Begin with the System and Its Intended Purpose
The AI Act’s high-risk classification is a legal assessment of a particular system and use. A vendor’s label, the size of the buyer or the use of a general-purpose model does not settle that assessment. Record what the system is intended to do, whose decisions it influences and how the organisation will use it.
A recruitment tool that ranks applicants deserves a different assessment from a tool that formats an already approved job advert. Both may use AI, but their effect on the decision can differ.
Two Routes Under Article 6
Article 6(1): regulated products. This route covers an AI system that is itself a product, or is intended as a safety component of a product, under the EU legislation listed in Annex I, where the relevant product must undergo third-party conformity assessment.
Article 6(2): Annex III uses. This route covers specified uses in the areas below. It is necessary to read the actual use case in the annex, rather than classifying every system in an industry as high-risk.
Article 6(3) provides a qualified exception for certain Annex III systems that do not pose a significant risk and do not materially influence decision-making. The conditions concern narrow procedural, preparatory or specified supporting tasks. An Annex III system that profiles natural persons remains high-risk. Providers relying on the exception must document their assessment and meet the applicable registration requirements.
The Eight Annex III Areas
| Area | Uses that require particular scrutiny |
|---|---|
| Biometrics | Specified remote identification, categorisation and emotion-recognition uses |
| Critical infrastructure | AI safety components in specified infrastructure and utilities |
| Education and training | Admission, assessment of learning outcomes, assignment of education level and certain test monitoring |
| Employment | Recruitment, selection and specified decisions or monitoring affecting workers |
| Essential services | Specified public-benefit decisions, personal creditworthiness, life/health insurance and emergency response |
| Law enforcement | Specified uses by or on behalf of law-enforcement authorities |
| Migration and borders | Specified uses by competent authorities in migration, asylum and border control |
| Justice and democracy | Specified judicial assistance and influence over elections or voting behaviour |
Check prohibited practices under Article 5 separately. For example, certain biometric categorisation and workplace or educational emotion-recognition uses are prohibited, subject to the regulation’s detailed conditions and exceptions. Calling a use high-risk does not make a prohibited practice permissible.
Three Business Scenarios
Candidate screening. A system that scores applicants or filters applications may fall within Annex III’s employment uses. Assess its actual purpose, decision influence and profiling behaviour. Identify the provider of the system and the employer using it; their duties differ.
Personal creditworthiness. A system evaluating a natural person’s creditworthiness may fall within Annex III. The annex distinguishes this from AI used to detect financial fraud. Sector-specific financial rules may apply alongside the AI Act.
Educational assessment. A system assessing learning outcomes or influencing access to education may fall within Annex III. A drafting assistant for a lecturer is not automatically equivalent to a grading system. Assess the workflow and the extent of human review in context.
What High-Risk Providers Need to Address
The relevant requirements include lifecycle risk management, data governance where applicable, technical documentation, logging, instructions, human oversight, accuracy, robustness and cybersecurity. Provider duties also cover quality management, conformity assessment, corrective action and relevant registration obligations.
The conformity route depends on the system and applicable legislation. Do not assume that every system requires a notified body, or that every high-risk system is entered into the same public register. Substantial changes can require the assessment to be revisited.
Build a Classification Record
For each system, record its supplier and intended purpose; affected people; inputs and outputs; decision influence; applicable Annex I or III provisions; possible Article 5 prohibitions; and the reasoning behind any exception. Attach the available instructions and evidence. Assign an owner and review the record when the purpose, model, data or workflow changes.
Provider and deployer responsibilities and the application timetable are separate parts of this assessment.
From the Inventory to an Implementation Plan
Q-Journey includes AiP Express and Platinum, with Lean and Muda consulting in Platinum. The agreed project scope determines which processes and technical gaps are examined. A technical review does not itself certify legal compliance; legal classification and any required assessment need the appropriate accountable specialists.
Primary Source
Regulation (EU) 2024/1689 on EUR-Lex. This article explains the framework in the adopted regulation. For a deployment decision, use the current consolidated text, applicable guidance and the facts of the system; publication of this article does not establish the status of later amendments.