High-risk AI system

In short

A high-risk AI system is the EU AI Act's term for AI used where mistakes can seriously harm people's health, safety or rights, such as in hiring, credit scoring, exams or policing. These systems face the Act's strictest rules.

Also called: High-risk AI, Annex III AI system, High risk AI system
Topic: Law, policy and the UK
Level: Some background helps
First described: Set out in Article 6 and Annex III of the EU AI Act, Regulation (EU) 2024/1689, published in July 2024¹.

The EU AI Act sorts AI by risk, and high-risk is the most tightly regulated category that is still allowed. There are two routes in¹.

The first covers AI that is a safety component of a product already governed by EU product-safety law listed in Annex I, or is itself such a product, where that product must pass a third-party conformity assessment, an outside safety check¹. The second covers uses listed in Annex III: biometrics, critical infrastructure, education, employment, access to essential services such as benefits, credit and life or health insurance, law enforcement, migration and border control, and the administration of justice and elections².

Being on the list is not the end of it. An Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it only performs a narrow procedural task or a preparatory step. But a system that profiles people is always high-risk¹.

Providers must meet requirements on risk management, data governance, technical documentation, record-keeping, transparency to users, human oversight, and accuracy, robustness and cybersecurity³. Systems must be designed so people can effectively oversee them while in use⁴. Breaking provider duties can bring fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher⁵.

The deadlines have moved. The Digital Omnibus, Regulation (EU) 2026/1744, delayed them: Annex III systems are covered from 2 December 2027 and AI in Annex I products from 2 August 2028⁶⁷.

Example

Software that screens CVs and ranks job applicants falls under Annex III, because it is used to analyse and filter job applications and evaluate candidates². A UK recruiter selling such a tool to employers in the EU would need to meet the high-risk rules from December 2027⁶.

Why it matters

These are the AI tools most likely to decide whether you get a job, a loan or a benefit. The high-risk label is what gives people in the EU a right to expect testing, records and a human able to step in.

Questions people ask

What counts as a high-risk AI system?

AI that is a safety component of a regulated product, such as a medical device or machinery, or AI used in areas listed in Annex III: biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration, and justice and elections¹².

When do the EU high-risk AI rules apply?

After the 2026 Digital Omnibus, from 2 December 2027 for systems listed in Annex III, and from 2 August 2028 for AI built into products covered by EU product-safety law⁶.

Is a chatbot a high-risk AI system?

Not by default. High-risk status depends on what a system is used for, not how it is built. A general chatbot is not on the Annex III list, but a system used to evaluate job candidates or creditworthiness would be high-risk².

Related terms

Sources

Back to the glossary