High-Risk AI Systems Under the EU AI Act

The EU AI Act classifies certain AI use cases as high-risk. If your system falls into one of these categories, you inherit a long list of obligations before you can lawfully place it on the EU market.

The Annex III categories in plain English

• Biometric identification and categorisation of natural persons
• Management of critical infrastructure (energy, water, traffic)
• Education and vocational training (admissions, scoring, proctoring)
• Employment (recruitment, task allocation, performance evaluation)
• Access to essential private and public services (credit scoring, benefits, insurance)
• Law enforcement, migration, border control, administration of justice
• Democratic processes (e.g. influencing elections)

Core obligations for providers

1. Risk management system across the full lifecycle
2. Data and data governance — representative, relevant, free of errors
3. Technical documentation (Annex IV) kept up to date
4. Record-keeping — automatic logging of events
5. Transparency and information to deployers
6. Human oversight designed into the system
7. Accuracy, robustness, cybersecurity with declared performance metrics
8. Quality management system covering the whole organisation
9. Conformity assessment, CE marking, EU database registration
10. Post-market monitoring and incident reporting

Where most teams underestimate the effort

• Building an actual data governance process (not a slide)
• Producing Annex IV technical documentation at the level regulators expect
• Designing human oversight that is meaningful, not cosmetic
• Setting up post-market monitoring with real telemetry

If your product touches HR, credit, health, education, insurance, or public services — assume high-risk until proven otherwise, and start building the evidence trail now.