Which AI systems are high-risk, and who decides

Which AI systems are high-risk under the EU AI Act is not decided by the technology. Systems built on the same language model can fall outside the high-risk rules in one task and squarely inside them in the next, and what separates the tasks is what the system is said to be for. An organisation that classifies its tools by what they are, rather than by what they are for, gets the answer wrong in both directions.

Which AI systems are high-risk under the EU AI Act?

The EU AI Act has two routes to high risk. The first covers AI that is a safety component of, or is itself, a product that is already regulated and has to undergo third-party conformity assessment, from medical devices to lifts. The second is Annex III, and that is the one most organisations meet. It lists mainly uses rather than technologies: recruitment and selection, decisions on terms of employment and promotion, creditworthiness assessment of individuals, pricing of life and health insurance, admission to and assessment in education, and a few other areas.

The wording in the annex is almost always the same. It concerns AI systems intended to be used for a particular purpose. Article 3(12) defines the intended purpose as the use for which the provider intends the system, including the context and conditions of use, as specified in the instructions for use, the promotional or sales materials and statements, and the technical documentation. What gets classified, in other words, is a description of the use, and the provider writes that description.

The requirements for Annex III systems apply from 2 December 2027, since amending Regulation (EU) 2026/1744 moved the date. How that shift affects planning is covered in the article on the postponed high-risk deadline. This article is about the question that decides whether the date applies to you at all.

One language model, four uses in HR, three classes

In May 2026 the Commission published draft guidelines on classification, with examples intended to cover every area of Annex III. Under Article 6(5) the guidelines were due by 2 February 2026, and the draft is still a draft: according to the Commission's page, feedback from the consultation, which closed on 23 July, is to be incorporated into a final version before adoption.

The examples for employment are the most instructive. Four of them describe tasks that one and the same generative language model could perform. The draft does not mention a language model, and in the job advertisement example the system relies on patterns and terms defined and reviewed by human experts:

That is three classes for four uses, and the difference between them lies in the task, not in the model. The third row is high-risk because the system affects who goes forward, and the fourth shows that a tool can change class without anyone touching the technology, if it is turned into a tool for assessing staff.

The draft also illustrates a rule that settles some answers outright. Under Article 6(3), an Annex III system is always high-risk if it performs profiling of natural persons, which Article 3(52) defines by reference to the GDPR. Background checks on job applicants, which combine education, employment history and online information into a risk score, fall under point 4(a) according to the draft, and because the system profiles, no exemption can apply.

Who decides what the system is for?

Because the intended purpose is the provider's description, the assessment rests first with the provider. The draft draws a consequence from that which is worth knowing at every purchase. Where a provider presents a system as broadly applicable across many contexts, without consistently limiting its use or excluding high-risk uses, the intended purpose is, according to the draft, deemed to cover the high-risk uses as well. That applies in particular, the draft adds, where such uses are feasible and reasonably foreseeable given the system's functionalities and capabilities. Stating in the terms of service that such uses are excluded is not enough if the product's presentation and examples in practice promote them.

Classification follows the sentence that describes what the system is for.

The reverse case is the one that reaches the buyer. If an organisation modifies the intended purpose of a system that has not been classified as high-risk and has already been placed on the market or put into service, so that it becomes a high-risk system under Article 6, the organisation itself becomes the provider of a high-risk system under Article 25(1)(c), with the provider's obligations. Article 25 also makes the position costlier than it sounds. Under paragraph 2, the initial provider must cooperate with the new one and, among other things, make technical documentation available, but neither the cooperation nor the handover applies if the provider has clearly specified that its system is not to be changed into a high-risk system.

An organisation that has a general-purpose assistant rank applicants can therefore end up with the provider's responsibility and without the provider's documentation. It may be the same assistant that checks the wording of the job advertisements, and the use is the only thing that differs.

A provider that considers an Annex III system not to be high-risk must document its assessment before the system is placed on the market or put into service, register the system in the EU database, and hand over the assessment on request from national authorities. The amending regulation simplified what the registration must contain, but not the duty to document. A no without a recorded reason is therefore not a classification.

Classification has been hard even for those who tried

Two studies with different methods point the same way. In 2023 the appliedAI initiative classified 106 AI systems from business functions such as marketing, purchasing, production and HR. 19 came out high-risk, 44 low-risk and 42 could not be determined, while one might have been prohibited. Nine of ten HR systems were classified as high-risk.

That classification started from the Commission's 2021 proposal, with references to the Parliament's and the Council's amendments, which means before the exemption in Article 6(3) had its final wording. The two sources concern different systems and are not directly comparable, but the contrast is instructive. Under the draft texts, HR came out almost entirely high-risk. Under the adopted text, as the Commission reads it, the same area is divided by use: scheduling interviews, sorting CVs into a searchable database and auditing past hiring decisions retrospectively on anonymised data fall within the annex according to the draft but are exempt, while ranking and scoring applicants are not.

The second study applies the adopted text. A study by the Technical University of Munich and Siemens had 78 employees of a global company with more than 100,000 staff classify AI systems with a decision-support tool, eleven under observation and 67 on their own. 21 of the 67 said they had difficulty with particular questions. The arXiv text is the authors' submitted version rather than the final conference version, and the population is a single company. One finding from the observed sessions is still clear: a clear description of the system's purpose, functionality and context of use makes classification easier, and systems with several uses are hard to delimit.

The objection: it is not the use that decides, but the intended purpose

There is a countervailing point that carries weight. Saying that high risk follows the use is, strictly, wrong. The regulation ties classification to the purpose the provider intended, and the draft explicitly distinguishes that from reasonably foreseeable misuse, which by definition lies outside the intended purpose. An employee who, on their own initiative, ranks applicants with a writing assistant does not by that alone turn the provider's product into a high-risk system, as long as the provider has limited the intended purpose clearly and consistently across all its materials.

The objection is right about the provider's product. But it only moves the question to the buyer. When the organisation itself chooses to use a system for something other than what the provider described, it is the organisation's use that has to be classified, and Article 25(1)(c) can then make the organisation the provider. The Commission has said that separate guidelines on Article 25 will explain in more detail when that happens. Classification follows the use that someone has described. If nobody has described the use you have, you are the one describing it.

The draft is also still a draft. The examples may change in the final version, and the Commission says they are not exhaustive. The interpretive responsibility the guidelines are meant to ease stays with whoever does the classifying.

Which of your AI systems can you not classify without the provider's material?

The criterion is a comparison that can be made system by system. Take each AI system used in any of the Annex III areas, and write two sentences side by side: what the provider's instructions for use and sales material say the system is for, and what you actually use it for.

The answers divide organisations. Those who can write both sentences and find that they say the same thing have the provider's classification to review, and can ask the provider for its documented assessment if the system is said to fall under the exemption, although the provider is only obliged to hand it to national authorities. Those who find that their use is broader than, or different from, the one described have a classification of their own to make, and possibly a provider's responsibility. Those who cannot write the first sentence, because nobody has read the provider's material, do not know which class the system is in, whatever the technology.

Which point in Annex III a system meets is decided by the described purpose, and if you use the system for something other than the provider described, it is your purpose that has to be classified. Whether an exemption holds also depends on what the system actually does: a system that profiles people, or that materially influences the outcome of decisions, cannot be exempt. That is why the classification in AI governance work is done per purpose and not per tool.