Classify the system against Article 6 / Annex III
Determine whether the system is high-risk: does it fall in an Annex III domain AND perform a listed function (6(2)), or is it an Annex I product/safety-component (6(1))? Apply the 6(3) not-significant-risk exception only with a documented justification.
- Applies to
- Provider, Deployer
- Applies from
- 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply
- Primary source
- Art. 6 AIA · Annex III AIA · Commission draft HRAI guidelines, 19 May 2026
Evidence an auditor expects
- High-risk classification decision record — Documented Article 6 determination: Annex III domain + function match (or 6(1) product route), and any 6(3) exception justification.
Audit red flags
Fails an audit
- Relying on the Article 6(3) 'not significant risk' exception without a documented justification.
Common mistakes
- Assuming that landing in an Annex III domain automatically makes the system high-risk.
Fix: The system must also perform one of the specific functions listed for that domain; otherwise it is not high-risk via 6(2).
FAQ
What evidence do I need for Article 6?
High-risk classification decision record. Each should be contemporaneous, versioned, and traceable to the system version.
When does “Classify the system against Article 6 / Annex III” apply?
From 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply. It applies to: Provider, Deployer.
What fails an audit here?
Relying on the Article 6(3) 'not significant risk' exception without a documented justification.
Legal source
Art. 6 AIA · Annex III AIA · Commission draft HRAI guidelines, 19 May 2026
Explained in the newsletter
- Draft high-risk guidelines: what the EC's May 19 text changes for your Article 6 argument
- Annex III of the EU AI Act: which AI use cases are high-risk in 2026
Stay audit-ready as the Act changes
EU AI Regulation Decoded tracks each obligation and the evidence auditors expect — one practitioner email a week.
Subscribe — free, weeklyNot legal advice. This is a practitioner reference generated from a cited knowledge base built on the primary legal text and official Commission guidance. Verify against the cited primary sources before relying on it for a compliance decision. See editorial standards & methodology.