Guidelines on classification of high-risk AI systems: applying them to one system

What the obligation asks for

Art. 6 of Regulation (EU) 2024/1689 has two routes into the high-risk class and one route out. Under Art. 6(1) a system is high-risk where it is a safety component of a product, or is itself a product, covered by the Union harmonisation legislation in Annex I, and that product needs a third-party conformity assessment under that legislation. Under Art. 6(2) a system referred to in Annex III is high-risk. Under Art. 6(3) an Annex III system is not high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making, and one of four conditions holds: the system performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns or deviations from prior patterns without replacing or influencing a completed human assessment without proper human review, or performs a preparatory task to an assessment relevant for an Annex III use case. The third subparagraph closes the route out for any system that performs profiling of natural persons, with profiling taking the meaning in Art. 3(52). Art. 6(4) requires a provider that relies on Art. 6(3) to document the assessment before placing on the market or putting into service, to give the documentation to a national competent authority on request, and to register the system under Art. 49(2). Art. 6(5) tasks the Commission with guidelines on the practical implementation of the article; the draft under consultation, Commission guidelines on high-risk classificationDraft on the standards page, gives the general principles, the Annex I guidance and the Annex III guidance that this guide cites by section. A final version can change a recorded result, so every citation names the stage.

Chapter III Section 1, which holds Art. 6, applies to Annex III systems from the Annex III application date 2027-12-02Deferred; the regulation entry states that Regulation (EU) 2026/1744 amended Art. 113(c) and that the obligations are unchanged in content. The registration duty that follows a not-high-risk conclusion carries its own entry 2026-07-27Working reading, and its timing is an unsettled point: the callout shows both readings, and step 10 below runs the data-set check under the working reading. A function that leaves the sequence as high-risk under Art. 6(2) or Art. 6(1) opens the Art. 9 obligation record: the risk management file that Art. 9(1) requires to be established, implemented, documented and maintained, and the tests that Art. 9(8) requires to run against prior defined metrics and probabilistic thresholds before placing on the market. This guide covers the classification that decides whether that record applies; the Art. 9 elements themselves are tested under PR-17-QMS v1.0 and PR-15-ROB v1.0, and step 12 records the hand-off. The role question that precedes classification, provider under Art. 3(3) or deployer under Art. 3(4), is on the provider vs deployer guide and is not repeated here.

Inputs

The inputs are the subset of the PR-CLS v1.0 input table that steps 12 to 18 read. The full table is on the protocol page.

• The intended-purpose statement, the instructions for use, the marketing materials and the terms of service, one entry per material.
• The function inventory: each function with its inputs, its outputs and the natural persons it affects, on the protocol's inventory template.
• Interface access for behaviour observation: a test account or staging environment with the same functions as production, used to check what each function does with the natural persons it affects.
• For an Annex I product: the product's conformity assessment route under the listed legislation, from the manufacturer's technical file.
• Where a not-high-risk conclusion is claimed: the Art. 6(3) assessment document, dated and version-stamped, and the EU database entry or its draft with the Annex VIII Section B fields.
• The regulation entry id for each application date the obligation register will carry, from the regulation data.

Procedure

The procedure is the decision sequence of the protocol with one step added at the front. PR-CLS v1.0 and the risk classifier both start after the Art. 5 question: the classifier's logic page states that the tool does not assess the Art. 5 prohibited practices, so step 3 below derives from the Act text and produces a record the tool does not. From step 4 on, the sequence and the tool's rules agree: an Annex I Section A act that lets the manufacturer self-assess does not satisfy Art. 6(1)(b), a profiling answer keeps the system high-risk whatever condition is claimed, and where routes give different results the strictest classification is recorded. The two code blocks follow the steps. Every name, function id, version and value in the examples is synthetic.

1. Record the system name and version, and collect the intended-purpose statement, the instructions for use, the marketing materials and the terms of service.

   Record System identification record and intended-purpose evidence set, one entry per material

   [AIAssuranceLabs procedure; PR-CLS steps 1 and 2; Commission guidelines on high-risk classification, draft, general principles, para. 12 on intended purpose]

2. List each function of the system with its inputs, its outputs and the natural persons it affects.

   Record Function inventory with a function id per row

   [AIAssuranceLabs procedure; PR-CLS step 5]

3. Screen each function against every point of Art. 5(1) and stop the sequence for a function that matches one.

   Record Prohibited-practice screen record, one row per function: each Art. 5(1) point, matched or not matched, with the evidence

   [Regulation (EU) 2024/1689, Art. 5(1), including points (ba) and (bb) inserted by Regulation (EU) 2026/1744]

4. Check whether the system is, or is a safety component of, an Annex I product that needs third-party conformity assessment under the listed legislation.

