions
No. High-risk systems are allowed on the EU market - they just carry the Act's most detailed compliance requirements, covering risk management, data governance, documentation, human oversight, and a conformity assessment before market placement.
2 December 2027 for Annex III systems, following the 2026 Digital Omnibus amendment, which pushed back the original 2 August 2026 date. Annex I systems (safety components of already-regulated products) have until 2 August 2028.
No. Most Annex III categories allow the provider to self-assess against its own quality management system and documentation. Certain categories, particularly remote biometric identification, typically require an independent notified-body assessment instead.
The provider carries the bulk of them (documentation, risk management, conformity assessment). Deployers have a narrower set of duties, mainly around following the provider's instructions, ensuring human oversight in practice, and monitoring the system once it's in use.
Related
Not sure if your AI system counts as high-risk?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.