Documenting a not-high-risk decision under the Article 6(3) exemption
A function matches an Annex III use case, and the provider considers that a condition in Art. 6(3) removes the high-risk classification. The conclusion holds only where the function performs no profiling; Art. 6(4) requires the assessment documented before placing on the market and the system registered under Art. 49(2). Regulation (EU) 2026/1744 kept both duties and trimmed the data set. Chapter III Section 1 applies to Annex III systems from the date in the regulation data Deferred. This page gives the sequence, the record and the data set.
Where this starts
The situation arrives in two forms. A governance function with a portfolio of built, bought and vendor-embedded systems needs each not-high-risk decision recorded in a form that answers an authority's question, and needs the same form across business units. A provider of an Annex III product, for example a recruitment tool, has one function that extracts fields from an application and another that ranks applicants, and wants the first function outside the high-risk set. Art. 6(3) of Regulation (EU) 2024/1689 opens the derogation: an Annex III system is not high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The derogation applies where the system is intended to perform a narrow procedural task, to improve the result of a previously completed human activity, to detect decision-making patterns or deviations from prior patterns where it is not meant to replace or influence the previously completed human assessment without proper human review, or to perform a preparatory task to an assessment relevant for an Annex III use case. The third subparagraph closes the derogation: a system that performs profiling of natural persons is always high-risk, with profiling taking the meaning in Art. 3(52). The risk classifier runs the four conditions and the profiling rule on the published logic; the enterprise hub carries the portfolio view.
The conclusion exists only as a document. Art. 6(4) requires a provider that considers an Annex III system not high-risk to document its assessment before the system is placed on the market or put into service, to give the documentation to a national competent authority on request, and to register the system under Art. 49(2) before placing it on the market. The regulation entry for that duty records what Regulation (EU) 2026/1744 changed: it kept the Art. 6(4) documentation duty and the Art. 49(2) registration, deleted point 7 of Annex VIII Section B (the summary of the grounds for the not-high-risk conclusion) and point 9 (the Member States where the system is placed on the market), and left points 1 to 6 and 8 in place, including the condition or conditions under Art. 6(3) on which the system is considered not high-risk. The streamlined data set carries the date on the entry Working reading. From which date the registration duty itself binds is an unsettled point; the callout below shows both readings, and this page states neither reading as its own.
The decision criteria come from Commission guidelines on high-risk classificationDraft, a draft under consultation that gives the general principles, worked examples per condition and, at paras. 113 to 116, the Art. 6(4) duties to document the assessment and to register the system so that exempted systems stay traceable. The draft reads the four conditions narrowly, and a final version can change a recorded result, so the record names the stage of the guideline on every citation. The function that fails the filter keeps the Annex III classification under Art. 6(2) and carries Chapter III Section 2, beginning with the risk management file under Art. 9 and the Annex IV technical documentation under Art. 11. Annex IV section 1(a) states the intended purpose of the documented system, and the draft guideline's general principles count materials that leave a high-risk use open toward the Annex III match, so the intended purpose in the technical documentation, in the instructions for use and in the Art. 6(3) record has to be the same statement. The classification protocol records that check at step 14 before any condition is tested.
The sequence
The work runs function by function: the Annex III match first, then the four conditions and the profiling rule, then the documentation and registration checks, then the register for what remains high-risk.
Match the intended purpose of each function against the Annex III areas and their listed use cases.
Record Annex III matching record, one row per function
[Regulation (EU) 2024/1689, Art. 6(2) and Annex III points 1 to 8; PR-CLS step 13]
Check that the instructions for use, marketing materials and terms limit each function to its stated purpose.
Record Intended-purpose consistency record
[Commission guidelines on high-risk classification, draft, general principles, para. 12; PR-CLS step 14]
Test each matched function against the four conditions and record the condition relied on, or none.
Record Art. 6(3) condition record, one row per Annex III match
[Regulation (EU) 2024/1689, Art. 6(3) first and second subparagraph, points (a) to (d); PR-CLS step 15]
Check whether the function performs profiling of natural persons, and record a profiling function as high-risk.
Record Profiling check record
[Regulation (EU) 2024/1689, Art. 6(3) third subparagraph and Art. 3(52); PR-CLS step 16]
Record why the function poses no significant risk of harm and does not materially influence a decision outcome.
Record Determination rationale record: significant risk of harm and material influence on the outcome
[Regulation (EU) 2024/1689, Art. 6(3) first subparagraph; PR-CLS step 40]
Check that the assessment is documented, dated and version-stamped before placing on the market or putting into service.
Record Art. 6(4) documentation check
[Regulation (EU) 2024/1689, Art. 6(4); PR-CLS step 17]
Compare the EU database entry, or its draft, with Annex VIII Section B points 1 to 6 and 8.