   Record Annex I route record: product, safety component status, Section A or B, conformity assessment route

   [Regulation (EU) 2024/1689, Art. 6(1)(a) and (b); Commission guidelines on high-risk classification, draft, Annex I guidance; PR-CLS step 12]

5. Match the intended purpose of each function against the Annex III areas and their listed use cases.

   Record Annex III matching record, one row per function: area, point, listed use case, matched or not matched

   [Regulation (EU) 2024/1689, Art. 6(2) and Annex III points 1 to 8; Commission guidelines on high-risk classification, draft, Annex III guidance; PR-CLS step 13]

6. Check whether every material limits each function to its stated purpose, and record any material that leaves an Annex III use open.

   Record Intended-purpose consistency record: per material, whether it limits the function to its stated purpose or leaves a high-risk use open

   [Commission guidelines on high-risk classification, draft, general principles, para. 12; PR-CLS step 14]

7. Test each matched function against the four Art. 6(3) conditions in turn and record the evidence for each.

   Record Art. 6(3) condition record, one row per Annex III match: each of the four conditions, holds or does not hold, with the evidence

   [Regulation (EU) 2024/1689, Art. 6(3) first and second subparagraph, points (a) to (d); Commission guidelines on high-risk classification, draft, Annex III guidance, section on Art. 6(3); PR-CLS step 15]

8. Check whether the function performs profiling of natural persons, and record a profiling function as high-risk regardless of step 7.

   Record Profiling check record: whether the function evaluates personal aspects of natural persons from personal data, with the inputs and the inferred attributes

   [Regulation (EU) 2024/1689, Art. 6(3) third subparagraph and Art. 3(52); PR-CLS step 16]

9. For a function that passes steps 7 and 8, check that the assessment is documented and dated before placing on the market or putting into service.

   Record Art. 6(4) documentation check: document present, dated before placing on the market or putting into service, version matched to the system

   [Regulation (EU) 2024/1689, Art. 6(4); Commission guidelines on high-risk classification, draft, paras. 113 to 116; PR-CLS step 17]

10. Compare the EU database entry, or its draft, with Annex VIII Section B points 1 to 6 and 8, under the working reading of the unsettled point.

    Record Registration data-set check, one row per Annex VIII Section B point: present or absent

    [Regulation (EU) 2024/1689, Art. 49(2) and Annex VIII Section B; PR-CLS step 18]

11. Resolve each function to the strictest applicable classification and compile the obligation register.

    Record Classification resolution record and obligation register, with the regulation entry id per date

    [AIAssuranceLabs procedure; PR-CLS steps 38 and 39]

12. For each high-risk function, open the Art. 9 risk management file, record the protocol hand-off and add the counsel note.

    Record Protocol hand-off list naming PR-17-QMS and PR-15-ROB per high-risk function, and the counsel note on each determination

    [Regulation (EU) 2024/1689, Art. 9(1); PR-CLS steps 41 and 43]

Example for steps 5 to 11. The record below is the protocol's high-risk classification record extended with one row per Art. 6(3) condition and the evidence behind each row, for a synthetic system that triages applications for a public assistance benefit. The Annex III point examined is point 5(a), and every condition is tested even after the first one fails, so that the record shows the whole filter was run. The profiling row decides the outcome on its own. The system, the function, the version, the materials and the evidence are synthetic.

