high-risk AI system
In plain wordsUnder EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
Under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., an AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it. in one of two groups. The first is AI in products already regulated by the EU safety laws listed in Annex I — toys, lifts, medical devices, vehicles and the like — where the AI is the product itself or performs a safety function in it, and the product must be checked by an independent body under those laws. The second is AI meant for one of the sensitive uses in Annex III: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services such as credit, insurance and benefits; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. An Annex III system escapes the label if it poses no significant risk, for instance because it only carries out a narrow procedural or preparatory task, but never if it profiles people. Providers must run a risk management system and meet requirements on data governance, technical documentation, logging, transparency to deployers, human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., and accuracy, robustness and cybersecurity, then complete conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used., affix CE marking and register Annex III systems in an EU database.
Because it ranks job applicants, the tool is a high-risk AI system under Annex III.
Origin
Foreshadowed in the European Commission's 2020 White Paper on AI and defined in its April 2021 AI Act proposal. Obligations were originally due from 2 August 2026; the 2026 Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year. postponed them to 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products, narrowed the definition of 'safety component' and left AI in machinery largely to the Machinery Regulation.
Usage note
'High-risk' is a legal category, not a measured property: a mediocre hiring tool is high-risk while a highly capable chatbot generally is not. The Commission can amend Annex III by delegated act. Its guidelines on classification under Article 6, due by February 2026, appeared in draft only on 19 May 2026 and were still a draft in late July 2026.
Related
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.
- provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes.
- human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked.
- fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm.
- post-market monitoringpost-market monitoring, n.: The duty of an AI system's maker to keep watching how it performs after release, gathering evidence from real use so that problems are found and fixed.
- harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch.
- risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest.
Sources
- European Commission (2026). Draft Commission guidelines on the classification of high-risk AI systems. 19 May 2026. digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 6 and Annexes I and III; requirements Arts. 8–15; application dates as amended by Reg. (EU) 2026/1744
Mentioned in
EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., AI applicationAI application, n.: A program or product that uses AI to do something useful for people, such as a translation app, a medical-scan checker or a coding assistant., AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it., automation biasautomation bias, n.: The habit of trusting a computer's suggestion too much: following it even when it is wrong, or missing problems because the machine did not flag them., Colorado AI ActColorado AI Act, prop. n.: A Colorado law, first passed in 2024, governing AI used to make important decisions about people, such as hiring, lending and housing. In 2026 it was rewritten as a narrower law that starts in 2027., conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used., Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year., harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch., human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., human-in-the-loophuman-in-the-loop, adj.: Describes AI systems in which a person checks, corrects or approves the machine's work at key points, rather than letting it act entirely on its own., model risk managementmodel risk management, n.: The rules banks and other firms follow to make sure the mathematical models and AI systems they rely on are built correctly, checked independently and used only for what they are fit for., predictive AIpredictive AI, n.: AI used to forecast outcomes about people or events, such as who will repay a loan, which patient may get sicker or which machine will fail, in order to guide decisions., provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes., remote biometric identificationremote biometric identification, n.: Using AI to recognize people at a distance — usually by matching faces in camera footage against a database — without their taking part. The EU strictly limits live police use of it in public places., right to explanationright to explanation, n.: The idea that a person affected by a decision made or shaped by an algorithm — a refused loan, a rejected job application — is entitled to a meaningful account of why., risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest., serious incidentserious incident, n.: Under EU AI law, an AI failure that kills or badly injures someone, disrupts vital services, violates fundamental rights or seriously damages property — which the maker must report to authorities quickly., social scoringsocial scoring, n.: Rating people on how they behave or what they are like, then using the score to treat them worse in unrelated parts of their lives — a practice the EU has banned for AI., AI Basic ActAI Basic Act, prop. n.: South Korea's main AI law, in force since January 2026, which sets safety and transparency duties for AI used in sensitive areas and for AI-generated content., AI PactAI Pact, prop. n.: A voluntary European Commission scheme in which companies pledge to start following the EU AI Act's main ideas early, before the rules legally apply to them., biometric categorisationbiometric categorisation, n.: Using AI to sort people into groups — by age, sex, ethnicity and the like — from their faces, voices or other body features. The EU bans using it to guess sensitive traits such as religion or sexuality., emotion recognition systememotion recognition system, n.: AI that tries to work out how people feel or what they intend from their faces, voices or bodies. The EU bans it at work and in schools and tightly regulates it elsewhere., fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm., intended purposeintended purpose, n.: The use a maker says its AI system is meant for. In EU law, the rules that apply to a system depend largely on this declared purpose.