Is my AI feature high-risk under the EU AI Act?

Under the EU AI Act, “high-risk” is a label for what an AI system is used for, not for how powerful the model is. A chatbot built on a large model can be low-risk. A small scoring model that decides who gets a loan is high-risk. If your feature lands in the high-risk group, the strictest part of the Act applies to it from 2 December 2027.

This guide walks through the questions in the order they are usually asked. It is a starting point for your own assessment, and the final call needs a person who knows the law and your product.

Step 1: Is it an AI system at all?

The Act covers machine-based systems that infer from their input how to produce outputs such as predictions, content, recommendations or decisions, with some level of autonomy. A model call that scores, ranks, classifies or generates almost always counts. Plain rule-based code written entirely by people (if income < 20000 then reject) usually doesn’t.

Step 2: Is it banned?

Before high-risk comes the short list of banned uses in Art. 5. Among them:

• manipulating people in ways that cause them significant harm
• social scoring
• predicting that a person will commit a crime based only on profiling
• reading emotions at work or in schools, apart from medical or safety reasons
• scraping faces from the internet or CCTV to build recognition databases

If your feature is close to one of these, stop and get legal advice. These rules have applied since 2 February 2025.

Step 3: Is it in an Annex III area?

Annex III lists the areas where AI that affects people is high-risk. In short:

Area	Examples
Biometrics	Remote identification of people, categorising people by sensitive traits, emotion recognition
Critical infrastructure	Safety parts of systems that run roads, water, gas, heating or electricity
Education	Deciding admission, grading, assessing the right level of education, watching for cheating in tests
Employment	Screening CVs, ranking candidates, deciding promotion or dismissal, assigning tasks, monitoring performance
Essential services	Deciding access to public benefits, credit scoring, pricing life and health insurance, triaging emergency calls
Law enforcement, migration, justice	Risk assessments, evidence evaluation, visa and asylum decisions, helping judges apply the law

Credit scoring has a carve-out for systems used only to detect financial fraud.

There is a second route into high-risk: AI that is a safety part of a product already covered by EU product law in Annex I, such as machinery, toys or medical devices. Those rules apply from 2 August 2028.

Step 4: Does an exception apply?

A system in an Annex III area is not high-risk if it doesn’t pose a significant risk of harm and does only one of these (Art. 6(3)):

• a narrow procedural task, such as turning unstructured documents into structured data
• improving the result of something a person has already done, such as polishing the wording of a letter
• spotting patterns or departures from past decisions, without replacing or influencing a human assessment without proper review
• a preparatory task for an assessment a person then makes, such as translating or indexing files

There is one firm limit. If the system profiles people, it stays high-risk, whatever else it does.

If you rely on an exception, write down why before you put the system on the market. You may need to register it in the EU database even though it isn’t high-risk.

Three examples

A CV screener that ranks applicants. Employment area, ranking candidates, and it shapes who gets an interview. High-risk.

A tool that drafts a polite rejection email after a recruiter has decided. Employment area, but it only improves a text after a human decision. Likely covered by the exception, as long as it doesn’t profile the candidate. Write down the reasoning.

A support chatbot for a bank. Not in an Annex III area by itself, so not high-risk. It still has to tell customers they are talking to an AI (Art. 50). If it starts deciding who gets a loan, that part becomes high-risk.

What changes if it is high-risk

If you are the provider of a high-risk system, by 2 December 2027 you need, among other things:

• a risk management process (Art. 9)
• governance for training and test data (Art. 10)
• technical documentation (Art. 11)
• automatic logs of what the system does (Art. 12)
• instructions for the companies that deploy it (Art. 13)
• human oversight built in, so a person can understand, override or stop it (Art. 14)
• accuracy, robustness and security measures (Art. 15)
• a quality management system (Art. 17)

Logs and human oversight are the two that most often need changes to product code, and they take months to add well.

What you can check in your code

Code can’t decide the risk tier. It can show signals that help a person decide, and gaps that matter if the answer is “high-risk”:

• model outputs that become final decisions about people with no review step (automated decision rule)
• model calls with no record kept (AI call not logged)
• emotion recognition or biometric categorisation libraries (emotion or biometric rule)

Lintsure’s classify tool asks the same questions as this guide (EU users, AI use, decision area) and suggests which frameworks may apply, then asks you to confirm. See also the EU AI Act for developers.