European Commission publishes draft guidance defining which AI systems qualify as 'high‑risk' under the AI Act

The European Commission on May 19 published draft guidelines setting out how companies, public authorities and regulators should determine whether an AI system counts as “high-risk” under the EU AI Act. The draft is paired with a targeted public consultation that runs until June 23, according to the Commission’s consultation page. The documents are meant to support “uniform application and effective enforcement” of Article 6 of the AI Act, the Commission said. They also add practical examples for providers and deployers trying to classify real systems across different use cases. ### Which systems does the draft say are high-risk? Article 6 of the AI Act sets out two main routes into the high-risk category. One route covers AI used as a safety component of a product — or an AI system that is itself a product — when that product falls under EU harmonisation laws listed in Annex I and must undergo third-party conformity assessment. The second route covers AI systems listed in Annex III of the AI Act. (digital-strategy.ec.europa.eu) The Commission said the guidelines follow the structure of Article 6 and are split into sections covering general principles, Annex I and Annex III. The draft is intended to help providers, deployers and market surveillance authorities assess classification questions in the same way across member states. (digital-strategy.ec.europa.eu) ### Why is the Annex III carve-out getting so much attention? Article 6(3) creates an exception for some Annex III systems. The AI Act says an Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights and does not materially influence decision-making outcomes. The law then lists conditions that can support that conclusion, including narrow procedural tasks, improving the result of a previously completed human activity, detecting decision-making patterns without replacing human assessment, or carrying out preparatory tasks. (digital-strategy.ec.europa.eu) The Commission’s draft guidelines use practical examples to show how that exception should be assessed. The consultation notice says the examples are meant to test the clarity and usefulness of the draft, while the policy page says the examples are not exhaustive and may be updated over time. (ai-act-service-desk.ec.europa.eu) ### What did the Commission actually ask stakeholders to do? The Commission opened a targeted consultation on May 19 and invited feedback from providers and developers of AI systems, businesses, public authorities, researchers, academics and citizens. The consultation asks for views on the clarity of the guidelines and on whether the examples are useful in practice. Submissions are due by June 23 at 22:00 CET, according to the consultation page. (digital-strategy.ec.europa.eu) The draft is also being presented through the AI Act Single Information Platform, where users can browse summaries, examples and a searchable explorer of areas and use cases. The Commission said feedback from the consultation will be incorporated before the final version is adopted. (digital-strategy.ec.europa.eu) ### When do the high-risk rules apply? The Commission’s policy page says the enforcement timeline has changed following the political agreement on the “AI Omnibus.” Rules for systems used in certain high-risk areas, including biometrics, critical infrastructure, education, employment, migration, asylum and border control, apply from December 2, 2027. Rules for systems integrated into products such as robotics and industrial machinery apply from August 2, 2028. (digital-strategy.ec.europa.eu) The AI Act itself is Regulation (EU) 2024/1689, according to the Commission’s AI Act page. That page describes the law as the EU’s comprehensive legal framework on artificial intelligence and says the rules are based on risk categories for developers and deployers. ### What should companies be doing now? (digital-strategy.ec.europa.eu) Providers and deployers now have a Commission draft that turns the classification question into a documented exercise: identify the use case, test whether Annex I or Annex III applies, assess whether any Article 6(3) exception is available, and then map the resulting obligations. That last step is an inference from the structure of Article 6 and the Commission’s explanation that the guidelines are meant to support classification and later compliance. (digital-strategy.ec.europa.eu) The next formal milestone is June 23, when the consultation closes. The Commission said feedback received in that process will be folded into the final guidelines before adoption. (digital-strategy.ec.europa.eu 1) (digital-strategy.ec.europa.eu 2)