An AI product is not high risk merely because it uses a sophisticated model. The EU AI Act’s Annex III evaluates specified use cases, and exemptions and role definitions demand a careful system-level assessment.
Classify the intended purpose first
Document which decision or activity the system supports, whose rights are affected and how the output influences the outcome. A résumé ranking system and a note-taking assistant can share a model yet be classified differently.
Read Annex III together with Article 6
A list entry is not the full legal test. The Act contains rules for determining when particular Annex III systems are high risk and when limited exceptions might apply. Avoid simple keyword matching against “health,” “education” or “employment.”
Provider and deployer are different roles
Organizations building or putting a system on the market may have different duties from those operating it. Upstream GPAI model suppliers have their own framework. Assign the correct legal actor for conformity, recordkeeping and oversight.
2026 amendments matter
Regulation 2026/1744 amended the AI Act; historical summaries based only on its July 2024 text may have obsolete application dates or obligations. Version control legal passages and do not backdate later amendments.
Build a classification file
Capture purpose, Annex entry, user population, relevant outputs, oversight, exemptive rationale, supporting evidence and specialist reviewer. Separate technical risk level from legal classification; a low-risk legal category can still cause real harm.
Publication gate
Before issuing a categorical high-risk label, obtain current consolidated wording, application phase and any sector-specific product legislation. This article is a method for screening, not a legal opinion on a named deployment.
Publication limitation
Additional verification remains open: Annex III Article 6 exemption and 2026 postponed implementation must be audited for each actual use. Do not represent this jurisdictional draft as a complete statement of current legal obligations until that review is finished.
Dated first-party verification and limits
For a 25 October 2026 assessment, Annex III high-risk implementation is not synonymous with the 2 August 2026 transparency milestone. The Commission’s amended timetable places Annex III duties on 2 December 2027; pre-existing discrimination, privacy and sector-specific obligations can still apply today.
Sources & Further Reading
- Consolidated EU AI Act, 27 July 2026 — EUR-Lex / European Union.
- Regulation (EU) 2026/1744 amending the AI Act — EUR-Lex / European Union.
- EU AI Act amended implementation timeline — European Commission.
Jurisdiction/scope: European Union. This is educational information and does not constitute legal or other professional advice. No hands-on product test is claimed.