The 2026 classification guidelines (draft)
The Commission's draft high-risk classification guidelines of 19 May 2026: what they clarify, how binding they are, and how to keep classifications defensible.
On 19 May 2026, the European Commission published its draft guidelines on the classification of high-risk AI systems under Article 6(5) of Regulation (EU) 2024/1689 (the EU AI Act). That is roughly three and a half months after the 2 February 2026 deadline the Act itself set. The draft comes in three documents: general classification principles, the Article 6(1) route for products and safety components under Annex I, and the Article 6(2) route through the Annex III use cases. Each carries practical examples of what falls in and out of high-risk.
Status: the consultation ran 19 May – 23 July 2026 (extended from 23 June); the Commission says it will adopt the final guidelines by the end of 2026. Until then the draft is the best indication of the Commission's reading, but it is not binding and may change. Market surveillance authorities will treat it as the default reading of Article 6, so a classification that diverges from it needs stronger documentation, not silence. This page sets out what the draft clarifies chapter by chapter, how much legal weight it carries, and how to keep your classifications defensible until the final text lands.
Last reviewed: 23 October 2026. No final guidelines had been published as of that date; this page will be updated when they land.
Three and a Half Months Late: The Draft Guidelines Arrive
What Was Published on 19 May 2026 — Article 6(5)
Article 6(5) required the Commission to provide guidelines specifying the practical implementation of Article 6, together with a list of practical examples of high-risk and non-high-risk use cases, by 2 February 2026. The draft arrived on 19 May 2026, roughly three and a half months late. It was published on digital-strategy.ec.europa.eu as three downloadable documents, and surfaced through the AI Act Single Information Platform.
The lateness matters less than it would have a year ago. Days earlier, the Digital Omnibus agreement had moved the main Annex III high-risk date to 2 December 2027 — a deferral in force since 27 July 2026 — so the guidelines arrive with usable runway rather than weeks before the obligations bite. The detail on that adoption is covered below.
The Consultation: Closed 23 July 2026
The targeted consultation opened alongside the draft on 19 May 2026 and, after an extension from 23 June, closed on 23 July 2026. It was open to anyone with an interest in developing, deploying, supervising or using AI systems: providers, deployers, authorities, researchers and civil society organisations, through the Commission's EUSurvey questionnaire.
The Commission says it will adopt the final guidelines by the end of 2026, after the AI Board has provided its input. No final guidelines had been published as of 23 October 2026.
What the Draft Contains: Three Documents, One Decision Logic
The three parts of the draft mirror the two statutory routes into high-risk status under the Article 6 classification rules:
- General principles: how to read intended purpose, when something is an AI system at all, and how integrated workflows are assessed.
- Article 6(1) and Annex I: AI systems that are products, or safety components of products, covered by Union harmonisation legislation.
- Article 6(2) and Annex III: stand-alone AI systems in the eight Annex III areas, with practical in-scope and out-of-scope examples per area.
Two reading notes. First, the Commission states that the examples are not exhaustive and may be updated over time, so the absence of your use case from the lists is not a clearance. Second, read the general principles first, because they condition everything that follows, then read only the route that matches your system: product-embedded (Annex I) or stand-alone (Annex III).
General Principles: Substance Over Disclaimers
The first document opens with the gate question: is the system an AI system at all under Article 3(1)? The definition turns on autonomy, adaptiveness and the capacity to infer, and the draft confirms that not every automated or rule-based tool qualifies. That is the first practical filter. Three principles then carry most of the analysis.
Intended Purpose Is Read From Everything You Publish — Article 3(12)
Intended purpose (Article 3(12)) is assessed across the instructions for use, promotional and sales materials and the technical documentation. The whole published record counts, not the one page that was carefully worded. The draft guidelines draw the consequence explicitly: a terms-of-service disclaimer excluding high-risk uses is insufficient if your marketing, sales decks or documentation suggest those uses are intended.
This gives classification reviewers a named evidence set to audit (documentation, marketing claims, sales materials, contracts) instead of arguing about intent in the abstract.
