high-risk AI system

advancedspreading

An AI system that the EU AI Act subjects to strict requirements due to its use case, because its failure could harm people's health, safety, or fundamental rights.

In plain terms

The EU Artificial Intelligence Regulation (AI Act) does not treat all AI equally. It looks at how much harm the system could cause if it makes a mistake. The high-risk category includes those whose errors could affect a person's life, livelihood, or rights: for example, if a program decides whether you get a loan, are called for a job interview, or are admitted to a school.

It is like traffic. Anyone can ride a bicycle, a car can only be driven with a license and a technical inspection, and even stricter rules apply to bus drivers. High-risk AI is at the level of the car and the bus: it is not forbidden, but must operate only under control, with documentation and human supervision.

The classification does not depend on the technology, but on how it is used. The same language model is harmless if it recommends a recipe, but can be part of a high-risk system if it ranks resumes. This also applies to agents: an independently working AI agent becomes high-risk because it is assigned a task in a sensitive area.

How it works

Classification: a system can be high-risk in two ways. One case is if it is a safety component of a product falling under EU product safety regulations (for example, a medical device, lift, toy, or machine), or the product itself, requiring independent certification. The other case is if it operates in an area listed in Annex III of the regulation. These are: biometrics, critical infrastructure, education, employment, essential private and public services (for example, credit scoring, life and health insurance pricing), law enforcement, migration and border control, and justice and elections.
The provider's obligations (the provider is whoever develops the system and places it on the market under their own name): operate a risk management and quality management system, and ensure adequate quality of training and test data. Prepare detailed technical documentation and instructions for use. Design the system so that its operation can be logged automatically and overseen by humans. Ensure accuracy, robust operation and cybersecurity.
Conformity assessment: before placing on the market, it must be proven that the system meets the requirements. For most systems falling under Annex III, the provider carries this out themselves. For certain biometric systems and regulated products, an independent certification body also participates. After this, the system receives the CE marking, and systems under Annex III must generally also be registered in the EU database.
The obligations of the deployer (the deployer is the company or authority using the system): appoint a competent person to supervise it, use the system according to instructions, and preserve the logs. Inform the affected parties, such as employees or those about whom decisions are made using the system. Public institutions and companies providing public services, as well as companies using it for credit assessment or insurance pricing, must also conduct a fundamental rights impact assessment before use.
Post-market monitoring: the system must be monitored after deployment, and serious incidents must be reported to the market surveillance authority. For violations of obligations regarding high-risk systems, the fine can be up to 15 million euros or 3 percent of annual global turnover, whichever is higher. For small and medium-sized enterprises, the lower amount applies.

An everyday example

You apply to a large corporation, and an AI system first filters and ranks your resume. This system is considered high-risk, so the company must ensure human oversight of its operation. You can also request an explanation if a decision made with the system's involvement adversely affects you.

Who is affected

jobseeker, new graduateAI used in recruitment and selection is high-risk. Therefore, you have the right to know about it, human oversight must be present behind the decision, and in certain cases you may request an explanation. → Work & HR

Banking and insurance customerAI that assesses individuals' creditworthiness and determines the risk and price of life and health insurance falls into this category. This entitles you to stricter oversight and transparency.

entrepreneur, executiveIf your company develops or uses such a system, you have documentation, supervision, and information obligations, and failure to comply may result in heavy fines.

developerYou must know during the design phase whether your product or agent's intended use is classified as high-risk, as this determines logging, testing, and documentation requirements. → Code

A common misconception

MythHigh-risk AI is dangerous, so the EU bans it.

In realityHigh-risk systems are permitted only under strict conditions. Prohibited practices (such as social scoring) form a separate "unacceptable risk" category.

Limits and risks

The label is not a quality judgment: "high-risk" refers to the use case, not that the system performs poorly.
Compliance does not guarantee flawlessness: a properly certified system can still make mistakes or be biased.
The boundary is not always sharp. The regulation allows an exception if a system falling under Annex III performs only a narrow, preparatory, or supplementary task, and the assessment of this can be disputed. However, systems creating profiles of people always remain high-risk.
The deadlines for applying the rules have changed, so always check the current status before making a business decision.

Similar, but not the same

tiltott AI-gyakorlat – Prohibited practices must never be used, while high-risk systems may be used under conditions.
general-purpose AI model – A general-purpose model (such as a large language model) is a good base material for many tasks, but the high-risk classification applies to the specific system used in a sensitive area.
systemic risk – Systemic risk refers to the societal-scale dangers of the most capable general-purpose models, not the risk of a specific use case.

Related concepts

Broader

EU AI Act, risk-based regulation, AI regulation

Narrower

conformity assessment, fundamental rights impact assessment, biometric identification

On the edge

human oversight, tiltott AI-gyakorlat, general-purpose AI model, transparency obligation, algorithmic bias

A brief history

The term was introduced by the European Commission's April 2021 draft regulation as part of a risk-based approach. The final text, Regulation (EU) 2024/1689, was adopted in June 2024, published on July 12, 2024, and entered into force on August 1, 2024. The official Hungarian text of the regulation uses the expression "high-risk AI system."

Where things stand

The concept is legally codified. Under the original schedule, obligations were to apply to systems listed in Annex III from August 2, 2026, and to systems embedded in regulated products from August 2, 2027. The European Commission's November 2025 "digital omnibus" proposal would tie these deadlines to the completion of standards, pushing them to no later than December 2027 and August 2028, respectively. Exact dates will be fixed in the final text of the amending regulation. As some harmonized standards and Commission guidelines are still being prepared, many organizations remain in the preparation phase.

Status: 2026 November

In the news

Appears in 7 Agent Age stories; the curve shows weekly occurrence in the news magazine.

EU AI Act: Digital Omnibus pushes high-risk deadlines to 2027 as Article 50 transparency rules applyOct 26, 2026 · Jog
AI Act digital omnibus pushes high-risk rules back to December 2027Oct 12, 2026 · Jog
Hungary adopts AI act and government decree, with fines of up to HUF 5.7 billionSep 24, 2026 · Jog
MNB recommendation and credit scoring: high-risk AI systems at Hungarian banksSep 1, 2026 · Money
EU AI Act high-risk deadline pushed back 16 months; Health Canada clarifies status of AI scribesAug 17, 2026 · Health
EU digital omnibus in force: high-risk AI rules pushed back to December 2027Aug 10, 2026 · Jog
Digital Omnibus becomes law, delaying high-risk AI deadlinesAug 3, 2026 · Jog

Also known as

high-risk AI system · High-risk AI system · high-risk artificial intelligence system · high-risk AI · high-risk AI system · high-risk AI · HRAIS · high-risk AI agent

Sources

European Commission: AI Act – the regulatory framework for artificial intelligence

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.