Skip to main content
Praxikon
Agent check
Article 6 of 1135%
Nederlands

Article 6: Classification rules for high-risk AI systems

Article 6 determines when an AI system is high-risk, through two routes: as a product or safety component under Annex I that requires a third-party conformity assessment, or with an intended purpose listed in Annex III. An Annex III system only falls outside through the narrow Article 6(3) exception, which never applies to profiling. Which use cases are high-risk is set out per area in Annex III.

, AI and privacy legal adviserobligations checked against the source on
Check your own case for free

Praxikon tracks Article 6 (Classification rules for high-risk AI systems) under the EU AI Act, citing the source for every statement.

EU Official:
UpcomingAnnex III from 2 Dec 2027; Annex I from 2 Aug 2028
Title III: High-Risk AI Systems

Application dates

  • : Article 6(2) and systems listed in Annex III
  • : Article 6(1) and systems linked to Annex I

Short answer to the question ‘Is my system high-risk?’, with sources and a case check: Annex III of the EU AI Act.

Implementation timeline

1 Aug 2024
AI Act entered into force
2 Feb 2025
Prohibited practices apply (context for classification)
19 May 2026
Commission draft guidelines published; final version not yet published
2 Dec 2027
Core rules for Article 6(2) and Annex III apply
2 Aug 2028
Core rules for Article 6(1) and Annex I apply

Official text

||

Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.

Download AI Act (PDF) →

Decision tree

Is your AI system high risk?

What decides is the intended purpose the provider gives the system, not the technology. First check that the system is not prohibited (Article 5).

Question 1 · Art. 6(1)(a) · Art. 6(1) bis en 1 ter

Is the AI system intended to be used as a safety component of a product covered by the Union harmonisation legislation in Annex I, or is it itself such a product?

Annex I covers among others machinery, toys, lifts, radio equipment and medical devices. A system used solely for user assistance, performance optimisation, efficiency, automation, convenience or quality control without a safety function is not a safety component, unless its failure would endanger health or safety.

Full diagram
  1. 1

    Is the AI system intended to be used as a safety component of a product covered by the Union harmonisation legislation in Annex I, or is it itself such a product?

    Art. 6(1)(a) · Art. 6(1) bis en 1 ter

    • Yes → Question 2
    • No → Question 3
  2. 2

    Must that product undergo a third-party conformity assessment under that legislation before it is placed on the market or put into service, because of risks to health and safety?

    Art. 6(1)(b) · Art. 6(1) quater

    • Yes → Outcome A
    • No → Question 3
  3. 3

    Does the intended purpose fall under one of the use cases in Annex III?

    Art. 6(2) · bijlage III

    • Yes → Question 4
    • No → Outcome E
  4. 4

    Does the system perform profiling of natural persons: automated processing of personal data to evaluate or predict personal aspects, such as performance, behaviour or reliability?

    Art. 6(3), derde alinea

    • Yes → Outcome B
    • No → Question 5
  5. 5

    Is the system only intended for one of these four things: (a) a narrow procedural task, (b) improving the result of a previously completed human activity, (c) detecting decision-making patterns or deviations from prior patterns, without being meant to replace or influence the previously completed human assessment without proper human review, or (d) a preparatory task to an assessment relevant for a use case listed in Annex III?

    Art. 6(3)

    • Yes, and it does not materially influence the outcome → Question 6
    • No → Outcome B
  6. 6

    Are you the provider of the system: do you develop it or have it developed, and place it on the market or put it into service under your own name or trademark?

    Art. 6(4) · Art. 3(3)

    • Yes, I am the provider → Outcome C
    • No, I use it → Outcome D

Outcome A · Applies

High risk via Annex I: requirements apply from 2 August 2028

The system is high risk under paragraph 1. The requirements of Chapter III, Sections 1 to 3, apply for this route from 2 August 2028. The conformity assessment runs within the procedure of the sectoral legislation. If the product falls under Section B of Annex I, such as aviation, vehicles and, since Regulation (EU) 2026/1744, machinery under the Machinery Regulation, only Article 6(1), Article 60a and Articles 102 to 112 of the AI Act apply; the requirements then apply through that sectoral legislation (Article 2(2)).

