AI Act: Identify High-Risk Areas Before Establishing Compliance

GAIGI Team

— 4 min de lecture
Partager

On May 19, 2026, the European Commission published draft guidelines on the classification of high-risk AI systems under Article 6 of the AI Act. The targeted consultation is open until June 23, 2026. The document does not replace the provider’s decision; rather, it provides a framework through interpretations and practical examples. However, this initial classification determines the obligations, the documentation, and, where applicable, the conformity assessment to be conducted.

Updated September 10, 2026. Regulation (EU) 2026/1744 amending the AI Act was published in the Official Journal on July 24, 2026, and entered into force on July 27. The new deadlines for high-risk systems are now set for December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Full details in our reference article.

The Essentials in 30 Seconds

  • The draft guidelines were published on May 19, 2026 by the European Commission.
  • The targeted consultation opened on May 19 and is scheduled to close on June 23, 2026.
  • Article 6(1) applies to certain safety products and components listed in Annex I that are subject to third-party assessment.
  • Article 6(2) applies to the use cases listed in Annex III.
  • A supplier who rules out high risk for a system listed in Annex III must document its analysis prior to placing the product on the market or putting it into service.

What Happened

The Commission presents these guidelines as a tool for suppliers, deployers, and competent market surveillance authorities. Their purpose is to help assess whether a system should be classified as high-risk, in order to promote a uniform and effective application of Article 6. The draft follows the structure of this article and provides practical examples of systems that should—or should not—be considered high-risk.

The targeted consultation, which opened on May 19, 2026, specifically seeks feedback on the clarity of the guidelines and the usefulness of their examples. The Commission’s webpage is aimed at suppliers and developers, user organizations, public authorities, researchers, civil society, supervisory bodies, and the public. As of the date of this briefing, the announced closing date is June 23, 2026. The consultation is therefore also an opportunity to flag any ambiguities in classification before the final version is released.

The draft must be read for what it is. It sets out the Commission’s interpretation of concepts relevant to classification and provides non-exhaustive examples that are subject to change. It does not shift the primary responsibility for the operation: the classification of a commercialized system begins with the supplier, based on knowledge of its intended use, its functions, and its intended context of use.

The Two Provisions of Article 6

The first provision is Article 6(1). A system is considered high-risk when two conditions are met: it is intended to be used as a safety component of a product, or it constitutes a product in its own right, covered by the Union harmonization legislation listed in Annex I; and that product, or the system itself, must undergo a third-party conformity assessment before being placed on the market or put into service. This provision is therefore not limited to the label “regulated product”: both conditions must be verified.

The second provision is Article 6(2). The systems listed in Annex III are, in addition to those in paragraph 1, considered high-risk. The guidelines organize their sections according to this distinction and seek to illustrate the relevant areas and use cases. For a company, it is useful to establish a separate qualification document for each system rather than relying on the tool’s general category or a commercial assertion by the upstream supplier.

The intended use is decisive. The same technical component may be integrated into products or deployed in contexts that do not trigger the same legal test. A proper classification therefore describes the system, its role in the decision or product, the intended user, the individuals affected, and the human oversight interfaces. This description must precede the selection of controls; otherwise, the organization risks building a robust system that is applicable to the wrong category.

The Exception and the Supplier Trace

Article 6(3) provides for a limited exception for systems listed in Annex III that do not pose a significant risk to health, safety, or fundamental rights, in particular because they do not materially influence the outcome of a decision-making process. The Regulation lists four possible scenarios: a narrow procedural task; improvement of the outcome of a human activity that has already been carried out; detection of patterns or anomalies without replacing or influencing the prior human assessment without appropriate human review; and a preparatory task for an assessment related to Annex III use cases.

This exception is not a simple checkbox. Annex III systems that profile natural persons are always considered high-risk. Most importantly, when a provider determines that an Annex III system is not high-risk, Article 6(4) requires the provider to document that assessment prior to placing the system on the market or putting it into service. The supplier remains subject to the registration requirement under Article 49(2) and must provide this documentation to the competent national authority upon request.

Classification is thus a documented governance decision, not a simple product analysis. It defines the scope of the quality management system, risk management, data management, technical documentation, and post-market surveillance. It also determines whether to anticipate a conformity assessment under Annex I or to implement the regime applicable to Annex III.

What to Do Now

  • Establish a qualification register — record, system by system, the intended use, the Article 6 test, and the conclusion.
  • Test both tracks — examine Annex I separately with the third-party assessment, then Annex III and its use cases.
  • Document any exceptions — for Article 6(3), link the system’s facts to the condition invoked and retain the evidence.
  • Verify profiling — do not rule out high risk when the Annex III system performs profiling of natural persons.
  • Respond to the consultation — report any vague examples or insufficiently addressed use cases by June 23.

Sources

  • European Commission, targeted consultation opened on May 19, 2026; subject, target audience, and announced deadline: digital-strategy.ec.europa.eu
  • European Commission, draft guidelines, structure of the scenarios in paragraphs 1 and 2 of Article 6, and role of the examples: digital-strategy.ec.europa.eu
  • EUR-Lex, Article 6 of Regulation (EU) 2024/1689, criteria, exception, profiling, and the provider’s documentation requirement: eur-lex.europa.eu

Lire la suite