A practical guide to classifying an AI system as high risk under the EU AI Act: the two routes into the category, the sensitive use areas, self-check questions, the obligations it triggers, and why documenting the decision matters.
Not every artificial intelligence system is subject to the same obligations under the EU AI Act. The act is built on a risk hierarchy, and the heavy obligations fall mainly on systems classified as high risk. The first and most important decision for any organization is therefore to classify its systems correctly.
This article gives a practical way to check whether a given system falls into the high-risk category.
A wrong classification is expensive in both directions. Classify a high-risk system as low, and you expose the organization to non-compliance, fines, and a delayed market entry. Over-classify, and you spend resources on obligations that are not required. An accurate, documented classification is the basis of any compliance program.
The act sorts systems into four levels: unacceptable risk (prohibited), high risk (strict obligations), limited risk (mainly transparency obligations), and minimal risk (almost unregulated). This article focuses on identifying the second level, high risk, because it triggers the bulk of the regulation.
A system can enter the high-risk category by two main routes. The first: the system serves as a safety component of a product already subject to EU regulation, such as medical devices, vehicles, or machinery. The second: the system operates in one of the sensitive use areas listed in the act, among them recruitment and employee evaluation, credit scoring and access to financial services, education and student assessment, essential public services, critical infrastructure, biometric identification, and law enforcement.
If your system touches one of these, assume high risk until shown otherwise.
For a first-pass classification, ask: does the system affect a decision with a significant consequence for a person, such as hiring, credit, or access to a service? Is it part of a regulated product? Does it process biometric data? Could its failure harm safety or rights? A yes to any of these is a clear sign that a deeper high-risk analysis is needed.
A high-risk classification triggers significant obligations: a risk management system, data quality and governance, effective human oversight, detailed technical documentation, transparency toward the user, and sometimes registration in a dedicated database. Preparing for all of these starts early, before market entry, not after the fact.
Even a system operating in a listed area is not necessarily high risk, if it can be shown not to pose a real risk to rights or safety, for example when it performs a narrow, purely supporting task. But relying on such an exception requires an orderly analysis. Documenting the decision and its reasoning is critical: it is the organization's defense before a regulator who asks why you classified as you did.
Preparation starts with three steps: map every AI system in the organization, classify each to its risk level by the routes above, and document the reasoning for the classification. An orderly classification infrastructure saves duplicated work, prevents exposure, and lets the organization focus on the right obligations for the right systems.
Note: nothing here is legal advice or a substitute for it, and it is not a binding opinion. Every case requires an individual review with a licensed lawyer.
נושא: בינה מלאכותית וממשל סיכונים
Real estate advisory & opinion · AI advisory & opinion · Advisory · Mediation & dispute resolution · Articles · Q&A · Readiness assessment · Book a call