Human-in-the-Loop Is Not a Declassifier
Adding a human reviewer does not by itself remove high-risk status. Per the draft guidelines, the decisive factors remain the system's role in the decision and the materiality of its output. A recruitment-screening tool whose ranking effectively determines who reaches an interview is high-risk whether or not a person clicks "approve" at the end of the process.
You Cannot Carve a Workflow Into Innocent Pieces
Where multiple AI components form one integrated workflow that serves a high-risk purpose, the draft assesses them as a single system. A provider cannot decompose the architecture (a parsing module here, a scoring module there) and argue that each fragment, viewed in isolation, escapes classification. What governs the analysis is the workflow's purpose, not the component diagram.
Article 6(1) and Annex I: Products and Safety Components
Two Cumulative Conditions
An AI system is high-risk under Article 6(1) only where both conditions hold:
- The AI system is a product, or a safety component of a product, covered by the Union harmonisation legislation listed in Annex I: machinery, medical devices, motor vehicles, civil aviation equipment, toys, lifts and the rest.
- That product must undergo a third-party conformity assessment under the relevant Annex I act.
The conditions are cumulative. Coverage by an Annex I act without notified-body involvement does not make the system high-risk through this route. So product teams have a two-step check: map the product to the Annex I act that covers it, then confirm whether a notified body is involved in the conformity assessment.
Safety Function Versus Optimisation Function — Article 3(14)
Under Article 3(14), as amended by Regulation (EU) 2026/1744, an AI system is a safety component only if it fulfils a safety function (its intended purpose is to prevent or mitigate risks to the health and safety of persons or property) or its failure or malfunctioning endangers health and safety. The draft confirms that a component can qualify even where it was not designed for a safety purpose; what counts is the consequence of failure, not the design intent. Its examples are door-closing systems in elevators and lane-assist systems in vehicles.
The draft draws the opposite boundary for functions serving efficiency, comfort or convenience, and the amended text now sets it out: systems 'solely used for non-safety related aspects' of user assistance, performance optimisation, service efficiency, automation, convenience or quality control are excluded, unless their failure or malfunctioning would endanger health and safety (Article 6(1a) and (1b)). A third-party assessment required only for risks other than health and safety, such as electromagnetic compatibility, does not count (Article 6(1c)). On timing, Annex I cases carry the later application date: 2 August 2028 under the Digital Omnibus, in force since 27 July 2026, deferred from the original 2 August 2027. For Annex I Section B products (e.g. vehicles, aviation, and, since Regulation (EU) 2026/1744, machinery), the requirements arrive through the sectoral legislation, not directly from the AI Act.
Article 6(2) and Annex III: The In/Out Examples, Area by Area
Where the Examples Genuinely Help Operational Teams
The third document walks all eight Annex III areas with concrete examples; see Annex III explained for the full statutory list. In biometrics, remote biometric identification, emotion recognition and sensitive-attribute categorisation are in. In critical infrastructure, safety components for critical digital infrastructure, road traffic and water, gas, heating and electricity supply are in. Education, employment (recruitment and selection tools and workforce-management systems are in), essential private and public services, law enforcement, migration and border control and the administration of justice and democratic processes each get the same treatment.
One distinction runs through the examples and decides most cases:
| Tends out of high-risk | Tends into high-risk |
|---|---|
| Sorting or structuring incoming data | Scoring or ranking natural persons |
| Detecting duplicate records | Labelling or categorising people substantively |
| Routine document handling and formatting | Recommending decisions about individuals |
| Narrow procedural sub-tasks | Substantively evaluating people or their behaviour |
If your system touches people's outcomes, meaning who is hired, scored, granted or flagged, the examples push it in. If it touches data hygiene around a human-led process, they tend to push it out.
The Article 6(3) Filter: Four Narrow Exits
Article 6(3) provides four exemption pathways for an Annex III system that does not pose a significant risk of harm: it performs a narrow procedural task; it improves the result of a previously completed human activity; it detects decision-making patterns or deviations without replacing or influencing a prior human assessment; or it performs a preparatory task to an assessment. The draft reads all four narrowly. Chapter 3 of this guide dissects each pathway in detail.
