Article 6 — Classification rules for high-risk AI systems (EU AI Act)

Article 6 of Regulation (EU) 2024/1689 — Classification rules for high-risk AI systems. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 6 of Regulation (EU) 2024/1689 establishes the two-track classification mechanism that determines when an AI system is subject to the stringent obligations applicable to high-risk systems under Title III, Chapter 2.

The first track, set out in Article 6(1), captures AI systems that are safety components of products already regulated by the Union harmonisation legislation enumerated in Annex I — including the Machinery Regulation, the Medical Devices Regulation, the In Vitro Diagnostic Medical Devices Regulation, the Radio Equipment Directive, and several others. Where such a product is itself required to undergo third-party conformity assessment under the applicable sectoral legislation, the AI system functioning as its safety component is automatically classified as high-risk.

The second track, set out in Article 6(2), captures standalone AI systems that are listed in Annex III. That annex enumerates eight areas — biometric identification and categorisation; critical infrastructure management; education and vocational training; employment and worker management; access to essential private and public services; law enforcement; migration, asylum, and border control; and administration of justice and democratic processes.

Article 6(3) introduces a self-assessment exception: a provider may determine that an Annex III system does not pose a significant risk if it does not profile natural persons and satisfies specific conditions, with the determination documented and communicated to national authorities. The Commission retains delegated power to amend Annex III and to publish guidelines clarifying the application of the self-assessment criteria.

What This Means in Practice

Article 6 is the compliance gateway for the entire high-risk regime. Before any conformity assessment, CE marking, or registration obligation arises, a provider must first determine whether their system crosses the Article 6 threshold.

For developers and providers of embedded AI: If your AI system controls, monitors, or assists a safety function within a product that carries a CE mark under Annex I legislation — a surgical robot, an autonomous vehicle, an industrial press — you must treat it as high-risk from the moment of design. This applies regardless of whether your organisation is the manufacturer of the end product or a sub-component supplier; the obligation follows the safety function, not the corporate structure.

For providers of standalone AI applications: You must map your intended use against each category in Annex III. A credit-scoring model used by a bank to decide access to essential financial services falls under point 5(b) of Annex III. An AI tool used by an employer to screen CVs falls under point 4. The key word throughout Annex III is "intended purpose": classification follows what you have designed and documented the system to do, not how a deployer chooses to use it post-deployment.

Self-assessment under Article 6(3): If you believe your Annex III system qualifies for the exception — for example, a narrowly scoped AI tool that assists humans without any profiling function — you must produce a written assessment, retain it, and notify the relevant market surveillance authority. This is not a blanket opt-out; regulators may challenge the determination.

Practical first step: Conduct a classification audit mapping every AI system in your portfolio against both Annex I product categories and all eight Annex III areas before the August 2026 application date.

Key Obligations

• Determine classification before market placement: Providers must assess whether each AI system meets the Article 6(1) safety-component criterion or falls within any Annex III category prior to placing the system on the market or putting it into service.
• Apply the full high-risk compliance framework if classified: A positive classification under Article 6(1) or 6(2) triggers all obligations under Title III, Chapter 2 — including risk management (Article 9), data governance (Article 10), technical documentation (Article 11), logging (Article 12), transparency (Article 13), human oversight (Article 14), and accuracy and robustness requirements (Article 15).
• Document and notify self-assessment exceptions: Where a provider invokes the Article 6(3) exception to avoid high-risk classification for an Annex III system, the determination must be documented in writing, included in technical documentation, and communicated to the competent national authority before market placement.
• Monitor Annex III for Commission updates: The Commission may amend Annex III via delegated acts under Article 97. Providers must track such amendments and re-classify existing systems where necessary, even after initial market placement.
• Respect sectoral law interaction for Annex I products: For systems falling under Article 6(1), conformity assessment procedures and timelines are governed by the applicable sectoral legislation listed in Annex I, and compliance with that legislation is a precondition of AI Act compliance — the two regimes are cumulative, not alternative.
• Apply transitional provisions correctly: Providers must identify whether any of their high-risk systems benefit from the transitional regime and record the basis for that determination, since a "significant change" to the system will end the transition and trigger immediate full compliance.

Relationship to Other Articles

Article 6 is the entry point to the high-risk regime and must be read as the precondition for the entire Chapter 2 of Title III. A positive classification under Article 6 immediately engages Article 9 (risk management system), Article 10 (training data governance), Article 11 (technical documentation per Annex IV), Article 12 (automatic logging), Article 13 (transparency and instructions for use), Article 14 (human oversight measures), and Article 15 (accuracy, robustness, and cybersecurity).

Article 43 governs which conformity assessment procedure applies once a system is classified as high-risk: Article 6(1) systems generally follow the sectoral procedure, while Article 6(2) systems may use the internal control procedure of Annex VI unless a specific Annex III category requires third-party involvement. Article 47 requires providers to draw up an EU declaration of conformity, and Article 49 requires CE marking — both contingent on classification under Article 6. Article 5 (prohibited practices) applies independently and upstream of Article 6: a system may simultaneously be prohibited and high-risk, in which case Article 5 prevails absolutely.

Compliance Timeline

2 August 2024 — Regulation (EU) 2024/1689 entered into force (20 days after publication in the Official Journal on 12 July 2024).

2 February 2025 — Prohibited AI practices under Article 5 became enforceable. Article 6 classifications do not yet apply, but providers are advised to begin portfolio mapping at this stage.

2 August 2025 — Rules on general-purpose AI models (Title VIII) and governance obligations became applicable. Article 6 still not yet in force, but the Commission is expected to publish guidelines on the Article 6(3) self-assessment criteria around this period.

2 August 2026 — Article 6 and the full high-risk obligations under Title III, Chapter 2 become enforceable for AI systems listed in Annex III. This is the primary compliance deadline for most high-risk standalone AI systems.

2 August 2027 — Extended transitional deadline for AI systems that are safety components of Annex I products and were already placed on the market or put into service before 2 August 2026 under existing sectoral law, provided no significant change has occurred.

Providers should plan backwards from 2 August 2026, allowing 12–18 months for conformity assessment, technical documentation, and registration in the EU database under Article 71.