WHAT THE ARTICLE IS ABOUT
Article 6 establishes the criteria for determining whether an AI system qualifies as “high-risk” under the EU AI Act. This classification triggers a comprehensive set of obligations — from risk management and data governance to human oversight and transparency — so understanding where your system sits is essential before anything else.
WHAT IT SAYS
∙ Route 1 — Safety components: An AI system is automatically high-risk if it is a safety component of a product already regulated under EU harmonisation legislation and requires third-party conformity assessment.
∙ Route 2 — Annex III: An AI system is high-risk if it appears in Annex III — covering eight sensitive areas including biometrics, critical infrastructure, education, employment, and access to essential services.
∙ A notable exception exists: if a system poses “no significant risk” it may escape classification, but this must be documented.
WHO IS AFFECTED
∙ Companies that develop or sell AI systems used in the eight Annex III categories
∙ Companies that deploy third-party AI in regulated contexts — hiring tools, credit scoring, student assessment
∙ Importers and distributors of AI products covered by EU product safety law
∙ Non-EU companies whose systems are used in the EU
WHAT IT MEANS FOR SMES
∙ If you are buying and using a third-party AI tool you are a deployer and may have obligations even though you didn’t build the system
∙ If your AI performs a generic back-office task with no direct impact on people’s rights, you are likely outside high-risk scope
∙ First practical step: check Annex III — if your use case isn’t listed, you’re probably clear
∙ Document your reasoning either way — this protects you in any future regulatory inquiry
Related Articles
∙ Article 5 — Prohibited AI practices
∙ Article 9 — Risk management obligations for high-risk systems
∙ Article 26 — Specific obligations for deployers
∙ Annex III — The full list of high-risk use cases