The filter is not paperwork-free. A provider relying on it must document its assessment before the system is placed on the market or put into service (Article 6(4)) and must register the system in the EU database (Article 49(2)). An exemption you cannot evidence will not hold up.
Profiling Closes Every Exit
The third subparagraph of Article 6(3) is absolute: an Annex III system that performs profiling of natural persons is always high-risk. Profiling eliminates eligibility for all four filter pathways. This bites hardest in HR tech, financial services and adtech, where profiling is often the product's core mechanism rather than a side effect.
The task this sets up is concrete. Map every Annex III classification you hold to a named example in the draft, and decide whether the draft supports your call, challenges it, or stays silent. Record the exact example and paragraph in each case. That log is the working asset for the final section.
Legal Status: Not Binding, But Not Ignorable
The guidelines are not legally binding, and the Commission says so itself in the draft: authoritative interpretation of Regulation (EU) 2024/1689 rests with the Court of Justice of the European Union. The final text may also change after the consultation and AI Board input. That is why every position on this page is attributed to "the draft guidelines."
Market surveillance authorities will nonetheless lean on the guidelines as the default reading of Article 6. A classification that diverges from them does not automatically become wrong, but it needs stronger documentation, not silence.
The financial stakes are what make the documentation matter. Wrongly classifying a system out of high-risk feeds exposure under Article 99(4): fines up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. An incorrect, incomplete or misleading Article 6(4) assessment supplied to authorities falls under Article 99(5): up to EUR 7.5 million or 1% of turnover. For SMEs and start-ups, Article 99(6) caps each fine at the lower of the two figures, a proportionality cap rather than an exemption. For small mid-cap enterprises (SMCs), the lower amount applies only to fines under Article 99(4) and (5), not to fines for prohibited practices under Article 99(3) (Article 99(6a)).
The Digital Omnibus Backdrop: Which Deadlines These Guidelines Actually Serve
In Force Since 27 July 2026
The Digital Omnibus (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026), which reached political agreement on 6–7 May 2026, was adopted by the European Parliament on 16 June and the Council on 29 June 2026. It defers stand-alone Annex III high-risk obligations (Article 6(2)) from 2 August 2026 to 2 December 2027, and Annex I product-embedded high-risk (Article 6(1)) from 2 August 2027 to 2 August 2028.
Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The background is in what the Digital Omnibus changed, and the deferral detail in the Digital Omnibus and the 2027 deadline.
The new dates are fixed calendar dates, and that is easy to get wrong. The Commission's November 2025 proposal would have linked the start date to the availability of standards and support tools, with backstop dates; the co-legislators adopted fixed dates instead, so the deferral is not tied to harmonised-standards availability, and the obligations will not slip further just because standards are unfinished.
What Did Not Move
Not everything moved. The Article 5 prohibitions have applied since 2 February 2025 and the GPAI obligations under Articles 51-55 since 2 August 2025; both are untouched. Article 50, including 50(2) marking, has applied since 2 August 2026. Generative systems already on the market before that date have until 2 December 2026 (Art. 111(4)), the same date as two new Article 5 prohibitions, points (ba) and (bb). Both dates come earlier than either deferred high-risk date.
So classification work done now should be re-tested against the final guidelines once they land, rather than redone repeatedly as the guidance settles.
What to Do Until the Final Text
Date-Stamp Every Classification Against the Draft
The formal consultation window has closed, so the lever now is your own record. The procedure runs in four steps:
- Pull your inventory of Annex III and Annex I classifications.
- Check each against the draft's named examples, and date-stamp the result against the 19 May 2026 draft.
- Where you depart from a draft example, write down why now, citing the specific example and your reasoning.
- Raise contested borderlines through trade associations.
