High-risk AI system (EU AI Act)

Under the EU AI Act (Article 6), a high-risk AI system is one covered by Annex I product law or used in an Annex III area such as credit scoring.

Part of the Learn hub and the customer data glossary.

What it means in practice

Article 6(1) makes an AI system high-risk if it is a safety component of a product, or is itself a product, covered by the Union harmonisation legislation in Annex I, and that product must undergo third-party conformity assessment. Article 6(2) makes the systems listed in Annex III high-risk. Those closest to customer data include recruitment and candidate evaluation (point 4(a)), eligibility for essential public assistance benefits (5(a)), creditworthiness and credit scoring, except fraud detection (5(b)), and risk assessment and pricing for life and health insurance (5(c)) 1 2.

Article 6(3) lets an Annex III system escape the high-risk label if it poses no significant risk of harm and does not materially influence the outcome of decision making, for example because it performs a narrow procedural task. That exception never applies where the system profiles natural persons: those systems are always high-risk 1.

High-risk systems must meet requirements including risk management, logging (Article 12), transparency to deployers (Article 13) and human oversight (Article 14), and affected people can seek explanations (Article 86). On timing, the Digital Omnibus on AI, Regulation (EU) 2026/1744, set application for Annex III systems at 2 December 2027 and for Annex I systems at 2 August 2028 3.

Marketing segmentation and personalisation are not high-risk in themselves, but the same customer data can feed systems that are.

Example (insurer): a model using customer-data features to price life cover is high-risk under Annex III point 5(c). The insurer's newsletter personalisation is not.

Related terms

• Explainability: explanation rights attach to these systems.
• Model lineage: feeds the technical documentation.
• Audit ledger: satisfies logging expectations.
• AI agent: an agent can be a high-risk system by use.
• Next best action: high-risk only in listed uses.

Where it matters

• EU AI Act for marketing and customer decisioning: high-risk, transparency and deadlines.
• AI governance for marketing teams: a policy template.

Back to the customer data glossary or the Learn hub.