Is your AI high risk?

Risk level

⚠️ High risk (Annex III)

Your use case probably falls under Annex III. This is the most demanding level. Your obligations depend on your role.

You use a system supplied by a third party (deployer)

• Use the system in accordance with the provider's instructions for use, with appropriate technical and organisational measures (Art. 26(1))
• Assign human oversight to staff who have the necessary competence, training and authority (Art. 26(2))
• Ensure the input data you control is relevant, monitor operation and keep the logs for at least six months (Art. 26(4) to (6))
• Inform workers' representatives and affected staff before use in the workplace, and inform the people subject to decisions the system helps to make (Art. 26(7) and (11))
• Fundamental rights impact assessment before deployment, mandatory for bodies governed by public law and private entities providing public services, except critical infrastructure (Art. 27)
• For public authorities: registration of the use of the system in the EU database, except critical infrastructure (Art. 26(8) and Art. 49(3))
• A DPIA (GDPR) is most often required in parallel; the impact assessment can refer to it (Art. 26(9) and Art. 27(4))

Your organisation becomes the provider

This is the case if you develop the system or have it developed and put it into service under your own name (Art. 3(3)), or if you put your name on an existing high-risk system, make a substantial modification to it, or change its intended purpose so that it becomes high risk (Art. 25(1)). The provider obligations then apply on top (Art. 16):

• Risk management system (Art. 9) and data governance (Art. 10)
• Technical documentation (Art. 11) and automatic logging (Art. 12)
• Instructions for use and transparency towards deployers (Art. 13), design enabling human oversight (Art. 14)
• Accuracy, robustness and cybersecurity (Art. 15)
• Quality management system (Art. 17), conformity assessment (Art. 43) and registration of the system (Art. 49(1))

Deadline: these requirements and obligations (Chapter III, Sections 1 to 3, Articles 6 to 27) apply from 2 December 2027 for Annex III systems, and from 2 August 2028 for AI built into a regulated product listed in Annex I (Regulation (EU) 2026/1744, the "Digital Omnibus on AI"). This delay is no breathing space: it is better to anticipate them from the design stage.

Risk level

📝 Probably not high risk: document your assessment

Your use falls within an Annex III area, but the AI appears to be limited to a role covered by the derogation in Article 6(3), with no profiling. It is then not considered high risk, provided it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making.

• Document the assessment before putting the system into service: this is a provider obligation, and the provider must also register the system in the EU database and hand over this documentation when authorities ask for it (Art. 6(4) and Art. 49(2)). If you develop the system or have it developed under your own name, it falls on you; otherwise, ask your provider for it and keep your own analysis.
• Reassess whenever the use changes: if the AI influences the decision or profiles individuals, it becomes high risk again.
• If your AI interacts with people or generates content, the transparency obligations apply on top (Art. 50).

Risk level

✅ Minimal risk

No specific legal obligation under the EU AI Act for this use case. Still recommended: good practice, documented governance and GDPR compliance.

Worth noting, whatever the risk level: Article 4 on AI literacy, as worded by Regulation (EU) 2026/1744, requires providers and deployers to take measures to support the AI literacy of their staff. It does not require them to guarantee any specific level for each individual.