{"head":{"title":"Is My AI System High-Risk Under the EU AI Act? | OceanLab","description":"How to tell if your AI system is high-risk under the EU AI Act: the Annex I and Annex III routes, the Article 6(3) exemption and the 2027 and 2028 dates.","canonical":"https://oceanlab.in/questions/is-my-ai-system-high-risk"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"Is my AI system high-risk under the EU AI Act?","path":"/questions/is-my-ai-system-high-risk"}],"question":"Is my AI system high-risk under the EU AI Act?","answer":["It is high-risk if it is a safety component of a product covered by the EU laws in Annex I that needs a third-party conformity assessment, or if it is used in one of the areas listed in Annex III, such as hiring, credit, education or essential services, unless a narrow exemption applies. After the 2026 Digital Omnibus, the high-risk rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems."],"sections":[{"heading":"Work through it in this order","body":[],"bullets":[["Is it an AI system under the Act's definition, and is it placed on the EU market or its output used in the EU? If not, the Act may not apply."],["Is it a prohibited practice under Article 5, such as social scoring or emotion recognition at work or school? Those are banned, not high-risk."],["Is it a safety component of, or itself, a product under the Annex I laws (such as medical devices or machinery) that needs a third-party conformity assessment? Then it is high-risk, from 2 August 2028."],["Is it used in an Annex III area: biometrics, critical infrastructure, education, employment, essential services such as credit or insurance, law enforcement, migration, or justice and democratic processes? Then it is high-risk from 2 December 2027, unless Article 6(3) applies."],["Does Article 6(3) apply? An Annex III system is not high-risk if it does not pose a significant risk, for example because it only does a narrow procedural task or improves work a person already finished. It never applies to systems that profile people. Document the assessment."],["If none of these, check Article 50 transparency duties, for example telling people they are talking to an AI or marking AI-generated content."]]},{"heading":"What changes for the software if it is high-risk","body":[["Providers need a risk management system, data governance, technical documentation, automatic logging, instructions for deployers, ",{"href":"/glossary/human-in-the-loop","text":"human oversight"},", accuracy, robustness and cybersecurity, a quality management system, a conformity assessment and registration in the EU database. Deployers have duties too, such as using the system as instructed and keeping logs."],["Most of these are easier to design in than to add later, especially logging, oversight screens and documented ",{"href":"/glossary/llm-evals","text":"evaluation"},"."]],"bullets":[]}],"faqs":[{"question":"Is a general chatbot high-risk?","answer":"Usually not by itself. Risk depends on the use. The same model used to screen job applicants or decide on credit falls into Annex III, while a general help chatbot usually only has transparency duties."},{"question":"We are not based in the EU. Does this apply to us?","answer":"It can. The Act applies to providers placing AI systems on the EU market and to cases where the output is used in the EU, wherever the provider is based."},{"question":"Did the Digital Omnibus change what counts as high-risk?","answer":"The main change for most teams is timing: it moved the start of the high-risk rules to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Check the official text for the details that affect you."}],"terms":[{"href":"/glossary/high-risk-ai-system","label":"high-risk AI system"},{"href":"/glossary/human-in-the-loop","label":"human-in-the-loop"},{"href":"/glossary/guardrails","label":"guardrails"},{"href":"/glossary/llm-evals","label":"LLM evals"},{"href":"/glossary/ai-agent","label":"AI agent"}],"tools":[{"href":"/tools/eu-ai-act-risk-checker","label":"EU AI act risk checker","detail":"Free tool"},{"href":"/tools/ai-readiness-assessment","label":"AI readiness assessment","detail":"Free tool"}],"links":[{"href":"/compliance/eu-ai-act","label":"EU AI Act guide","detail":"Risk classes, duties and the current dates."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/ai","label":"AI by industry","detail":"AI use cases, costs and risks per industry."}],"related":[{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"},{"href":"/questions/how-to-reduce-llm-api-costs","label":"How do I reduce LLM API costs?","detail":"Question"},{"href":"/questions/who-owns-the-code","label":"Who owns the code when you hire a software agency?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"Regulation (EU) 2024/1689, the AI Act (Official Journal)","url":"https://data.europa.eu/eli/reg/2024/1689/oj","checkedAt":"2026-10-25"},{"title":"Regulation (EU) 2026/1744, Digital Omnibus on AI (Official Journal)","url":"https://data.europa.eu/eli/reg/2026/1744/oj","checkedAt":"2026-10-25"},{"title":"European Commission, AI Act overview","url":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}