Log, Don't Re-Classify
Do not re-classify systems on the strength of the draft alone. The final text may differ from the draft, and reclassifying twice costs budget and credibility with internal stakeholders. Instead, build the classification log described above: for each AI system, record whether the draft supports, challenges or is silent on your call, with the specific example and paragraph cited. Keep your Article 6(3) assessments documented under Article 6(4) exactly as before.
Re-Test When the Final Version Lands
Re-run borderline systems within 30 days of the final text, which the Commission says it will adopt by the end of 2026. Your obligation dates are already fixed: Regulation (EU) 2026/1744 has been in force since 27 July 2026. Running the support/challenge log inside a structured risk classification workflow keeps that re-test cheap. If you want to know where each system stands against the full obligation stack today, run a readiness assessment.
The decision you need to make: Date-stamp every classification against the 19 May draft. Where you depart from a draft example, write down why now. Re-run borderline systems within 30 days of the final text. The formal consultation window has closed; raise contested borderlines through trade associations.
How Confir helps
Confir's risk classification module runs exactly the workflow this page describes. It asks plain-English questions about what each AI system does, derives the risk tier under Articles 5 and 6 (including the Article 6(3) filter pathways and the profiling override), and produces the documented assessment that Article 6(4) requires. The engine is deterministic and rule-based: the same inputs produce the same classification every time, with no model inference and no hallucination. That is precisely the property you want in evidence shown to a market surveillance authority.
Because every classification decision and its rationale land in an append-only audit log, time-stamped and locked against edits, recording where the draft guidelines support or challenge each call is a structured exercise rather than a spreadsheet. Confir's rule set reflects Regulation (EU) 2026/1744 as published, and when the final guidelines are adopted it updates to the final positions, so the re-test this page recommends runs against current rules, not stale ones.
Frequently Asked Questions
What are the Commission guidelines on the classification of high-risk AI systems?
They are draft interpretive guidelines published by the European Commission on 19 May 2026 under Article 6(5) of the EU AI Act. Across three documents they explain how to decide whether an AI system is high-risk: general classification principles, products and safety components under Annex I, and the Annex III use cases — with practical examples of systems that fall in and out of scope.
Are the draft high-risk AI classification guidelines legally binding?
No. The guidelines reflect the Commission's interpretation of Article 6 but are not legally binding — only the Court of Justice of the European Union can interpret the AI Act authoritatively. In practice, market surveillance authorities are expected to rely on them, so a classification that contradicts the guidelines should be documented with particular care.
Can I still respond to the consultation on the high-risk classification guidelines?
No. The targeted consultation ran from 19 May to 23 July 2026 (extended from 23 June) and has closed. The Commission says it will adopt the final guidelines by the end of 2026. Raise contested borderlines through trade associations, and write down now why any classification departs from a draft example.
Why were the high-risk classification guidelines published late?
Article 6(5) of the AI Act required the Commission to deliver the guidelines by 2 February 2026. The draft arrived on 19 May 2026, roughly three and a half months late, landing days after the Digital Omnibus agreement that — now in force as Regulation (EU) 2026/1744 — defers the main Annex III high-risk date to 2 December 2027, which softens the practical impact of the delay.
Does human review stop an AI system from being high-risk?
Not by itself. The draft guidelines state that adding a human in the loop does not declassify a high-risk system — what matters is the system's role and the weight of its output in the decision. The Article 6(3) exemptions are read narrowly, and any Annex III system that performs profiling of natural persons remains high-risk regardless.
Should companies re-classify their AI systems based on the draft guidelines?
No — not on the draft alone. The text may change before the Commission adopts the final guidelines, which it says it will do by the end of 2026. The better move is to log which of your existing classifications the draft supports or challenges, keep your Article 6(3) assessments documented under Article 6(4), and re-test the borderline calls against the final version.
When do the high-risk AI classification rules start to apply?
Annex III high-risk obligations apply from 2 December 2027 under the Digital Omnibus (Regulation (EU) 2026/1744 of 8 July 2026, OJ L 24.7.2026), which deferred them from the original 2 August 2026, with Annex I product cases moving to 2 August 2028. Regulation (EU) 2026/1744 was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026.