Art. 6(1) · Art. 43(3) · art. 113 onder c · Art. 2(2)

Outcome B · Applies

High risk via Annex III: requirements apply from 2 December 2027

The provider must meet the requirements of Chapter III, Section 2, and the obligations of Article 16, including conformity assessment and registration in the EU database (Article 49(1); systems in Annex III point 2 are registered at national level, Article 49(5)). The deployer has the obligations of Article 26; public authorities also register their use (Article 49(3)) and some deployers carry out a FRIA (Article 27). A system placed on the market or put into service before 2 December 2027 only falls under the regulation after a significant change in design from that date. Providers and deployers of high-risk systems intended to be used by public authorities must in any case comply by 2 August 2030.

Art. 6(2) · art. 16 · art. 26 · art. 27 · art. 49 · Art. 111(2) · art. 113 onder c

Outcome C · Partly applies

Not high risk, provided you document and register it

As provider you document your assessment before placing on the market or putting into service, and you register yourself and the system in the EU database. On request you provide the documentation to the national competent authority. If the market surveillance authority finds that the system is high risk after all, you must still bring it into compliance; misclassifying it to avoid the requirements can lead to a fine (Article 80). The classification rules of Article 6 apply to Annex III from 2 December 2027.

Art. 6(3) · Art. 6(4) · Art. 49(2) · art. 80 · art. 113 onder c

Outcome D · Check further

Ask the provider for the reasoning and the registration

The assessment under paragraph 3 and the registration are obligations of the provider. Check that they exist and that you use the system within the intended purpose. If you use it for another purpose that makes it high risk, you may become the provider yourself (Article 25(1)(c)).

Art. 6(4) · Art. 49(2) · Art. 25(1)(c)

Outcome E · Does not apply

Not a high-risk system

The system does not fall under Annex I or Annex III. The obligations for high-risk systems do not apply. Article 4 and, depending on the function, Article 50 still apply. If the intended purpose changes, check again.

art. 6 · art. 4 · art. 50

A decision tree simplifies. If you are unsure at a question, read the provision or have it assessed. Checked against the legal text on 1 October 2026.

Official guidance on this article

7

Governance

Provider

  • •Classifies the AI system as high-risk or not
  • •Performs conformity assessment (Art. 43)
  • •Registers in EU database (Art. 49)
  • •Can claim Art. 6(3) exception with documentation

Deployer

  • •Verifies provider's classification
  • •Uses AI system within intended purpose
  • •Deviating use: reclassification required

Supervisory Authority

  • •Market surveillance on correct classification
  • •Can challenge Art. 6(3) exception
  • •Access to EU database

European Commission

  • •Publishes guidelines on classification (deadline missed)
  • •Can update Annex III via delegated acts
  • •Establishes standard templates

What does this mean for you?

Provider+
First determine which Article 6 route applies: a safety component or product under Annex I, or a use case listed in Annex III. An Annex III system can fall outside high risk under Article 6(3) only if it poses no significant risk of harm, does not materially influence decision-making and meets one of the four statutory conditions. Profiling blocks this filter. Document the assessment in advance and register the system as required by Article 49(2).
Deployer+
Ask the provider for the intended purpose, classification and supporting reasons. Where Article 6(3) is invoked, check the EU database to see which condition is relied on. If you use the system outside its intended purpose or substantially modify it, separately assess whether Article 25 makes you a provider.
SME / Startup+
There is no general SME exemption from the classification rules. For each system, record its intended purpose, the Annex I or Annex III route, any Article 6(3) reasoning and the allocation of roles with the vendor. The high-risk rules apply from 2 December 2027 for Annex III and from 2 August 2028 for Annex I.
Public Sector+
Government use is not automatically high-risk. The intended purpose must fall within a specific Annex III use case, such as access to essential public services, law enforcement, migration or the administration of justice. Then check Article 6(3), the profiling exclusion, and the applicable registration and FRIA duties.

Overlap with other legislation

Complementary

High-risk classification under the AI Act often also requires a DPIA under the GDPR. The risk assessment for high-risk AI systems overlaps with the DPIA obligation, but they are not identical — the AI Act focuses on AI-specific risks, the GDPR on privacy risks.

NIS2 DirectiveArt. 21 (Cybersecurity)
Complementary

High-risk AI systems must meet cybersecurity requirements (Art. 15 AI Act). If the AI system is part of an essential or important entity under NIS2, additional security obligations apply. Measures can be combined.

Product Liability Directive (EU) 2024/2853Art. 6 (Defective product)
Reinforcing

AI systems placed on the market as products also fall under product liability. The new PLD (2024/2853) explicitly names software as a product. A high-risk AI system that does not comply with the AI Act may be considered a 'defective product'. The previously proposed AI Liability Directive has been withdrawn — the PLD is now the primary route for AI damage claims.