# Synthetic example: classification record for one function of one system.
record: high-risk-classification
system: synthetic-benefit-triage-assistant
version: 2.1.0
function: F-03, orders the queue of benefit applications for caseworker assessment
intended_purpose: >
  Assigns each incoming application a likelihood-of-eligibility score from the
  applicant's declared income, household composition and application history, and
  sorts the caseworker queue by that score.
affected_persons: applicants for a public assistance benefit
art_5_screen: no Art. 5(1) point matched, screen record PSR-03
route_art_6_1: not applicable, no Annex I product or safety component
route_art_6_2:
  annex_iii_point: 5(a), evaluation of eligibility of natural persons for essential public assistance benefits and services
  matched: yes
  intended_purpose_consistency: instructions for use and marketing materials both state queue ordering by eligibility likelihood; no material leaves a further use open
art_6_3_conditions:
  - condition: (a) narrow procedural task
    holds: no
    evidence: the score changes which applications a caseworker sees first and which wait; recital 53 gives as examples of a narrow procedural task the transformation of unstructured data into structured data, the classification of documents and the detection of duplicates, none of which F-03 performs
  - condition: (b) improve the result of a previously completed human activity
    holds: no
    evidence: F-03 runs before any human assessment of the application
  - condition: (c) detect decision-making patterns or deviations from prior patterns
    holds: no
    evidence: F-03 scores each application on its own data; it does not compare a caseworker decision with prior decisions
  - condition: (d) preparatory task to an assessment
    holds: no
    evidence: the score is shown to the caseworker with the application and shapes the assessment order; recital 53 gives indexing, searching, text and speech processing and translation as examples of a preparatory task with a very low impact on the assessment that follows, and a score that orders the assessment is more than that
significant_risk_of_harm: yes, a low score delays access to a benefit for the applicant
profiling_of_natural_persons: yes, F-03 evaluates the personal situation of each applicant from personal data to predict eligibility (Art. 3(52))
art_6_4_documentation: not applicable, no not-high-risk conclusion
art_49_2_registration: not applicable under Art. 6(3); Art. 49(1) registration applies to the high-risk system
outcome: high-risk under Art. 6(2), Annex III point 5(a)
follows: Art. 9 risk management file opened; hand-off to PR-17-QMS and PR-15-ROB
entry: annex-iii-high-risk
resolution_ref: CRR-03
rationale_ref: DRR-07
counsel_note: technical assessment for discussion with counsel

Example for steps 3 to 11. The function below encodes the decision sequence: the Art. 5 screen, the Art. 6(1) route with the third-party conformity assessment condition of Art. 6(1)(b), the Art. 6(2) match, the four Art. 6(3) conditions, the profiling rule, and the resolution to the strictest classification in the same tier order the classifier uses. It reads a record in the shape of the YAML above and prints the outcome. The registration_duty value follows the working reading of the unsettled point and names the alternative in its text; the function does not decide between them.

# Synthetic example: decision sequence for one function under Art. 5, Art. 6(1), 6(2), 6(3) and 6(4).
from __future__ import annotations

from dataclasses import dataclass, field

TIER_ORDER = [
    "high-risk under Art. 6(2), Annex III",
    "high-risk under Art. 6(1), Annex I Section A",
    "Annex I Section B product, sectoral route under Art. 2(2)",
    "Annex III area, not high-risk under Art. 6(3)",
    "no high-risk classification identified",
]


@dataclass
class FunctionRecord:
    function_id: str
    art_5_point_matched: str | None                 # e.g. "5(1)(f)" or None
    annex_i_section: str | None                     # "A", "B" or None
    annex_i_third_party_assessment: bool            # Art. 6(1)(b)
    annex_iii_point: str | None                     # e.g. "5(a)" or None
    materials_leave_high_risk_use_open: bool        # draft guidelines, para. 12
    art_6_3_conditions_holding: list[str] = field(default_factory=list)  # subset of ["a", "b", "c", "d"]
    profiling_of_natural_persons: bool = False      # Art. 6(3) third subparagraph, Art. 3(52)
    art_6_4_documented_before_placing: bool = False


def classify(r: FunctionRecord) -> dict:
    if r.art_5_point_matched:
        return {"function": r.function_id, "outcome": f"prohibited practice, Art. {r.art_5_point_matched}",
                "next": "stop; no Art. 6 classification is recorded"}

    candidates: list[str] = []
    notes: list[str] = []

    if r.annex_i_section == "A" and r.annex_i_third_party_assessment:
        candidates.append(TIER_ORDER[1])
    elif r.annex_i_section == "A":
        notes.append("Annex I Section A act allows self-assessment; Art. 6(1)(b) not met on that ground")
    elif r.annex_i_section == "B":
        candidates.append(TIER_ORDER[2])

    if r.annex_iii_point or r.materials_leave_high_risk_use_open:
        exempt = bool(r.art_6_3_conditions_holding) and not r.profiling_of_natural_persons
        if r.profiling_of_natural_persons:
            notes.append("profiling of natural persons keeps the function high-risk in every case (Art. 6(3), third subparagraph)")
        if exempt:
            candidates.append(TIER_ORDER[3])
            if not r.art_6_4_documented_before_placing:
                notes.append("Art. 6(4) assessment not documented before placing on the market")
            notes.append("registration_duty: Art. 49(2) with Annex VIII Section B points 1 to 6 and 8 under the working reading; "
                         "the alternative reading defers the duty to the Annex III date (unsettled point art6-3-registration)")
        else:
            candidates.append(TIER_ORDER[0])

    if not candidates:
        candidates.append(TIER_ORDER[4])

