Artificial intelligence systems that fall into the high-risk category are subject to the most comprehensive regulatory obligations under the EU AI Act.
For companies operating in Europe, identifying whether an AI system qualifies as high-risk is a critical first step. High-risk classification triggers a set of legal requirements relating to documentation, risk management, transparency and regulatory oversight.
This article explains:
• what high-risk AI systems are under the EU AI Act
• which applications fall under Annex III
• what conformity assessments require
• what technical documentation providers must maintain
For an overview of the overall regulatory structure, see the main guide:
→ EU AI Act Overview: Structure, Scope and Key Obligations
For a breakdown of the four regulatory categories:
→ EU AI Act Risk Categories Explained
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
What Are High-Risk AI Systems Under the EU AI Act?
Under the EU AI Act, an AI system is considered high-risk when it can significantly affect:
• health and safety
• fundamental rights
• access to essential services or opportunities
High-risk systems are therefore subject to strict ex-ante regulatory controls before they can be placed on the EU market or used in certain contexts.
The regulation identifies two main groups of high-risk systems:
1. AI systems embedded in regulated products
These include AI components used in products that already fall under EU safety legislation, such as:
• medical devices
• aviation systems
• machinery
• vehicles
In these cases, AI compliance is integrated into the existing product safety frameworks.
2. AI systems listed in Annex III
Annex III identifies a number of stand-alone AI applications considered sufficiently sensitive to justify high-risk classification.
Annex III High-Risk AI Systems
The document lists specific use cases where AI systems are presumed to be high-risk because of their potential impact on individuals or society.
These systems include AI used in areas such as:
Biometric identification
AI systems used for:
• biometric identification
• biometric categorisation
• facial recognition in certain contexts
Critical infrastructure
AI used to manage or operate infrastructure where failures could affect public safety, including:
• transport networks
• energy systems
Education and vocational training
AI systems used to:
• evaluate exams
• determine access to educational institutions
• assess students
Employment and workforce management
AI tools used in:
• recruitment and hiring decisions
• CV screening
• worker monitoring
• promotion or termination decisions
Access to essential services
AI systems used to determine eligibility for services such as:
• credit scoring
• insurance pricing
• social benefits
Law enforcement and migration management
Certain AI applications used by public authorities in areas such as:
• risk assessment in law enforcement
• migration and border control
Because Annex III is attached to the regulation, the European Commission has the power to update this list, meaning additional high-risk use cases may be added over time.
Conformity Assessments
Before a high-risk AI system can be placed on the EU market, providers must complete a conformity assessment.
This process verifies that the AI system complies with the requirements established by the EU AI Act.
The conformity assessment typically involves evaluating:
• the risk management system
• data governance and training data quality
• technical documentation
• human oversight mechanisms
• accuracy and robustness
• cybersecurity safeguards
In many cases, the assessment can be performed internally by the provider. However, in certain situations a notified body may need to be involved.
Once the assessment is successfully completed, the system may receive CE marking, allowing it to be placed on the EU market.
Documentation Requirements
High-risk AI systems must be supported by extensive documentation designed to ensure transparency and regulatory oversight.
Providers are required to maintain technical documentation that demonstrates compliance with the regulation.
This documentation typically includes:
• description of the AI system and its intended purpose
• system architecture and model design
• training, validation and testing data information
• risk management processes
• human oversight measures
• performance metrics and limitations
In addition, providers must implement logging capabilities so that the operation of the system can be traced and audited.
This documentation must be available to national supervisory authorities upon request.
Why High-Risk Classification Matters for Companies
For organisations developing or deploying AI systems, high-risk classification has significant operational implications.
It can affect:
• product development timelines
• compliance costs
• documentation obligations
• procurement decisions
• internal governance structures
Companies that identify potential high-risk systems early can integrate compliance requirements directly into their development processes.
This can significantly reduce the cost and complexity of regulatory alignment later on.
Key Takeaways
High-risk AI systems represent the core regulatory focus of the EU AI Act.
These systems must comply with a comprehensive framework that includes:
• Annex III classification rules
• conformity assessment procedures
• extensive technical documentation requirements
Understanding whether an AI system falls into the high-risk category is therefore a crucial step for companies operating in the European AI market.
As enforcement timelines approach, organisations developing or deploying AI technologies will increasingly need to assess how their systems align with these requirements.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
