High-Risk AI System

Under the EU AI Act, high-risk AI systems are those that fall into one of two main categories. First, AI systems used as safety components of products covered by EU harmonisation legislation listed in Annex I (e.g., machinery, medical devices, toys, lifts). Second, AI systems deployed in sensitive areas listed in Annex III, such as biometric identification, critical infrastructure management, education, employment, law enforcement, migration, and administration of justice.

Providers of high-risk AI systems must comply with a comprehensive set of requirements before placing them on the market. These include establishing a risk management system, ensuring data governance and quality of training datasets, maintaining detailed technical documentation, implementing logging and record-keeping capabilities, providing transparency and information to deployers, enabling effective human oversight, and ensuring appropriate levels of accuracy, robustness, and cybersecurity.

High-risk AI systems must undergo a conformity assessment, either through internal control procedures or, in certain cases, involving a notified body, before being placed on the EU market. They must also be registered in the EU database for high-risk AI systems.

The obligations extend beyond initial market placement. Providers must implement post-market monitoring systems, report serious incidents to national authorities, and ensure continued compliance throughout the system's lifecycle. Deployers of high-risk AI systems also bear specific obligations, including conducting fundamental rights impact assessments in certain cases.