EU AI Act High-Risk Classification Checklist

Use this alongside our full Article 6 classification breakdown — this checklist is the working-session version, not a replacement for understanding why each question matters. Treat any "yes" answer below as a trigger for deeper analysis or legal review, not a final determination on its own.

Track 1: Product-safety overlap (Annex I)

• Is this AI system a safety component of a product already regulated under EU product-safety legislation (medical devices, machinery, toys, lifts, and similar Annex I categories)?
• Does that underlying product require third-party conformity assessment under its own existing regulatory regime?

If both are checked, the system is high-risk through Track 1 regardless of Track 2 below.

Track 2: Annex III use-case categories

• Does the system make or materially influence decisions about employment — recruitment, candidate screening, promotion, or termination?
• Does the system evaluate creditworthiness or determine eligibility for lending?
• Does the system determine eligibility for public benefits or essential public services?
• Does the system perform risk assessment or pricing for life or health insurance?
• Does the system perform biometric identification or categorization of individuals?
• Does the system determine access to educational institutions or evaluate student learning outcomes in a way that affects a student's academic path?

If any box in this section is checked, the system is presumptively high-risk under Annex III.

Checking the exemption (Article 6(3))

• Does the system perform only a narrow procedural task, without materially influencing the substance of the decision?
• Does the system improve the result of a previously completed human assessment, rather than replacing that assessment?
• Does the system detect patterns or anomalies without itself replacing human judgment on the outcome?
• Has this exemption assessment been documented and is it ready to be registered, as the Act requires before relying on the exemption?

If you checked one of the first three boxes but not the fourth, you do not yet have a defensible exemption — the documentation requirement is not optional.

If the system is high-risk: what's actually required

• Risk management system established and maintained across the system's lifecycle
• Data governance documentation covering training data sources and quality
• Technical documentation describing intended purpose, capabilities, and limitations
• Logging capability sufficient to reconstruct system behavior after the fact
• Human oversight measures designed into the deployment, not added after
• Defined and tested levels of accuracy, robustness, and cybersecurity

Next step

If this checklist surfaces a high-risk classification, route the system through your organization's governance review process before deployment — see our governance framework checklist for how that review should be structured. This page is not a substitute for legal review of a specific system's facts.