! High compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
Challenging incorrect non-high-risk self-assessments
Article 80 gives market surveillance authorities the power to challenge and overturn a provider’s self-assessment that their Annex III system is not high-risk under Article 6(3). Where an authority has sufficient reason to believe the system should in fact be classified as high-risk, it can require the provider to bring the system into compliance with all high-risk obligations — and impose additional fines where the misclassification was intentional.
WHAT IT SAYS
Authority challenges classification, requires compliance, penalises deliberate misclassification
- Where a market surveillance authority has sufficient reason to consider that an AI system classified by the provider as non-high-risk under Article 6(3) is actually high-risk, it must evaluate the system
- If the authority concludes the system is indeed high-risk, it requires the provider to take all necessary corrective actions to bring the system into compliance with high-risk requirements within 15 working days
- The provider must ensure corrective action covers all units of the system placed on the Union market
- Where the authority finds the system’s classification and use is not limited to its territory, it must notify the Commission and other member states
- If the provider fails to take adequate corrective action, Article 79 provisional measures apply — withdrawal, recall or restriction
- Where the authority establishes that the system was deliberately misclassified as non-high-risk to circumvent Chapter III requirements, the provider is subject to additional fines under Article 99
- Authorities may use information from the EU database and perform checks to monitor compliance with classification obligations
WHO IS AFFECTED
Providers who have self-assessed Annex III systems as non-high-risk
- Providers who have used Article 6(3) to conclude their Annex III system is not high-risk — their classification can be challenged
- Market surveillance authorities conducting reclassification evaluations
- Downstream deployers of systems that may be reclassified — their obligations change if the system is found to be high-risk
- The Commission and other member states notified of cross-border reclassification cases
WHAT IT MEANS FOR SMES
Document your non-high-risk assessment carefully — it may be scrutinised
- If you have self-assessed your Annex III system as non-high-risk under Article 6(3), that assessment must be thorough, documented and defensible — it can be reviewed by authorities
- The Article 6(3) assessment must be documented before market placement under Article 6(4) — if you cannot produce it on request, you have already violated a compliance obligation
- Deliberate misclassification carries a penalty premium — do not classify a system as non-high-risk for commercial convenience; the fine if discovered is larger than the compliance cost you would have avoided
- If you are uncertain whether your system genuinely qualifies as non-high-risk under Article 6(3), err on the side of treating it as high-risk and comply accordingly — the cost of unnecessary compliance is lower than the cost of enforcement action
- Reclassification from non-high-risk to high-risk mid-market is operationally disruptive — you may need to retrofit documentation, QMS, monitoring and registration processes that were never built
Related Articles
- Article 6 — Classification rules (the Article 6(3) self-assessment that this article scrutinises)
- Article 79 — National enforcement procedure (applies if corrective action is not taken)
- Article 99 — Penalties (additional fines for deliberate misclassification)
- Article 49 — Registration (systems self-assessed as non-high-risk must still register)
