What is a high-risk AI system under the EU AI Act?

A high-risk AI system is one used in a sensitive area listed in Annex III - such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice - or as a safety component of a regulated product.

What must high-risk AI providers do?

They must implement risk management, data governance, technical documentation, logging, transparency, human oversight, and accuracy/robustness measures, and undergo conformity assessment.

When do high-risk obligations apply?

High-risk obligations phase in through 2027 - product-safety AI (Annex I) by August 2027 and standalone Annex III systems by December 2027 under the Digital Omnibus.

CSOAI - Annex III

What counts as high-risk AI?

The EU AI Act's heaviest obligations fall on high-risk systems. These are the eight Annex III categories - if your AI lands in one, the full regime applies.

1Biometrics

Remote biometric identification, biometric categorisation, and emotion recognition.

2Critical infrastructure

AI as a safety component in road traffic, water, gas, heating, and electricity.

3Education + vocational training

Admissions, scoring of exams, and monitoring of prohibited behaviour during tests.

4Employment + worker management

Recruitment, CV screening, promotion, termination, and task allocation.

5Access to essential services

Credit scoring, insurance pricing, public benefits, and emergency-call dispatch.

6Law enforcement

Risk assessments of individuals, evidence reliability, and profiling.

7Migration, asylum + border control

Visa and asylum risk assessment, document verification.

8Justice + democratic processes

Assisting judicial decisions and influencing elections or voting behaviour.

In a category? The full high-risk regime applies - risk management, data governance, documentation, logging, human oversight, and conformity assessment. The Council builds and signs that evidence.

Readiness checklist ->Scan my readiness ->EU AI Act, explained ->

Ask the Sovereign — EU AI Act Annex III high-risk AI systems

Governed answer · AI governance & cybersecurity only · signed to Layer 0

Open the full AI OS →