Hochrisiko-KI-Systeme nach der EU-KI-Verordnung: Vollständiger Leitfaden

Why High-Risk Classification Matters

The EU AI Act's compliance obligations are concentrated almost entirely on high-risk AI systems. Minimal-risk systems face no mandatory requirements. Limited-risk systems need only transparency disclosures. But high-risk systems must meet a comprehensive set of requirements covering documentation, risk management, data governance, human oversight, accuracy, cybersecurity, conformity assessment, registration, and ongoing monitoring.

Getting the classification right is therefore the most consequential step in EU AI Act compliance. Misclassifying a high-risk system as limited risk leaves you exposed to penalties of up to €15 million or 3% of global annual turnover. Misclassifying a limited-risk system as high risk wastes resources on unnecessary compliance work.

Two Pathways to High-Risk

The AI Act establishes two independent pathways for high-risk classification. A system only needs to trigger one.

Pathway 1: Safety Component (Article 6(1))

An AI system is high-risk if both conditions are met:

1. The AI system is used as a safety component of a product, or is itself a product, covered by EU harmonisation legislation listed in Annex I of the AI Act
2. That product is required to undergo a third-party conformity assessment under the applicable harmonisation legislation

Annex I covers existing EU product safety legislation including:

• Machinery Regulation (EU) 2023/1230
• Medical Devices Regulation (EU) 2017/745
• In-Vitro Diagnostic Medical Devices Regulation (EU) 2017/746
• Radio Equipment Directive 2014/53/EU
• Civil Aviation Regulation (EU) 2018/1139
• Motor Vehicle Type-Approval Regulations
• Marine Equipment Directive 2014/90/EU
• Rail Interoperability Directive (EU) 2016/797
• And others

Examples: An AI system that controls braking decisions in an autonomous vehicle. An AI-powered diagnostic tool classified as a medical device. An AI component managing safety-critical functions in industrial machinery.

Application date: August 2, 2027 (one year later than Pathway 2).

Pathway 2: Annex III Listed (Article 6(2))

An AI system is high-risk if it falls into one of the use case categories listed in Annex III of the AI Act. This is the pathway that applies to most business AI systems.

Application date: August 2, 2026.

The Eight Annex III Categories

Category 1: Biometrics

Note: Real-time biometric identification in public spaces for law enforcement is not high-risk — it is prohibited under Article 5(1)(h), with three narrow exceptions requiring judicial authorization. Emotion recognition in the workplace and education is also prohibited (Article 5(1)(f)), except for medical or safety purposes.

Category 2: Critical Infrastructure

The system must be a safety component — not just any software used by a utility or infrastructure provider. An AI-powered billing system at an energy company is not high-risk. An AI system making decisions about power distribution is.

Category 3: Education and Vocational Training

Category 4: Employment, Worker Management, Access to Self-Employment

This category is particularly relevant for SMEs. Any AI tool used in hiring or employee evaluation falls here — including third-party SaaS tools. If you use an AI-powered applicant tracking system, you are a deployer of a high-risk AI system.

Category 5: Access to Essential Services

The fraud detection exception in 5(b) is notable. Banks using AI solely for fraud detection do not trigger high-risk classification for that system, even though credit scoring and lending AI does.

Category 6: Law Enforcement

Category 7: Migration, Asylum, and Border Control

Category 8: Administration of Justice and Democratic Processes

The Article 6(3) Exception: When High-Risk Can Be Downgraded

Not every Annex III system is automatically high-risk. Article 6(3) provides an exception pathway that can downgrade a system that technically falls within an Annex III category.

The exception applies when a system meets both conditions:

Condition 1: Limited Function

The system performs only one of the following:

• (a) A narrow procedural task (e.g., data format conversion, document sorting)
• (b) Improving the result of a previously completed human activity (e.g., spell-checking a human-written assessment)
• (c) Detecting patterns for human review without replacing or influencing the human assessment (e.g., anomaly flagging)
• (d) A preparatory task for a human assessment (e.g., data gathering before a human makes the decision)

Condition 2: No Profiling

The system does not profile natural persons. The GDPR Article 4(4) definition of profiling applies: automated processing of personal data to evaluate personal aspects such as work performance, economic situation, health, preferences, reliability, behavior, location, or movements.

If profiling is involved, the system is always high-risk — the Article 6(3) exception cannot apply, regardless of the function.

Exception Obligations

Even when the exception applies and the system is downgraded, the provider must:

1. Document the assessment explaining why the exception applies
2. Register the system in the EU database with the documented reasoning (Article 49(2))
3. Notify the relevant market surveillance authority

This is not a "get out of compliance free" card. It is a documented exception with its own obligations.

Provider Obligations for High-Risk Systems

Providers — those who develop high-risk AI systems or place them on the market under their name — bear 19 distinct obligations:

Conformity Assessment: Self or Third-Party?

Most high-risk systems undergo self-assessment based on Annex VI. The provider verifies their own compliance, issues a declaration of conformity, and affixes the CE marking.

Third-party assessment by a notified body (Annex VII) is required only for biometric identification systems (Annex III, Category 1), unless the provider has applied harmonised standards covering all requirements and follows the QMS assessment path.

Deployer Obligations for High-Risk Systems

Deployers — those who use high-risk AI systems under their authority — have a lighter but still significant set of obligations:

Role Shifting Warning

Article 25 specifies that a deployer becomes a provider — inheriting all 19 provider obligations — if they:

• Put their own name or trademark on a high-risk AI system
• Make a substantial modification to the system
• Change the intended purpose of any AI system in a way that makes it high-risk

This is a critical consideration for companies that customize or rebrand third-party AI tools.

Timeline: When Do High-Risk Obligations Apply?

There is a transitional provision: high-risk AI systems already on the market before August 2, 2026 need to comply only if they undergo a significant design change after that date. The exception: systems used by public authorities must comply regardless.

Getting Started

Classification is the foundation. If you are unsure whether your AI system is high-risk, the Witness AI System Classifier walks you through the decision tree in about three minutes — covering the Article 5 prohibitions check, Annex III category matching, and the Article 6(3) exception assessment. It identifies your risk level, your role, and the specific obligations that apply.