High-risk AI under the EU AI Act: risk classes, prohibited practices and Article 6
A software company with 300 employees is hiring fast. The HR team has started using a tool that reads incoming CVs, scores them against the job profile and sorts the list before a recruiter looks at it. It saves hours every week. Then a candidate who was rejected asks a simple question by email: “Was my application assessed by an AI, and on what basis?”
Under the EU AI Act, that tool is a textbook high-risk AI system. AI used to select or filter job applicants is listed in Annex III of the Act. Since the AI Omnibus, the full set of high-risk obligations for such systems applies from 2 December 2027. The classification decides today which systems need a risk management system, technical documentation and human oversight, and which ones need nothing beyond a line in your AI register.
Key takeaways
- The AI Act sorts AI systems by risk: prohibited practices, high-risk systems, systems with transparency duties and everything else.
- Prohibited practices have been banned since 2 February 2025. Two new bans, on non-consensual intimate imagery and on child sexual abuse material, apply from 2 December 2026.
- High-risk under Annex III (for example HR, credit scoring, education, critical infrastructure) applies from 2 December 2027. High-risk in regulated products under Annex I applies from 2 August 2028.
- Article 6(3) allows an exception for Annex III systems that do not pose a significant risk. An Annex III system that profiles people is always high-risk.
- Fines go up to 35 million euros or 7 percent of worldwide turnover for prohibited practices, and up to 15 million euros or 3 percent for most other breaches.
- Classification starts with an AI register. You can only classify systems you know about.
The risk classes of the EU AI Act
The AI Act, Regulation (EU) 2024/1689, regulates how AI is used. The same language model can be harmless in an internal search tool and high-risk when it ranks job applicants. That is why the Act works with risk classes, each with its own duties and dates.
A system can sit in more than one class. A chatbot that pre-screens loan applicants is high-risk because of what it decides and subject to Article 50 because it talks to people. Both sets of duties apply.
What is banned outright
Article 5 lists practices that are not allowed in the EU at all. They have applied since 2 February 2025:
- manipulative or deceptive techniques that distort behaviour and cause significant harm,
- exploiting vulnerabilities due to age, disability or a social or economic situation,
- social scoring that leads to unjustified or disproportionate treatment,
- predicting criminal offences based only on profiling or personality traits,
- untargeted scraping of facial images to build facial recognition databases,
- emotion recognition at the workplace and in education, except for medical or safety reasons,
- biometric categorisation to infer sensitive characteristics such as political opinions, religion or sexual orientation,
- real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
The AI Omnibus added two bans that apply from 2 December 2026: AI systems that generate or manipulate realistic intimate or sexually explicit images of identifiable people without their consent, and systems that generate child sexual abuse material.
Most companies will not build any of this. The ban that catches businesses in practice is emotion recognition at work: a call centre tool that rates the mood of its own staff from their voice falls under it.
When is an AI system high-risk under the EU AI Act?
Article 6 has two routes into the high-risk class.
Route 1: AI in regulated products (Annex I)
An AI system is high-risk if it is a safety component of a product, or is itself a product, covered by EU product law listed in Annex I, and that product needs a third-party conformity assessment. Think of medical devices, machinery, toys or lifts. The Omnibus narrowed the term “safety component” to functions meant to prevent or reduce risks to health and safety. For these systems, the high-risk obligations apply from 2 August 2028.
Route 2: stand-alone uses (Annex III)
An AI system is also high-risk if it is used in one of the areas listed in Annex III:
- Biometrics, such as remote identification and emotion recognition where they are not banned,
- Critical infrastructure, as a safety component in digital infrastructure, traffic or the supply of water, gas, heating and electricity,
- Education and vocational training, such as admission, grading and exam monitoring,
- Employment and workers management, such as recruiting, selection, promotion, termination and task allocation,
- Access to essential services, such as creditworthiness checks, credit scoring, risk pricing in life and health insurance, public benefits and emergency call triage,
- Law enforcement, migration and border control, and administration of justice and democratic processes.
For Annex III systems, the obligations apply from 2 December 2027. Systems already on the market before that date are only covered if they are significantly changed afterwards. AI systems used by public authorities have until 2 August 2030.
The exception in Article 6(3)
Not every Annex III system is high-risk. Article 6(3) excludes systems that do not pose a significant risk of harm, because they
- perform a narrow procedural task,
- improve the result of an activity a person has already completed,
- detect patterns or deviations in earlier decisions without replacing or influencing the human assessment without proper review, or
- perform a preparatory task for an assessment listed in Annex III.
