European Commission Publishes Draft Guidelines on High-Risk AI Systems under the EU AI Act

The European Commission has published draft Guidelines on the classification of high-risk AI systems under Article 6 of the EU AI Act.

The Guidelines are particularly significant because they provide the Commission’s first detailed interpretation of when AI systems should — and should not — fall within the “high-risk” category under the AI Act. They are intended to support providers, deployers, public authorities and market surveillance authorities in applying the rules more consistently across the EU.

The draft Guidelines clarify the two main routes through which an AI system may qualify as high-risk:

  • AI systems embedded in regulated products under Annex I (such as medical devices, machinery, robotics and other safety-related products); and
  • AI systems used in specific sensitive areas listed in Annex III, including biometrics, employment, education, financial services, migration, law enforcement and critical infrastructure.

A central theme throughout the draft is the importance of the AI system’s “intended purpose”. The Commission makes clear that classification will depend not only on technical functionality, but also on how the provider presents, documents and markets the system.

The Guidelines also confirm several important practical points for businesses:

  • human oversight alone will not remove high-risk classification;
  • the exemption mechanism under Article 6(3) AI Act will be interpreted narrowly;
  • AI systems involving profiling of individuals remain under heightened scrutiny; and
  • interconnected or agentic AI systems may be assessed together as one combined high-risk system.

Importantly, the draft includes numerous practical examples illustrating when AI systems are likely to fall inside — or outside — the high-risk category. This will be particularly useful for organisations currently conducting AI governance, classification and compliance assessments.

The Commission launched a targeted consultation on 19 May 2026, which remains open until 23 June 2026. Stakeholders, including businesses, developers, public authorities, academia and civil society, are invited to submit feedback on the draft.

The publication also follows the political agreement on the AI Omnibus, which extends certain implementation timelines under the AI Act:

  • rules for Annex III high-risk AI systems are expected to apply from 2 December 2027; and
  • rules for AI systems embedded in regulated products under Annex I are expected to apply from 2 August 2028.

The draft Guidelines are another important step in the operationalisation of the EU AI Act and provide useful insight into the Commission’s evolving enforcement approach.

Ceyhun Necati Pehlivan

Meet the Founder →

Subscribe to Cornerstone Counsel

Insights on technology, data, and digital law

 

Leading publications

Editor and co-author of leading publications in artificial intelligence, privacy and technology law.

Editor-in-Chief, Global Privacy Law Review · Co-editor, and co-author of two seminal books on AI, spanning more than 2,000 pages and bringing together over 90 leading experts, including academics, judges, regulators and practitioners.

Wolters Kluwer

View Publications →