The label depends on the use, not the model. The same language model is not high-risk when it drafts marketing copy, but a tool built on it to rank job applicants falls in Annex III’s employment area, which explicitly lists systems that analyse and filter job applications and evaluate candidates. The other route is product safety: AI that serves as a safety component of a product already covered by EU safety law, such as a medical device.
Providers of high-risk systems must meet the requirements in Articles 8 to 15 of the EU AI Act: a risk management system, data governance for training and test data, technical documentation, automatic record-keeping (an audit trail), transparency to deployers, human oversight, and accuracy, robustness and cybersecurity. Some deployers must also run a fundamental rights AI impact assessment.
Timing has moved. In the amended text shown on the AI Act Explorer as of October 24, 2026, the Annex III obligations apply from December 2, 2027 and the product-safety route from August 2, 2028. Check the current text before relying on a date. Editorially, the category matters even outside Europe because it is a useful test for any team: if a system decides who gets a job, a loan or an education, expect regulators and customers to want this level of evidence.
Sources
- EU AI Act Explorer: Article 6, Classification Rules for High-Risk AI Systems — Sets the two routes to high-risk status (product safety components and Annex III uses) and shows application dates of 2 December 2027 for Annex III and 2 August 2028 for Article 6(1) in the amended text; checked October 24, 2026.
- EU AI Act Explorer: Annex III, High-Risk AI Systems Referred to in Article 6(2) — Lists the high-risk areas, including biometrics, education and employment, with recruitment and filtering of job applications as an example; checked October 24, 2026.
- EU AI Act Explorer: Article 10, Data and Data Governance — One of the requirements in Articles 8 to 15 (risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity); checked October 24, 2026.