High-risk AI system (AI Act)

How it applies

• Two routes: Under Article 6(1), AI that is a safety component of a product, or is itself a product, covered by EU harmonization legislation in Annex I (such as toys, lifts or medical devices) and requiring third-party conformity assessment. Whether AI counts as a safety component follows the definition as amended by Regulation (EU) 2026/1744. For sector legislation in Section B of Annex I — which since 2026 includes machinery — the requirements are brought in through the sector law instead. Under Article 6(2), stand-alone systems in the areas of Annex III: biometrics, critical infrastructure, education, employment, access to essential services (such as credit scoring), law enforcement, migration and border control, and administration of justice and democratic processes.
• Exception: An Annex III system is not high-risk if it does not pose a significant risk of harm — for example because it only performs a narrow procedural task — unless it profiles people. The provider must document this assessment.
• Requirements: Risk management, data governance, technical documentation, record-keeping, transparency and instructions for use, human oversight, and accuracy, robustness and cybersecurity.
• Dates: December 2, 2027 for Annex III systems and August 2, 2028 for Annex I Section A products, as set by the Digital Omnibus on AI. AI in machinery is assessed under the Machinery Regulation from January 20, 2027; see the machinery AI timeline.

Compared with the USA, Canada and China

Colorado's original AI Act was built on a similar concept of “high-risk AI systems” in consequential decisions, but it was repealed before taking effect and replaced with narrower transparency duties. Canada's AIDA would have regulated “high-impact systems”. China has no equivalent category; instead, it imposes filing and security assessment duties on services by their influence on public opinion.