EU releases high-risk AI guidance

The European Commission on May 19 published draft guidelines on how to classify “high-risk” AI systems under Article 6 of the EU AI Act and opened a public consultation on the text. The draft is meant to help providers, deployers and market surveillance authorities decide when an AI system falls into the stricter compliance bucket under the law. The guidance is not legally binding, but the Commission says it reflects its interpretation and is intended to support more uniform enforcement across member states. The consultation is open until June 23. ### What exactly did Brussels publish? The Commission published three draft guidance documents covering general principles, Annex I systems and Annex III systems under Article 6 of the AI Act. The documents are designed to help users assess whether a system should be treated as high-risk and include practical examples of use cases that are and are not high-risk. (digital-strategy.ec.europa.eu) Article 6 is the AI Act’s classification rule. Under the law, an AI system is high-risk if it is used as a safety component, or is itself a product, covered by certain EU product laws and subject to third-party conformity assessment, or if it falls into listed Annex III use cases. ### Why is this guidance late and why does that matter? (digital-strategy.ec.europa.eu) IAPP reported that the Commission released the draft after delays and opened the consultation on May 19 to support “providers, deployers and other relevant actors” in deciding whether a system falls within the high-risk category. The publication came after business complaints that firms were being asked to prepare for obligations without enough interpretive guidance. (ai-act-service-desk.ec.europa.eu) IAPP also reported that more than 110 EU-based businesses had lobbied for a two-year pause in enforcing the high-risk rules, citing the lack of guidance and standards. That pressure made the timing of the draft politically sensitive because Annex III high-risk deployer obligations are still pointed at August 2, 2026 unless the legal text changes, according to a separate IAPP report. (iapp.org) ### What is the key test for companies using AI in Europe? The central question is whether a system meets the Article 6 triggers and, for Annex III systems, whether it can use the exemption in Article 6(3). The AI Act says an Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights and does not materially influence decision-making outcomes. (iapp.org) The Commission’s consultation materials say the guidelines focus on practical classification rules and examples of systems that are high-risk and not high-risk. That means companies now have a clearer framework for mapping intended purpose, deployment context and use case against the legal categories in the Act. ### What happens if a system is classified as high-risk? (ai-act-service-desk.ec.europa.eu) Providers of high-risk AI systems face obligations on risk management, data governance, transparency, human oversight, accuracy, cybersecurity and post-market monitoring, according to legal summaries of the draft and the AI Act framework. The Commission has separately said other guidance will follow to help with compliance obligations for high-risk systems. (ec.europa.eu) The AI Act also carries heavy penalties. Euronews reported this week that fines under the framework can reach €35 million or 7% of global annual turnover, depending on the violation. ### What should companies watch next? The consultation closes on June 23, 2026, according to the Commission’s consultation page and legal summaries published after the release. (connectontech.bakermckenzie.com) The draft says the guidance was prepared under Article 6(5) and will be informed by stakeholder feedback and input from member states through the AI Board. (iapp.org) August 2, 2026 remains the date businesses are watching for Annex III high-risk deployer obligations under the current timetable, IAPP said. That leaves providers, deployers and advisers a short window to test classifications, submit comments and prepare documentation before the next compliance phase. (iapp.org) (williamfry.com)