Classify the system against Article 6 / Annex III

Determine whether the system is high-risk: does it fall in an Annex III domain AND perform a listed function (6(2)), or is it an Annex I product/safety-component (6(1))? Apply the 6(3) not-significant-risk exception only with a documented justification. For the 6(1) route, apply the Art. 6(1a)–(1c) carve-outs first: AI used solely for non-safety assistance, optimisation, convenience or quality control is not a safety component unless its failure would endanger health and safety, and third-party assessment required only for non-safety risks does not count.

Applies to

Provider, Deployer

Scope

High-risk (Annex III use case), High-risk (Annex I regulated product)

Applies from

2027-12-02 — Stand-alone high-risk (Annex III) obligations apply

Derives from

Article 6 · Annex III

Primary source

Art. 6 AIA · Annex III AIA · Commission draft HRAI guidelines, 19 May 2026 · Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27 July 2026

Evidence an auditor expects

• High-risk classification decision record — Documented Article 6 determination: Annex III domain + function match (or 6(1) product route), and any 6(3) exception justification.

Audit red flags

Common mistakes

• Assuming that landing in an Annex III domain automatically makes the system high-risk.
  Fix: The system must also perform one of the specific functions listed for that domain; otherwise it is not high-risk via 6(2).

FAQ

What evidence do I need for Article 6?
High-risk classification decision record. Each should be contemporaneous, versioned, and traceable to the system version.

When does “Classify the system against Article 6 / Annex III” apply?
From 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply. It applies to: Provider, Deployer.

What fails an audit here?
Relying on the Article 6(3) 'not significant risk' exception without a documented justification.

Legal source

Art. 6 AIA · Annex III AIA · Commission draft HRAI guidelines, 19 May 2026 · Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27 July 2026

Explained in the newsletter

• Draft high-risk guidelines: what the EC's May 19 text changes for your Article 6 argument
• Annex III of the EU AI Act: which AI use cases are high-risk in 2026

Not legal advice. This is a practitioner reference generated from a cited knowledge base built on the primary legal text and official Commission guidance. Verify against the cited primary sources before relying on it for a compliance decision. See editorial standards & methodology.