First route: regulated products in Annex I
Under Article 6(1), a system is high-risk when it is a safety component of a product covered by the Union harmonisation legislation in Annex I — toys, lifts, medical devices, among others — or is itself that product, and the product also requires third-party conformity assessment.
The Omnibus specifies that systems used solely for user assistance, performance optimisation, service efficiency, automation, convenience or quality control are not safety components, unless their failure could endanger health and safety (Article 6(1a) and (1b)).
It also moves machinery: it deletes Directive 2006/42/EC from Section A of Annex I and adds Regulation (EU) 2023/1230 to Section B, whose products are subject to only a few articles (Article 2(2)), because the AI requirements are built into their sectoral legislation.
Second route: the eight areas in Annex III
Annex III lists the uses that are high-risk in their own right: biometrics; critical infrastructure; education and vocational training; employment, workers management and access to self-employment; access to essential private and public services; law enforcement; migration, asylum and border control; and administration of justice and democratic processes.
In private companies the most common are in point 4 — recruitment and selection, decisions on promotion or termination, task allocation based on personal traits, performance evaluation — and in point 5: creditworthiness assessment of natural persons and pricing in life and health insurance.
The Article 6(3) exception
An Annex III system is not high-risk if it does not pose a significant risk to health, safety or fundamental rights, because it only performs a narrow procedural task, improves the result of a previously completed human activity, detects deviations without replacing human assessment, or performs a preparatory task.
The exception does not apply if the system performs profiling of natural persons: it is then always high-risk. And anyone relying on it must document their assessment before placing the system on the market and register it all the same (Article 6(4) and Article 49(2)).
What an auditor usually asks for
- Every system in the inventory checked against Annex I and the eight areas of Annex III
- Uses in recruitment, evaluation or management of staff identified
- Article 6(3) exceptions justified in writing, paying attention to profiling
- Date of application noted for each high-risk system
How to tackle it in practice
- 1Sort each system into one of four columns: prohibited, high-risk, transparency obligation or minimal risk.
- 2For each HR use, check whether it fits point 4 of Annex III and whether it performs profiling.
- 3If you conclude that an Annex III system is not high-risk, keep the reasoning with a date and the person responsible.
Having the AI propose and a person decide does not take a system out of Annex III, but it is the basis for credible human oversight.
See how the AI's proposal is kept separate from the human decision
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EUR-Lex · OJ L 2024/1689 · 12 July 2024
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 EUR-Lex · OJ L 2026/1744 · 24 July 2026
- Regulation (EU) 2024/1689, consolidated text EUR-Lex · CELEX 02024R1689-20260727 · Version of 27 July 2026