Is my use case a high-risk AI system? Applying the Commission’s guidelines and next steps

2026-05-22 · Source: Data Protection Report · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations · Depth: Intermediate, medium

Summary

The EU Commission published draft guidelines on high-risk AI systems on May 19, 2026, clarifying their classification under the EU AI Act. These guidelines, covering general principles, standalone (Annex III), and embedded (Annex I) AI systems, detail the application of the Article 6(3) derogation and provide examples for employment-related high-risk purposes. A key clarification states that human involvement does not exempt an AI system from high-risk classification. The four conditions for Article 6(3) derogation, such as performing a narrow procedural task or improving a completed human activity, must be interpreted narrowly and are exhaustive. Profiling AI systems remain high-risk regardless of these conditions. Providers face extensive obligations, including risk management, technical documentation, conformity assessment, and EU database registration, while deployers must manage usage risks and ensure human oversight. Specific employment examples illustrate high-risk scenarios like automated job matching and dynamic compensation, contrasting with systems like CV parsers that may qualify for Article 6(3) derogation. Compliance obligations for high-risk AI systems are set to apply from December 2, 2027.

Key takeaway

For Directors of AI/ML or legal professionals overseeing product development, you must proactively assess your AI systems against the EU AI Act's high-risk guidelines. Begin embedding compliance processes, including risk management and technical documentation, throughout your product lifecycle now, rather than attempting retrospective retrofitting. Deployers should implement technical controls and contractual protections to prevent inadvertently assuming provider obligations, especially when using general-purpose AI tools for high-risk applications. Your organization's compliance hinges on early, documented adherence to these strict requirements before December 2, 2027.

Key insights

The EU AI Act's high-risk classification is strict, with narrow derogations and significant obligations for providers and deployers.

Principles

• Human involvement does not alter high-risk classification.
• Article 6(3) derogations are exhaustive and narrowly interpreted.
• Profiling AI systems are always high-risk.

Method

Providers must document an assessment for Article 6(3) reliance, detailing why the system is high-risk, which condition applies, and why it avoids profiling.

In practice

• Use guidelines to confirm product high-risk status.
• Embed compliance processes during product lifecycle.
• Implement controls to avoid accidental provider role.

Topics

• EU AI Act
• High-Risk AI Systems
• AI System Classification
• AI Governance
• Provider Obligations
• Employment AI

Best for: CTO, VP of Engineering/Data, Executive, Legal Professional, Consultant, Director of AI/ML

Related on AIssential

• EU AI Act High-Risk AI Systems: EU Commission Publishes Draft Guidance — EU AI Act "high-risk" classification hinges on intended purpose and substantive influence, clarified by new draft guidance.
• Guidelines on transparency obligations for providers and deployers of AI systems — The AI Act's Article 50 guidelines clarify transparency obligations for AI systems posing specific risks, effective August 2, 2026.
• Best AI Governance Tools in 2026: 10 Platforms I Evaluated for Compliance, Risk, and Audit Readiness — AI governance tools are essential for managing AI systems, ensuring compliance, and mitigating risks in a regulated environment.
• The EU AI Act, Decoded — The EU AI Act establishes a phased, risk-based regulatory framework for AI systems used within Europe.
• The Digital Iron Curtain: How the EU AI Act Is Strangling European Innovation — The EU AI Act's high compliance costs and restrictive classifications are stifling European AI innovation and competitiveness.
• The EU is rapidly rewriting the AI Act. What’s changed? — The EU AI Act is being revised to balance innovation with regulation, particularly for general-purpose AI, by clarifying definitions and adjusting timelines.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Data Protection Report.