EU AI Act High-Risk Checklist: Four Steps to a Defensible Verdict

Work it in order and the answer is rarely ambiguous. Whether an AI system is high-risk under Regulation (EU) 2024/1689 — the EU AI Act — is a structured decision, not a vibe: four sequential questions, each tied to a specific article. Skip a step and you misclassify; run them in order and you reach a verdict you can defend on paper. The four questions: (1) is it a prohibited practice under Article 5? (2) does its intended purpose match an Annex III area under Article 6(2)? (3) is it a safety component of an Annex I product under Article 6(1)? (4) does the Article 6(3) filter exempt it — bearing in mind that profiling of natural persons is always high-risk?

Run them top to bottom. This page is the checklist; the risk-classification decision tree is the visual companion.

---

Step 1 — Is it a prohibited practice? (Article 5)

Before "high-risk", ask "is it banned outright?" Article 5 lists the unacceptable-risk practices that are prohibited — in force since 2 February 2025. If your system is one of these, it is not high-risk; it is illegal to place on the market or use, full stop.

The prohibitions include: subliminal or purposefully manipulative techniques causing significant harm (5(1)(a)); exploiting vulnerabilities of age, disability or socio-economic situation (5(1)(b)); social scoring (5(1)(c)); untargeted scraping of facial images to build recognition databases (5(1)(e)); emotion recognition in the workplace and education (5(1)(f)) — a common trap, this is prohibited, not high-risk; biometric categorisation to infer sensitive attributes (5(1)(g)); and real-time remote biometric identification in public spaces for law enforcement, save narrow exceptions (5(1)(h)). A new CSAM / "nudifier" prohibition joins the list from 2 December 2026.

If yes → stop. The system is prohibited (Article 5), top penalty tier. Do not proceed to the high-risk steps. If no, continue. See prohibited practices.

---

Step 2 — Does its intended purpose match an Annex III area? (Article 6(2))

This is the stand-alone route. Under Article 6(2), a system is high-risk if its intended purpose falls within one of the eight Annex III areas:

1. Biometrics — remote biometric identification, biometric categorisation, emotion recognition (outside the prohibited workplace/education contexts).
2. Critical infrastructure — safety components in the supply of water, gas, heat, electricity and road traffic.
3. Education and vocational training — admissions, assessment, exam monitoring.
4. Employment and worker management — recruitment and selection (4(a)); in-employment decisions (4(b)).
5. Access to essential private and public services — public-benefit eligibility (5(a)); creditworthiness and credit scoring (5(b), excluding fraud detection); life and health insurance risk and pricing (5(c)); emergency-service dispatch (5(d)).
6. Law enforcement.
7. Migration, asylum and border control.
8. Administration of justice and democratic processes.

Classify by what the system does, not by the tool or vendor. A general-purpose model is not "high-risk" in the abstract; the system built on it for an Annex III purpose may be. If the intended purpose matches an Annex III area → go to Step 4 (the filter). If it matches none, it is not high-risk on the stand-alone route; check Step 3, then it is likely limited- or minimal-risk. See Annex III.

---

Step 3 — Is it a safety component of an Annex I product? (Article 6(1))

This is the product route, and it is easy to miss because it bypasses Annex III entirely. Under Article 6(1), a system is high-risk if it is itself a product, or a safety component of a product, covered by the EU harmonisation legislation in Annex I, and that product must undergo third-party conformity assessment under that sectoral law.

Annex I lists regimes such as MDR 2017/745 and IVDR 2017/746 (medical devices), the Machinery Regulation, Regulation (EU) 2018/1139 (civil aviation / EASA), motor-vehicle type-approval, the Marine Equipment Directive 2014/90/EU, and rail interoperability. A safety component is one that performs a safety function, or whose failure endangers health and safety.

The consequence of this route is different from Annex III: conformity is delivered through the sectoral regime (the medical-device notified body, the EASA framework), the documentation folds into the product file, and the deadline is 2 August 2028, not 2 December 2027. If yes → it is high-risk via the product route; the Step 4 filter does not apply the same way — assess through the sectoral conformity process. If no, return to your Step 2 result. See the conformity-assessment route.

---

Step 4 — Does the Article 6(3) filter exempt it?

Reached only if Step 2 placed the system in an Annex III area. Even then, Article 6(3) can pull it back out. An Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights because it meets any one of four conditions:

1. It performs a narrow procedural task.
2. It improves the result of a previously completed human activity.
3. It detects decision-making patterns or deviations from prior patterns, without replacing or influencing the human assessment.
4. It performs a preparatory task to an assessment relevant to an Annex III use case.

Only one condition is needed. So a CV-parser that just extracts fields, or a tool that flags anomalies for a human to judge, can be filtered out of high-risk.

The override that catches people out

Any system that performs profiling of natural persons is always high-risk — the Article 6(3) filter is unavailable to it. Profiling (automated processing to evaluate personal aspects) closes the door regardless of how procedural the task looks. If your Annex III system profiles people, you are high-risk; the four conditions cannot save you.

Document the assessment either way. Even where you conclude the filter applies, you must record the reasoning — and you may still need to register the system under Article 49. If the filter applies → not high-risk (documented). If it does not → high-risk. See the Article 6(3) exemption.

---

The verdict and the obligation stack

If Steps 2–4 land you on high-risk, here is what attaches — the provider's build duties (Article 16) and the deployer's use duties (Article 26):

Deployers additionally meet Article 26 (use per instructions, human oversight, monitoring, logs) and, for public bodies and certain essential-service deployers, the Article 27 FRIA. Breaches of high-risk obligations sit at up to €15,000,000 or 3% of total worldwide annual turnover under Article 99(4); prohibited-practice breaches at up to €35,000,000 or 7% under Article 99(3); for SMEs and start-ups, Article 99(6) caps the fine at the lower of the two. See the Article 99 penalties.

