EU AI Act High-Risk AI Rules: What Providers Must Do Before 2027

The key point is timing: the European Union’s full obligations for high-risk AI systems have been postponed, rather than already taking effect. Stand-alone high-risk systems listed in Annex III are scheduled to face the requirements from 2 December 2027. High-risk AI that forms part of certain regulated products has a later date of 2 August 2028. 18

For companies that plan to place these systems on the EU market, the practical task is to build a compliance process that can demonstrate safety, traceability and accountability before launch.

Which AI systems are considered high risk?

The high-risk category covers two broad groups:

• AI systems used as safety components of products governed by specific EU product laws, where those products require a third-party conformity assessment.
• AI systems used in certain Annex III areas, subject to the Act’s qualifications and exceptions. 15

In practice, the classification matters because high-risk status triggers a far more demanding set of lifecycle obligations than applies to ordinary AI tools.

The compliance requirements providers must prepare for

Before a high-risk system can be placed on the EU market, its provider will need controls that are designed into the product lifecycle—not assembled only after a regulator asks questions.

Risk management and data governance

Providers must establish risk-assessment and risk-mitigation measures. They must also use datasets of sufficient quality to reduce the risk of discriminatory outcomes. The Act’s high-risk framework emphasizes relevant, representative and appropriately governed training, validation and testing data. 115

Documentation and traceability

High-risk systems must maintain logs that support traceability, alongside detailed technical documentation describing the system and its intended purpose. That evidence enables authorities to assess whether the system complies with the rules. 1

Human oversight and operational resilience

The EU also requires appropriate human-oversight measures and a high level of accuracy, robustness and cybersecurity. Providers must give deployers clear, adequate information so the system can be used as intended and with an understanding of its limitations. 1

Conformity assessment, registration and monitoring

Providers will need to complete the applicable conformity assessment before placing a high-risk system on the market. Where required, they must register the system, monitor performance after release and report serious incidents. These duties make compliance an ongoing operating function, rather than a one-time product approval exercise. 115

A practical high-risk AI readiness checklist

Organizations preparing for the 2027 and 2028 deadlines should be able to answer the following questions:

1. Is the system actually high risk? Map its use case against the Annex I and Annex III categories.
2. Who is accountable? Assign ownership for product safety, legal compliance, documentation and incident response.
3. Can risks be evidenced and mitigated? Maintain a repeatable risk-management process, with testing and decision records.
4. Are the data controls defensible? Document dataset relevance, representativeness, quality checks and known limitations.
5. Can the system be audited? Preserve logs, technical files and user-facing instructions that explain intended use and constraints.
6. Does human oversight work in practice? Define when people can intervene, override outputs or stop use of the system.
7. Is post-market monitoring operational? Prepare processes for performance monitoring, corrective action and incident reporting.

Potential fines under the EU AI Act

The AI Act uses penalties tied to both fixed euro amounts and worldwide annual turnover. The most severe tier—covering prohibited AI practices—can reach €35 million or 7% of worldwide annual turnover. Other non-compliance can carry penalties of up to €15 million or 3% of worldwide annual turnover. 3

The size of the potential penalties means a high-risk AI program should involve more than legal review. Product, security, data science, procurement, compliance and operational teams all need evidence that the safeguards are functioning.

Why the delayed deadline still matters now

The revised dates give companies more time to prepare, but the core requirements remain extensive. A provider that waits until late 2027 may still need to build documentation systems, revise model-development practices, implement logging, test oversight processes and establish post-market reporting workflows.

The most useful approach is to treat the EU AI Act as a product-governance standard: identify high-risk use cases early, collect evidence as the system is built, and make safety, traceability and human control part of the release process from the start. 115