Machinery Regulation (EU) 2023/1230Art. 6 (High-risk machinery)
Integrated

AI systems that are safety components of machinery (Annex I, section A) automatically fall under high-risk (Art. 6(1)). The conformity assessment of the machinery and the AI system must be aligned.

Regulation (EU) 2026/1744Amendments to Art. 6, 49, deadlines
Modifying

Regulation (EU) 2026/1744 has applied since 27 July 2026 and amends the AI Act. For Art. 6, the core obligations for Annex III systems apply from 2 December 2027 and those for product-based Annex I systems from 2 August 2028. Registration under Art. 49(2) remains but is simplified. Proportionate rules are extended to small mid-caps.

Sectoral legislation (Annex I)Various
Integrated

Art. 6(1) explicitly refers to Annex I — 21 pieces of EU harmonisation legislation. If an AI system is a safety component of a product covered by this legislation AND requires third-party conformity assessment, it is automatically high-risk.

Related recitals

Recital 47Primary

AI systems could have an adverse impact on the health and safety of persons, in particular when such systems operate as safety components of products. Consistent with the objectives of Union harmonisa…

Recital 48Primary

The extent of the adverse impact caused by the AI system on the fundamental rights protected by the Charter is of particular relevance when classifying an AI system as high risk. Those rights include …

Recital 49Primary

As regards high-risk AI systems that are safety components of products or systems, or which are themselves products or systems falling within the scope of Regulation (EC) No 300/2008 of the European P…

Recital 50Primary

As regards AI systems that are safety components of products, or which are themselves products, falling within the scope of certain Union harmonisation legislation listed in an annex to this Regulatio…

5152535455565758

Related tools

AI Decision TreeAI Readiness Score

Related enforcement

  • •
    CNIL fines Amazon €32 million for AI employee monitoringCNIL · Dec 2023↗
  • •
    Hungarian bank fined for AI-based customer profilingNAIH · Aug 2021↗

Related blog posts

Cross-references

Articles

Art. 5Art. 7Art. 9Art. 43Art. 47Art. 51

Recitals

46474849505152535455565758

Annexes

Annex 1Annex 3

Frequently asked questions

How do I determine if my AI system is high-risk?+
Article 6 defines two categories of high-risk AI: (1) AI systems used as safety components in products under EU harmonisation legislation (Annex I), and (2) AI systems in specific application areas such as biometrics, critical infrastructure, education, employment and law enforcement (Annex III).
What is the difference between Annex I and Annex III high-risk AI?+
Annex I concerns AI in regulated products (medical devices, machinery, toys). Annex III concerns standalone AI applications in sensitive domains such as credit scoring, recruitment and law enforcement.
When do the rules for high-risk AI apply?+
The core rules apply from 2 December 2027 to systems under Article 6(2) and Annex III, and from 2 August 2028 to systems under Article 6(1) and Annex I.
Can my AI system still be not high-risk even if it's listed in Annex III?+
Only where the system poses no significant risk of harm, does not materially influence decision-making and meets one of the four Article 6(3) conditions. Profiling natural persons blocks this filter.
Do I need to document why my AI system is not high-risk?+
Yes, if you conclude your Annex III AI system is not high-risk based on Article 6(3), you must document this before placing the system on the market and make this documentation available to authorities. You must also register the system in the EU database with an explanation.
What are the practical consequences of a high-risk classification?+
A high-risk classification means you must comply with extensive requirements: establish a risk management system (Art. 9), ensure data governance (Art. 10), prepare technical documentation (Annex IV), implement logging (Art. 12), provide transparency (Art. 13), arrange human oversight (Art. 14), and undergo a conformity assessment.
Will the European Commission publish a list of examples of high-risk and not high-risk AI?+
On 19 May 2026, the Commission published draft guidelines with examples and separate parts for Annex I and Annex III. The targeted consultation is closed, but final guidelines have not yet been published.
How much does compliance with the high-risk AI requirements cost?+
The AI Act sets no fixed cost. The effort depends on the role, classification route, existing management systems, intended purpose, and the technical and organisational measures needed for the specific system.

What Article 6 requires in practice

Connections

What connects to Article 6 AI Act

Themes where this returns

Where this meets the other law

The counterpart in the other law

GDPR interpretation that also applies here6 of 10