What it asks for. An AI system is high-risk if it is a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I and that product must undergo third-party conformity assessment. Systems used in the areas listed in Annex III, such as employment, education, credit scoring, essential services, law enforcement and migration, are also high-risk.
In practice. An Annex III system is not high-risk where it does not pose a significant risk of harm, for example when it performs a narrow procedural task, improves the result of a completed human activity, detects decision patterns without replacing human assessment, or performs a preparatory task. A system that profiles natural persons is always high-risk. A provider relying on this derogation must document its assessment before placing the system on the market and register the system. Organisations should keep an AI inventory with a recorded classification decision, rationale and owner for each system.
Common gaps. Organisations often classify systems informally, rely on the derogation without written assessment, or overlook profiling, which removes the exemption.