    outcome = min(candidates, key=TIER_ORDER.index)  # strictest classification, PR-CLS step 38
    follows = "Art. 9 risk management file; hand-off to PR-17-QMS and PR-15-ROB" if outcome in TIER_ORDER[:2] else "none under Art. 9"
    return {"function": r.function_id, "outcome": outcome, "notes": notes, "follows": follows}


record = FunctionRecord(
    function_id="F-03",
    art_5_point_matched=None,
    annex_i_section=None,
    annex_i_third_party_assessment=False,
    annex_iii_point="5(a)",
    materials_leave_high_risk_use_open=False,
    art_6_3_conditions_holding=[],
    profiling_of_natural_persons=True,
)
print(classify(record))
# {'function': 'F-03', 'outcome': 'high-risk under Art. 6(2), Annex III',
#  'notes': ['profiling of natural persons keeps the function high-risk in every case (Art. 6(3), third subparagraph)'],
#  'follows': 'Art. 9 risk management file; hand-off to PR-17-QMS and PR-15-ROB'}

The output is a record for step 11, not a classification decision under Art. 6: the function reads the answers it is given, and the evidence behind each answer sits in the records of steps 3 to 10. A reading of a condition that the draft guideline leaves open, such as how far a score can shape an assessment before condition (d) fails, is recorded as an open judgement under PR-CLS v1.0 step 40.

A pitfall that vendor documentation omits

A product sheet states one classification for the product. Art. 6 classifies by intended purpose, and the draft guideline's general principles at para. 12 read intended purpose from every material the provider issues, so the unit of classification is the function and the materials that describe it, not the product name. Two consequences follow. First, a product with one function outside Annex III and one inside carries the high-risk classification for the second function, and the Art. 6(3) record is written per Annex III match, as step 7 does; a single sentence that the product "is not high-risk" answers no row of that record. Second, a marketing page that leaves an Annex III use open counts toward the match under the general principles, which is why step 6 reads the marketing materials and the terms of service and not only the instructions for use. The not-high-risk decision scenario walks the per-function record for a system where one function passes the filter and one does not.

A second omission is the profiling rule. A claim of condition (a) or (d) for a scoring, ranking or matching function says nothing about whether the function evaluates personal aspects of natural persons from personal data, and Art. 6(3) third subparagraph makes that question decisive: a profiling function is high-risk whatever condition is claimed, which is why step 8 runs after step 7 and overrides it, and why the classifier's rules treat a profiling answer as a high-risk answer. The third omission is the Annex I condition. Art. 6(1)(b) requires that the product needs a third-party conformity assessment under the listed legislation; a product under an Annex I Section A act that the manufacturer self-assesses is not high-risk on that ground, and the Annex III test still applies to it, as step 4 and the classifier's rule for a self-assessed product both record. Regulation (EU) 2024/1689 sets no numeric threshold for any decision in this sequence. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity attaches to any classification; no JTC 21 draft covers classification, so the second and third levels of the hierarchy are empty; the criteria in use sit at the fourth level, Commission guidelines on high-risk classificationDraft, a draft under consultation, and at the sixth, the provider's justified reading of "significant risk of harm" and "materially influencing", recorded at step 40 of the protocol.

What the result shows and what it does not

The result shows, for each function, which Art. 6 route was matched on the evidence collected, which Art. 6(3) condition holds or fails and why, whether the function profiles natural persons, and whether the Art. 6(4) document and the Annex VIII Section B data set exist for a not-high-risk conclusion. It does not give a legal opinion on classification: the protocol's limitations section states that a market surveillance authority, the AI Office or a court can reach a different result, and that a final version of the draft classification guidelines can change a recorded result, which the revision history of PR-CLS v1.0 then records. The Art. 5 screen in step 3 reads the function inventory and the observed behaviour; a function added after the observation is outside the result. The registration check in step 10 runs under the working reading of an unsettled point and the register carries both readings. The result is evidence for the provider's own file, and the classification decision under Art. 6 remains with the provider and their counsel. The classification and readiness assessment service runs the sequence and delivers the classification memo with the Art. 6(3) rationale and the obligation register, which follow the assessment memo and register specifications on the deliverables page; its scope limits are on what we cannot do.

Related pages

The role determination that precedes this sequence is on the provider vs deployer guide, and the register that follows it feeds the traceability matrix on the compliance matrix guide; the obligation, the protocol, both guides and the hubs for the two audiences are listed below, and every protocol on the site is on the methodology index.

Obligations

• Art. 9

Protocols

• PR-CLS v1.0

Related guides

• Provider vs deployer under the AI Act
• Building an EU AI Act compliance matrix: traceability from obligation to evidence

ICP hubs

• Enterprises
• Annex III providers

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com