There is a hard limit: an Annex III system that profiles natural persons is always high-risk. And the exception is not automatic. The provider has to document the assessment before placing the system on the market and show it to the authorities on request. The European Commission published draft guidelines on classification on 19 May 2026; the final version is still pending.
Back to the CV tool. It scores and ranks applicants, which is profiling of natural persons. The Article 6(3) exception does not apply, so the tool is high-risk.
What high-risk means in practice
The duties depend on your role. The provider develops the system or has it developed and places it on the market under its own name. The deployer uses it under its own authority. A company that buys the CV tool is a deployer. A company that builds its own scoring model and offers it to customers is a provider.
Providers
- a risk management system across the whole life cycle (Article 9),
- data governance for training, validation and test data, including checks for bias (Article 10),
- technical documentation (Article 11 and Annex IV) and automatic logging (Article 12),
- instructions for use that let deployers understand and use the system correctly (Article 13),
- design for effective human oversight (Article 14),
- appropriate accuracy, robustness and cybersecurity (Article 15),
- a quality management system (Article 17),
- conformity assessment, CE marking and registration in the EU database before placing on the market,
- post-market monitoring and reporting of serious incidents.
The Omnibus extended some relief for SMEs, such as simplified documentation and a more proportionate quality management system, to small mid-caps with fewer than 750 employees and up to 150 million euros in turnover.
Deployers
- use the system according to the provider’s instructions,
- assign human oversight to people with the necessary competence and authority,
- make sure input data under their control is relevant and representative,
- monitor operation and inform the provider about risks and serious incidents,
- keep the automatically generated logs for at least six months,
- inform workers’ representatives and affected employees before using a high-risk system at the workplace,
- inform people who are subject to decisions made or supported by the system.
Public bodies, private companies providing public services, and deployers who use AI for credit scoring or for pricing life and health insurance also have to carry out a fundamental rights impact assessment before first use.
What has to happen before December 2027
Just over thirteen months leave less time than it seems, for three reasons. First, providers need documentation, testing and a quality management system before they place a system on the market, and building those takes most of a year. Second, deployers depend on their vendors: if your HR tool provider is not ready, you have to decide whether to switch, and procurement takes time. Third, ISO/IEC 42001, a common standard for structuring AI governance, needs a running management system before an auditor will certify it.
The classification is the step that decides everything else, and it can be done now. It also answers the candidate from the introduction: from 2 December 2027, people affected by a decision based on a high-risk system have a right to an explanation (Article 86). Today the GDPR already gives them a right of access and, for fully automated decisions, the safeguards of Article 22.
How to classify your systems
- Build an AI register. List every AI system you develop, buy or use, including AI features inside existing software.
- Record your role for each system: provider, deployer, or both.
- Check Article 5 first. Anything that is banned has to stop, regardless of dates.
- Check Annex I and Annex III. Note the area and the intended purpose.
- Test the Article 6(3) exception for Annex III systems, and write down the reasoning. Profiling closes the exception.
- Check Article 50 for systems that interact with people or generate content.
- Plan the duties for each high-risk system, with owners and dates before 2 December 2027.
- Ask your vendors how they classify their systems and when their documentation will be ready.
Where classification goes wrong
Classifying the technology. The class follows from the intended purpose and the way the system is used, whatever model sits underneath.
Assuming the vendor carries the risk. Deployers have their own duties, from human oversight to informing employees.
Using Article 6(3) without writing it down. An exception that is not documented does not help in front of an authority.
Overlooking AI features in existing tools. Applicant tracking systems, CRM suites and HR platforms increasingly ship scoring features that change the classification.
FAQ: high-risk AI under the EU AI Act
Is CV screening software high-risk?
Yes. AI systems used to recruit or select people, in particular to analyse and filter applications and to evaluate candidates, are listed in Annex III. The high-risk duties apply from 2 December 2027.
When do the high-risk rules apply?
For Annex III systems from 2 December 2027, for AI in regulated products under Annex I from 2 August 2028.
Is a general-purpose AI chatbot a high-risk AI system?
Not as such. General-purpose AI models have their own set of duties. A system becomes high-risk through its intended purpose: if a general-purpose AI system is used to screen applicants, that use falls under Annex III, and whoever puts it to that use can take on provider duties (Article 25).
