AI glossary for businesses
High-risk AI system
In short
A high-risk AI system is an AI system that the EU AI Act considers able to seriously affect people's health, safety or fundamental rights. It includes AI used as a safety component of regulated products and AI used in areas listed in Annex III, such as recruitment, credit scoring and education. These systems must meet strict requirements.
How the classification works
The EU AI Act does not label a tool high-risk because it is powerful. It looks at what the system is used for. There are two main routes:
Product safety: AI that is a safety component of products already covered by EU safety law, such as machinery, medical devices or toys.
Annex III uses: AI used in listed areas, including biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit and some insurance, law enforcement, migration and justice.
Think of it like a building permit. A garden shed needs little paperwork. A school needs plans, inspections and sign-offs, because many people depend on it being safe. The AI Act applies the same logic. There are narrow exceptions, for example when a system only performs a minor preparatory task, so each case needs checking.
In practice for a small business
The most common way an SME meets this category is recruitment. Suppose a logistics company in Thessaloniki starts using a tool that ranks CVs or filters candidates automatically. Recruitment and candidate screening are high-risk uses under Annex III. Even as a user (a deployer), the company would need to use the tool according to its instructions, assign trained people to oversee it, monitor how it performs, keep the logs it generates, and inform candidates and staff where required. The use case on AI for job ads and candidate screening separates lower-risk tasks, like drafting the text of a job ad, from high-risk ones. Note that using AI to target job ads at specific people is also listed in Annex III.
By contrast, using ChatGPT to write a product description or Canva for social posts is not high-risk.
Why it matters and what to watch out for
Timeline. High-risk obligations phase in through 2026–2027. Follow official EU updates, because dates and guidance may change.
Providers carry most duties. The company that builds the system handles conformity assessment and technical documentation. Ask vendors for clear information before you buy.
GDPR applies too. High-risk uses often involve personal data, so a data protection impact assessment (DPIA) is often needed.
Get advice early. This page is not legal advice. If a use might be high-risk, check with your DPO or legal advisor before you start.