Compliance with the AI Act Part 2: What is ‘high-risk’ activity?

Updated July 2026 

Could the way your organisation uses an AI system be classed as high-risk under the EU AI ActThe EU Artificial Intelligence Act was approved by the EU Council on 21 March 2024. A world-first comprehensive AI law, intended to harmonise rules for the development, deployment, and use of artificial intelligence systems across the EU.? 

High-risk AI systems are permitted, but they are subject to the AI Act’s strictest requirements because of their potential impact on people’s safety, opportunities, and fundamental rights. 

Whether a system is high-risk depends on what it is designed to do, how it is used, and the decisions or outcomes it may influence. The same AI technology may therefore be low-risk in one context and high-risk in another. The requirements also depend on whether your organisation is acting as a provider, deployer, importer or distributer. 

Following the changes introduced by the Digital Omnibus on AI, high-risk requirements will apply from 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in certain regulated products. 

How does the AI Act classify risk?

The EU AI Act follows a risk-based approach, with stricter requirements applying where AI is used for activities that could significantly affect people’s health, safety or fundamental rights. 

There are four broad categories: 

• Prohibited: AI uses considered to pose unacceptable risk 
• High-risk: AI used for specified activities that could significantly affect people’s safety or rights 
• Limited-risk: AI subject to transparency rules, such as informing people they are interacting with AI or labelling AI-generated content 
• Minimal or no risk: AI not subjected to prohibited, high-risk or transparency rules, although AI literacy requirements and other laws may still apply 
• Low risk
   

General-purpose AI (GPAI) models

GPAI’s are covered by a separate set of requirements. These are designed to perform a wide range of tasks and can be used across different systems and applications. Examples include OpenAI’s GPT-4, Google’s Gemini, Anthropic’s Claude and Meta’s Llama. AI systems built using these models must be assessed according to their intended purpose and use. 

Which AI activities are prohibited under the AI Act?

Eight prohibited AI practices have applied since 2 February 2025. An additional ninth prohibition, introduced through the Digital Omnibus on AI, applies from 2 December 2026. 

The table below details the AI practices that fall under the prohibited category. These are the techniques and approaches considered to pose unacceptable risk to people’s safety, rights or freedoms. 

What is ‘high–risk’ activity? 

The AI Act identifies two main types of high-risk AI systems: 

• AI used in regulated products 
• AI used for specific purposes listed in Annex III 

Not every AI system used within a regulated sector or Annex III area is automatically high-risk. Classification depends on the specific use of the system, the decisions it affects and whether it meets the conditions set out in the AI Act. 

AI used in regulated products

An AI system is high-risk under this route when both of the following conditions apply: 

• The AI is itself a product, or a safety component of a product, covered by legislation listed in Annex I 
• The product must undergo a third-party conformity assessment before it can be placed on the market or put into service 

A safety component is an AI system that performs a safety function, or whose failure or malfunction could put people or property at risk. 

This can include AI incorporated into certain medical devices, lifts, toys and other regulated products. An AI system is not automatically high-risk simply because it forms part of one of these products. Both conditions must be met. 

AI used for activities listed in Annex III

Annex III identifies specific uses of AI across eight areas where systems may significantly affect people’s health, safety or fundamental rights. Not every AI system used in these areas is high-risk. 

If you are unsure how a system should be classified, an AI OfficerAn individual responsible for overseeing the ethical, legal, and effective use of Artificial Intelligence (AI) within an organisation. or other suitably qualified specialist can assess its purpose, use and potential impact against the relevant Annex III criteria.

When might an Annex III system not be high-risk?

Some systems used for Annex III activities may fall outside the high-risk classification if they have limited influence on people or decisions. 

If your organisation provides the system, you must assess and document any decision that an Annex III system is not high-risk before placing it on the market or putting it into service within the EU. If you use, import or distribute the AI system, you should verify its classification and understand the requirements that apply to your role. Other AI Act obligations may still apply. 

What should organisations do now?

The revised deadlines provide more time to prepare, but organisations should start identifying how each AI system is classified and which requirements apply. 

Key steps include: 

• Map your AI use and keep an up-to-date inventory of AI systems and their purpose 
• Confirm your role as provider, deployer, importer or distributer 
• Assess each system against the high-risk criteria in Annex I and III 
• Record your decisions and your reasoning 
• Prepare appropriate controls and put governance, risk management, and human oversight in place 
• Check which assessments are needed, such as AI Impact AssessmentA structured process used to identify, assess, and mitigate potential risks associated with an AI system before and during its deployment. An AIIA evaluates factors such as fairness, transparency, privacy, and accountability, helping organisations demonstrate compliance with AI regulations and responsible innovation practices., DPIA or fundamental rights impact assessment 

Your responsibilities will vary according to your role, so this should be established for every AI system. 

EU AI Act blog series

Explore the other blogs in our Compliance with the AI Act series: 

• Part 1: Timeline and important deadlines 
• Part 3: Who is subject to the AI Act? 
• Part 4: Strategies for achieving compliance 

______________________________________________________________________________________________________________________________

Need support with AI governance?

The DPO Centre’s AI governanceThe framework of policies, processes, and roles that ensure Artificial Intelligence (AI) is developed and used responsibly, ethically, and in compliance with applicable laws, societal expectations, and corporate values.  services can help you understand your obligations, assess AI risks and put appropriate oversight in place. This includes AI Impact Assessments and support from an Outsourced AI Officer. 

______________________________________________________________________________________________________________________________

In case you missed it… 

• Guide to updating Privacy Notices for AI 
• Governing AI Agents 
• AI Impact Assessments: What are they and why do you need one? 

______________________________________________________________________________________________________________________________ 

For more news and insights about data protection and AI governance follow The DPO Centre on LinkedIn