How the EU’s Draft Guidelines Classify High‑Risk AI Systems Under the AI Act

1. Product‑Safety Route (Annex I)

An AI system is considered high‑risk if it is:

• A safety component of a product, or
• An AI system that is itself a regulated product

and that product falls under EU harmonised product safety legislation listed in Annex I, such as rules covering machinery, medical devices, or other regulated equipment. In these cases, the product must undergo a third‑party conformity assessment before entering the EU market.

This route primarily applies to AI embedded in physical products where failures could pose safety risks.

2. Stand‑Alone Use‑Case Route (Annex III)

The second pathway applies to AI systems used in specific high‑risk contexts listed in Annex III, even when they are not part of a regulated product. These include systems used in areas such as:

• Biometric identification
• Critical infrastructure
• Education and vocational training
• Employment and worker management
• Access to essential services (e.g., credit scoring)
• Law enforcement
• Migration, asylum, and border control
• Administration of justice and democratic processes

If an AI system is intended for one of these uses, it generally qualifies as high‑risk under Article 6(2).

When Annex III Systems May Avoid High‑Risk Status

The AI Act includes a narrow exception in Article 6(3) allowing some Annex III systems to avoid high‑risk classification.

To qualify for this derogation, the AI system must not pose a significant risk of harm to health, safety, or fundamental rights, including situations where it does not materially influence the outcome of decisions affecting individuals.

According to the draft guidelines, the exemption may apply where the AI system:

• Performs a limited procedural or administrative task
• Improves or refines a result produced by a previously completed human activity
• Detects patterns or deviations in decision‑making without replacing or influencing human judgment
• Performs a preparatory step before the main Annex III decision process

However, the derogation cannot be used for systems that perform profiling of natural persons, which remain high‑risk when they fall within Annex III domains.

The 2026 Public Consultation

The Commission published the draft guidelines and launched a targeted consultation running from 19 May to 23 June 2026 (22:00 CET).

The consultation aims to gather feedback on:

• The clarity of the classification framework
• The usefulness of practical examples in the draft guidance

Stakeholders—including AI providers, deployers, and market‑surveillance authorities—can submit input through a structured questionnaire. The feedback will inform the final version of the guidelines.

New Compliance Deadlines Under the AI Act “Omnibus” Changes

Alongside the draft guidance, EU policymakers agreed to delay the application of key high‑risk AI obligations through amendments commonly referred to as the AI Act Omnibus.

The updated timeline now sets fixed compliance dates:

• 2 December 2027: obligations for stand‑alone high‑risk systems under Article 6(2) and Annex III
• 2 August 2028: obligations for AI embedded in regulated products under Article 6(1) and Annex I

These delays aim to give regulators and industry time to develop technical standards, compliance tools, and certification frameworks necessary to implement the high‑risk regime effectively.

Where the Guidelines Fit in the EU AI Act Rollout

The AI Act entered into force on 1 August 2024, but its provisions apply gradually.

Key milestones include:

• 2 February 2025: prohibitions on certain unacceptable‑risk AI practices and AI literacy obligations began to apply.
• August 2025: governance rules and obligations for general‑purpose AI models became applicable.
• August 2026: transparency rules start to apply.

Meanwhile, the EU is building supporting infrastructure such as harmonised technical standards to help organisations demonstrate compliance; the first AI‑related standard for quality management systems entered public enquiry in October 2025.

Within this broader rollout, the new classification guidance acts as a practical interpretation layer. It does not change the law itself but explains how to determine whether an AI system falls into the high‑risk category under Article 6 before the delayed compliance deadlines arrive.

What Organizations Should Do Now

For companies developing or deploying AI in the EU, the draft guidance effectively outlines a three‑step classification process:

1. Determine whether the system is part of a regulated product under Annex I.
2. Check whether the system fits a high‑risk use case listed in Annex III.
3. Assess whether the Article 6(3) derogation could apply and document the reasoning.

Even though enforcement deadlines are still years away, design choices, documentation, and stated intended use will influence whether a system ultimately falls inside the EU’s high‑risk AI regime.