---

Worked example: running the checklist on one system

Consider Talentbrücke GmbH, a German HR-tech company of about 70 employees and roughly €9M turnover, classifying its AI CV-ranking tool that scores and orders job applicants for client employers.

Step 1 — prohibited? No. CV-ranking is not an Article 5 practice. Continue.

Step 2 — Annex III? Yes. The intended purpose is recruitment and selection — Annex III point 4(a). Go to Step 4.

Step 3 — Annex I safety component? No. It is not embedded in a regulated product; the product route does not apply.

Step 4 — Article 6(3) filter? The tool scores and ranks candidates, building an evaluation of each person — that is profiling of natural persons, so the filter is unavailable and none of the four conditions can apply. (Had the tool merely parsed CVs into structured fields, the narrow-procedural-task condition might have exempted it — but ranking is not that.)

Verdict: high-risk. Talentbrücke is the provider under Article 16 and must build the full Article 9–15 programme, complete the Article 43 conformity assessment, and register under Article 49. As an SME it benefits from the Article 99(6) fine cap and proportionate fees under Article 62. The whole determination took four questions and is fully documented — which is exactly what an auditor will ask to see.

---

How Confir helps

Confir runs this four-step checklist as a structured, plain-English intake: it screens each system against Article 5, tests the intended purpose against Annex III (Article 6(2)), checks for Article 6(1) product-route status, and applies the Article 6(3) filter — including the profiling override — recording the reasoning at every step. Where a system is high-risk, it derives the provider or deployer role and assembles the Article 11 / Annex IV pack and Article 49 registration.

The engine is deterministic and rule-based: the same intake answers produce the same finding, with the rule that fired shown in plain English. A classification is reproducible and audit-defensible — the difference between "we think it's high-risk" and a documented, four-step determination an authority can follow.

---

Frequently asked questions

How do I know if my AI system is high-risk under the EU AI Act?

Run four questions in order. First, is it a prohibited practice under Article 5 — if so, it is banned, not high-risk. Second, does its intended purpose match an Annex III area under Article 6(2). Third, is it a safety component of an Annex I product under Article 6(1) — the product route. Fourth, if it is in Annex III, does the Article 6(3) filter exempt it. The system is high-risk if it reaches Annex III and the filter does not apply, or if it is an Annex I safety component. Document each step; the reasoning is what makes the verdict defensible.

What is the Article 6(3) filter and when does it apply?

Article 6(3) lets an Annex III system avoid high-risk status if it poses no significant risk of harm because it meets any one of four conditions: it performs a narrow procedural task; it improves a previously completed human activity; it detects decision patterns without replacing or influencing the human assessment; or it performs a preparatory task. Only one condition is needed. The critical exception is that any system that profiles natural persons is always high-risk and cannot use the filter. You must document the assessment whichever way it lands, and registration under Article 49 may still apply.

Does the Article 6(3) filter apply to profiling systems?

No. Any AI system that performs profiling of natural persons — automated processing to evaluate personal aspects such as performance, behaviour, preferences or reliability — is always high-risk, and the Article 6(3) filter is unavailable to it. This catches systems that would otherwise look procedural: a tool that scores or ranks people is profiling, so the four exemption conditions cannot save it. The override is deliberate, because profiling is precisely where the fundamental-rights risk concentrates. If your Annex III system profiles people, classify it high-risk.

What is the difference between Article 6(1) and Article 6(2)?

They are two distinct routes into high-risk. Article 6(2) is the stand-alone route: a system is high-risk if its intended purpose falls within one of the eight Annex III areas, with conformity by self-assessment or notified body and a deadline of 2 December 2027 (adopted by the Digital Omnibus). Article 6(1) is the product route: a system is high-risk if it is a safety component of a product covered by Annex I harmonisation law — such as medical devices, aviation or machinery — that requires third-party conformity assessment, with conformity through the sectoral regime and a deadline of 2 August 2028. Check both.

What obligations attach to a high-risk AI system?

The provider must build a risk-management system (Article 9), ensure data governance (Article 10), prepare technical documentation (Article 11 / Annex IV), enable logging (Article 12) and transparency to deployers (Article 13), allow human oversight (Article 14), and meet accuracy, robustness and cybersecurity (Article 15), then complete the Article 43 conformity assessment and register under Article 49. Deployers meet Article 26 — use per instructions, oversight, monitoring, logs — and certain deployers must complete an Article 27 FRIA. Breaches fall in the Article 99(4) tier, up to €15M or 3%, with an SME cap under Article 99(6).

When do high-risk obligations start to apply?

For stand-alone Annex III systems under Article 6(2), the statute originally read 2 August 2026; the Digital Omnibus defers that to 2 December 2027 and has been adopted — European Parliament vote on 16 June 2026, Council adoption on 29 June 2026 — with entry into force pending Official Journal publication, expected before 2 August 2026. For Annex I product-embedded systems under Article 6(1), the deadline is 2 August 2028. Article 5 prohibitions and Article 4 literacy already apply since 2 February 2025.

---

Related guides

• The risk-classification decision tree
• What counts as high-risk AI
• The Article 6(3) exemption
• Prohibited practices under Article 5
• Article 6 classification rules
• Annex III high-risk areas
• The conformity-assessment route