High-risk AI: Article 6 and Annex III.

The eight Annex III areas

The Article 6(3) filter

An Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing decisions, and it meets at least one condition: it performs a narrow procedural task; it improves the result of a completed human activity; it detects decision-making patterns or deviations without replacing or influencing the human assessment without proper review; or it performs a preparatory task for an Annex III assessment. A system that profiles natural persons is always high-risk. The provider must document the assessment before placing the system on the market and register it (Articles 6(4), 49(2)).

What providers must do

• A risk management system (Article 9).
• Data and data governance for training, validation and testing data (Article 10).
• Technical documentation with at least the elements of Annex IV; SMEs and small mid-caps may use a simplified form (Article 11).
• Record-keeping (Article 12) and transparency and instructions for use for deployers (Article 13).
• Human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15).
• A quality management system, proportionate to the provider’s size (Article 17).
• A conformity assessment (Article 43), an EU declaration of conformity (Article 47) and the CE marking (Article 48).
• Registration in the EU database before placing an Annex III system on the market (Article 49).
• Post-market monitoring (Article 72) and reporting of serious incidents (Article 73).

What deployers must do

• Use the system according to its instructions and assign human oversight to people with the competence, training, authority and support needed (Article 26(1), (2)).
• Where they control the input data, make sure it is relevant and sufficiently representative (Article 26(4)); monitor operation and inform the provider of risks (Article 26(5)).
• Keep the automatically generated logs under their control for at least six months, unless other law says otherwise (Article 26(6)).
• Employers inform workers’ representatives and affected workers before using a high-risk system at the workplace (Article 26(7)); public authorities register their use (Article 26(8)).
• Use the provider’s information for the GDPR data protection impact assessment, where one is required (Article 26(9)).
• Fundamental rights impact assessment (Article 27) before first use, for bodies governed by public law, private entities providing public services, and deployers of credit scoring and life or health insurance pricing systems (Annex III, points 5(b) and (c)); not for critical infrastructure systems.

Guidance and dates

Article 6(5) asked the Commission for guidelines with practical examples by 2 February 2026; it published a draft on 19 May 2026, which is still a draft on its page (draft guidelines). The obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems; systems already on the market are covered only if their design changes significantly, except those intended for public authorities, which must comply by 2 August 2030.