EU AI Act high-risk classification: Annex III, Annex I and the new dates

An AI system is high-risk under the EU AI Act if it is a product, or a safety component of a product, covered by the EU product laws in Annex I and needing a third-party check, or if it is used in one of the areas listed in Annex III, such as employment, credit scoring or education. Classification is the first question for any organisation that builds or uses AI with an EU connection. Whether a system is high-risk decides whether the heaviest obligations in the AI Act apply to it, from risk management and data governance for providers to human oversight and log retention for deployers. This guide covers the two routes into the high-risk category, the exception, and the dates as they now stand.

The dates, as amended

The AI Act entered into force on 1 August 2024 and applies in stages. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the start of the high-risk requirements.

• Annex III systems (Article 6(2)). The requirements in Chapter III, Sections 1 to 3, apply from 2 December 2027, sixteen months later than the original 2 August 2026.
• Annex I systems (Article 6(1)). The same requirements apply from 2 August 2028, a year later than the original 2 August 2027.

The Omnibus did not change the requirements themselves, only when they start. Other parts of the Act kept their dates. The prohibitions in Article 5 have applied since February 2025, the transparency duties in Article 50 since 2 August 2026, and the AI literacy provision in Article 4 since February 2025, now in amended form.

Systems already on the market before the relevant date are covered only if their design changes significantly afterwards, with a fixed deadline of 2 August 2030 for high-risk systems used by public authorities.

Route one: Annex I products

Under Article 6(1), an AI system is high-risk when both of these hold.

• It is a safety component of a product, or is itself a product, covered by the EU harmonisation legislation listed in Annex I.
• That product has to undergo a third-party conformity assessment, an independent check before it can be sold, under that legislation.

Annex I Section A lists the product laws that follow the EU’s standard product-safety model. It includes machinery, toys, lifts, radio equipment, pressure equipment, personal protective equipment, gas appliances, medical devices and in vitro diagnostic medical devices. Section B covers civil aviation, motor and agricultural vehicles, marine equipment and rail, where the Act reaches mainly through those sectors’ own rules.

The test turns on the product law, not on how sophisticated the AI is. An AI component that performs a safety function in a medical device that needs assessment by a notified body (an independent assessor) is high-risk. The same model in a consumer wellness app that is not a medical device is not caught by this route. The Omnibus narrowed the definition of a safety component and added provisions on its boundaries, so check the amended text for borderline cases.

Route two: Annex III uses

Under Article 6(2), systems used in the areas listed in Annex III are high-risk. There are eight areas, each with specific uses.

1. Biometrics. Remote biometric identification, biometric categorisation by sensitive attributes, and emotion recognition, where not prohibited.
2. Critical infrastructure. Safety components in managing critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity.
3. Education and vocational training. Admission, evaluating learning outcomes, assessing the appropriate level of education, and monitoring students during tests.
4. Employment and workers management. Recruitment and selection, and decisions on terms of work, promotion, termination, task allocation and performance monitoring.
5. Essential private and public services. Eligibility for public benefits, creditworthiness and credit scoring (except fraud detection), risk assessment and pricing in life and health insurance, and triage of emergency calls.
6. Law enforcement. Specific uses such as assessing the risk of a person becoming a victim, polygraphs, evaluating evidence and profiling in investigations.
7. Migration, asylum and border control. Risk assessments, examining applications and detecting or identifying people.
8. Administration of justice and democratic processes. Assisting judicial authorities to research and apply the law, and influencing elections or voting behaviour.

Read the specific uses, not just the headings. “Employment” does not catch a chatbot that answers staff questions about leave. It does catch a tool that ranks job applicants. The Commission can amend Annex III under Article 7, so the list is not fixed.

The Article 6(3) exception

An Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decisions. Article 6(3) sets out four conditions, any one of which can apply.

• The system performs a narrow procedural task.
• It improves the result of a previously completed human activity.
• It detects decision-making patterns or deviations from prior patterns, and is not meant to replace or influence the human assessment without proper human review.
• It performs a preparatory task to an assessment relevant to an Annex III use.

There is a hard limit. A system that performs profiling of natural persons is always high-risk, whatever else is true. A provider relying on the exception must document its assessment before placing the system on the market and register the system, and must hand the documentation to national authorities on request.

The exception is narrower than it first reads. Commentary on the Commission’s draft guidelines has noted that the filter may catch fewer systems than many providers expect. Treat it as something to argue carefully and record, not as a default.

Provider or deployer

Classification is mostly the job of the provider, which develops or supplies the system, but deployers, the organisations using it, have reasons to check it. Their own obligations under Article 26 depend on it. And under Article 25, a deployer becomes the provider of a high-risk system if it puts its name or trademark on the system, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk. Taking a general-purpose assistant and pointing it at candidate screening is the classic example.

Recording the classification

For each system with an EU connection, record the classification, the route, the specific Annex entry, any reliance on Article 6(3) with the reasoning, your role, and the date. Most of the facts you need already belong in a system’s AI register record, such as what the system produces, whether it makes or supports decisions about people, whether it profiles them, what data it uses and where it is used.

Revisit the classification when the intended purpose changes, when the system changes materially, when the Commission finalises its guidelines or amends Annex III, and as the application dates approach.

Where Aicura fits

Classification turns on facts most organisations already capture when they register a system. In Aicura those facts sit in the decision and impact, human oversight, data profile and cross-border sections of each system’s AI Register record, and each record saves a new version when it changes materially. A classification can then be tied to the version of the system it was made against, and revisited when a later version changes the intended purpose.

From the Essentials tier, for organisations in the EU, the EU AI Act is available as a framework that risk and impact assessments apply alongside your others. The classification itself stays your organisation’s call, made with your own legal advice.

---

A note on this page

This guide explains what the rules require and how to do the work. It is general information, not legal advice. How the obligations apply turns on your own circumstances, so read the primary source and take your own advice before you rely on it.

Aicura does not certify, audit or issue a compliance verdict, and it does not produce a score. That decision belongs to your organisation and its people.

Primary source: Regulation (EU) 2024/1689 (the AI Act), EUR-Lex