The hardest part of high-risk AI governance is not memorizing a list of requirements. It is proving why the system is or is not on a high-risk route, which actor obligations follow, what evidence supports each requirement, and whether that evidence still holds after the system changes.
Article 6 defines the high-risk classification routes. The Regulation also requires documented support when a provider concludes that an Annex III system is not high-risk under Article 6(3). The Commission published draft high-risk classification guidance in May 2026 to support practical application.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Check whether the AI is a safety component or regulated product under Annex I, or whether its intended use falls into an Annex III category. Do not assume “important” means high-risk or that “not dangerous” automatically means excluded.
Some Annex III systems may not be high-risk if they do not pose a significant risk of harm and meet one of the listed conditions. The provider must document that assessment before market placement or putting into service.
Map the relevant duties to the actual role and system, including risk management, data governance, technical documentation, records, transparency, human oversight, accuracy, robustness and cybersecurity.
Preserve the intended purpose, classification basis, versions, tests, risk controls, instructions, oversight design, performance evidence and any revalidation triggers. A label without the underlying record is fragile.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Establish the product context, Annex I or Annex III pathway, intended purpose, actor role and any claimed Article 6(3) exclusion before treating high-risk obligations as fixed.
Map risk-management records, testing, technical documentation, logs, instructions, human-oversight controls, accuracy, robustness and cybersecurity evidence to the specific proposition they support.
If classification depends on missing facts, pending guidance, product integration or an unproven exclusion, keep the determination conditional rather than silently converting uncertainty into a compliance claim.
Changes to intended purpose, model, data, product integration, authority, deployment context or legal-source state can change classification or make prior evidence insufficient.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
Article 6 establishes two principal routes: certain AI systems tied to regulated products under Annex I, and systems listed in Annex III. The exact classification depends on intended purpose and the conditions in Article 6.
Not always. Article 6(3) provides a limited route for some Annex III systems not to be treated as high-risk where they do not pose a significant risk of harm and one of the listed conditions applies. Profiling systems in Annex III remain high-risk.
Yes. Article 6(4) requires a provider relying on the Article 6(3) route to document the assessment before placing the system on the market or putting it into service.
The Regulation’s high-risk section includes requirements covering risk management, data and data governance, technical documentation, record-keeping, transparency and instructions, human oversight, and accuracy, robustness and cybersecurity.
As of August 2026, the Commission has published draft guidelines on high-risk classification. They are useful interpretive material, but the Regulation itself remains the controlling legal text.
No. TA-14 can preserve the classification basis, evidence, gaps, reviews and revalidation history. It does not itself provide legal advice, conformity assessment, certification or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views