High-Risk AI Classification

Legal Framework

The classification of an AI system as 'high-risk' is governed by Article 6 of the AI Act, which establishes a two-pronged legal test. First, an AI system must be intended for use as a safety component of a product, or be itself a product, covered by the Union harmonisation legislation listed in Annex I (e.g., machinery, medical devices, toys). Second, that product must be required to undergo a third-party conformity assessment under that sectoral legislation. Alternatively, an AI system is classified as high-risk if it falls within one of the specific use-cases listed in Annex III, which covers critical areas like biometrics, critical infrastructure, education, employment, and law enforcement. Recital 26 establishes the core rationale for this risk-based approach: rules must be tailored to the intensity and scope of the risks AI systems generate, with high-risk systems subject to a full suite of ex-ante conformity requirements.

Practical Application

The primary interpretive guidance comes from the AI Act's annexes and the European Commission's implementing acts, which will further specify the classification criteria. The classification is objective and based on the system's intended purpose as declared by the provider, irrespective of its potential for misuse. For systems under Annex I, the key is whether the product's governing legislation mandates a third-party assessment; if conformity can be declared by the manufacturer alone, the AI system is not high-risk via this route. For Annex III systems, the classification is automatic if the use-case description is met. Authorities will scrutinize a provider's stated intended purpose against these annexes. If a system not listed in the annexes performs a similar function to a listed high-risk system, the Commission may, via a delegated act, update Annex III to include it, but providers cannot self-classify systems as high-risk on this basis.

Key Considerations

• Determine the Regulatory Pathway: First, ascertain if your AI system is a safety component of, or is itself, a product under Annex I legislation. If not, assess directly against the eight areas of Annex III.
• Document the Intended Purpose: Rigorously document the system's intended purpose, as this is the legal anchor for classification. Marketing materials and technical documentation must align.
• Monitor Annex Updates: Annex III is a living list. Providers must monitor delegated acts from the Commission that may add new high-risk use-cases, which could trigger a reclassification of existing systems.