What counts as high-risk AI?
High-risk AI is AI systems that under the EU AI Act can significantly affect people's health, safety or rights, and therefore face stricter requirements.
High-risk includes AI used in recruitment, in assessing employees, for access to essential public services and in credit scoring. The areas are listed in Annex III of the regulation.
Such systems must meet requirements on risk management, documentation, human oversight and logging. The requirements apply from 2 December 2027 for the Annex III areas and from 2 August 2028 for AI in regulated products.
The classification follows the use. An assistant answering from routines normally falls outside, but the same tool can become high-risk if it is used to assess individuals.
How it works
There are two ways in. One is AI that serves as a safety component in products already regulated, such as medical devices and machinery. The other is the use cases in Annex III. A system in those areas is still not high-risk if it only performs a narrow or preparatory task without significant risk. Profiling of people, however, is always high-risk.
Why it matters
The requirements affect both purchasing and ways of working. The provider must have assessed that the system meets the requirements before placing it on the market. Whoever uses the system must follow the instructions, monitor how it performs and keep logs.
What to keep in mind
An employer using high-risk AI at work must inform staff before the system is put into use.
People affected by decisions where high-risk AI was involved must generally be told. Plan for how that will happen.
What it means for you
Go through what your AI tools are used for. It is the use that decides whether the requirements apply.
Common questions
How do we know if an AI system is high-risk?
Compare the use with the areas in Annex III, such as recruitment, credit scoring and access to essential public services. It is the use that decides.
What must a deployer of high-risk AI do?
Among other things, use the system according to the instructions, ensure human oversight by people with the right competence and keep logs. Public bodies must also assess the impact on fundamental rights.
When do the requirements apply?
From 2 December 2027 for the Annex III areas and from 2 August 2028 for AI in regulated products. The dates were set by an amending regulation from July 2026.
Sources: Regulation (EU) 2024/1689, Annex III, on EUR-LexAmending Regulation (EU) 2026/1744 on EUR-Lex
Related terms
Read more
All terms Updated