Record Registration data-set check, one row per Annex VIII Section B point
[Regulation (EU) 2024/1689, Art. 49(2) and Annex VIII Section B; PR-CLS step 18]
Resolve each function to one classification and compile the Section 2 register for the functions that remain high-risk.
Record Classification resolution record and obligation register
[PR-CLS steps 38 and 39]
Mark each determination as a technical assessment for discussion with counsel.
Record Counsel note on each determination
[PR-CLS step 43]
The Art. 6(3) assessment record uses the fixed layout of the protocol. One is shown with synthetic values for a function that passes the filter next to a function that does not.
record: article-6-3-assessment
system: synthetic-recruitment-screening-assistant
function: F-01, extracts fields from a submitted CV into the structured application form
annex_iii_match: point 4(a), recruitment or selection of natural persons
intended_purpose_consistency: all materials limit F-01 to field extraction
art_6_3_condition_tested: (a) (b) (c) (d)
art_6_3_condition_relied_on: (a), narrow procedural task
profiling_of_natural_persons: no, output is the applicant's own stated data, no inference
significant_risk_of_harm: none recorded, F-01 does not score, rank, filter or recommend
material_influence_on_outcome: none recorded, F-02 and the recruiter act on the form, not on F-01
art_6_4_documented_before_placing_on_market: yes, dated, version v3.2
art_49_2_registration: draft entry, Annex VIII Section B points 1 to 6 and 8 present, point 6 states condition (a)
result: F-01 not high-risk under Art. 6(3), point (a); F-02 (ranking) high-risk under Art. 6(2), profiling
rationale_ref: DRR-01
counsel_note: technical assessment for discussion with counsel
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| High-risk classification record (PR-CLS output) | Art. 6(2) and Annex III: the matching per function and the consistency of the intended purpose across materials | PR-CLS v1.0 |
| Article 6(3) assessment record (PR-CLS output) | Art. 6(3) first to third subparagraph: the condition relied on per Annex III match and the profiling check | PR-CLS v1.0 |
| Determination rationale record (PR-CLS output) | Art. 6(3) first subparagraph: why the function poses no significant risk of harm and does not materially influence a decision outcome | PR-CLS v1.0 |
| Art. 6(3) assessment documentation, dated before placing on the market | Art. 6(4): the assessment the provider gives to a national competent authority on request | the provider |
| EU database registration entry with Annex VIII Section B points 1 to 6 and 8 | Art. 49(2): the provider, the system, its intended purpose, the Art. 6(3) condition relied on and the status | the provider |
| Obligation register (PR-CLS output) | Chapter III Section 2 per function that remains high-risk, with a regulation entry id per date | PR-CLS v1.0 |
| Risk management file (Art. 9(1)) | Art. 9(1) and 9(2): the risks of each function that remains high-risk, with the residual risk judgement | the provider |
| Annex IV technical documentation set (Annex IV sections 1 to 9) | Annex IV section 1(a): the intended purpose of each high-risk function, identical to the statement in the Art. 6(3) record | the provider |
Each artifact follows a specification with a synthetic sample on the deliverables page: the classification, assessment and rationale records follow the assessment memo specification, the obligation register follows the register or checklist specification, and the risk management file and the Annex IV set are the provider's own documents in the structure the obligation pages describe.
If nothing is done
A system the provider classified as not high-risk falls under the procedure of Art. 80: where a market surveillance authority has sufficient reason to consider that the system is high-risk, Art. 80(1) directs the authority to evaluate the classification against the Art. 6(3) conditions and the Commission guidelines, and where the evaluation finds the system high-risk, Art. 80(2) requires the provider to take the action needed to meet the requirements and obligations of the Regulation and to take corrective action within a period the authority sets. A provider that does not act within that period is subject to fines under Art. 99 by Art. 80(4), a provider that misclassified the system to circumvent Chapter III Section 2 is subject to fines under Art. 99 by Art. 80(7), and Art. 80(6) applies the Art. 79(5) to (9) measures where the corrective action is inadequate. An assessment that was never documented cannot be produced on request under Art. 6(4), and incorrect, incomplete or misleading information given to a national competent authority in reply to a request falls under Art. 99(5). The action from the provider's side is to re-run steps 1 to 8 above on the function concerned and, where it is high-risk, to open the Section 2 set with the risk management file under Art. 9 and the Annex IV documentation under Art. 11, to run the conformity assessment under Art. 43 before placing on the market, and to take the same corrective action for every copy of the system on the Union market under Art. 80(5). A deployer reads the same register: the draft guidelines encourage deployers to verify a claimed exemption in the EU database, and the inventory scenario records that check per vendor system.
Services, guides and tools for this situation
The classification and readiness assessment runs PR-CLS v1.0 on the portfolio or on one system and issues the classification memo with the Art. 6(3) rationale, the obligation register and the gap list, within the limits stated on what we cannot do: the memo is a technical assessment for discussion with counsel, and a market surveillance authority, the AI Office or a court can reach a different result.
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.