Can a low-risk AI tool become high-risk?

Yes. The classification depends on how you use the tool, not what the tool is. If you start using a general-purpose AI tool for a high-risk purpose listed in Annex III, it becomes subject to high-risk requirements.

Who decides if my AI system is high-risk?

You do, initially. As the deployer, you need to assess your AI tools against Article 6 and Annex III criteria. If you're uncertain, the EU AI Office and national authorities can provide guidance.

What if my AI vendor says their tool isn't high-risk but I use it for hiring?

Your use case matters more than the vendor's classification. If you deploy an AI system for a high-risk purpose, you have high-risk obligations regardless of what the vendor says about their product.

Quick answer

Article 6 sets out two ways an AI system can be classified as high-risk: either it's a safety component of a product covered by EU safety legislation, or it falls into one of the specific use cases listed in Annex III (like hiring, credit scoring, or law enforcement). Most standard business AI tools are not high-risk.

Updated June 2026 · MmowW AI Compliance

Article 6: How to Tell If Your AI System Is 'High-Risk'

Two Paths to High-Risk Classification

Article 6 is the gateway that determines whether your AI system faces the strictest rules in the EU AI Act. There are two ways an AI system can be labeled high-risk, and understanding them helps you figure out where your business stands.

The first path applies when AI is used as a safety component of a product that already falls under EU safety rules — things like medical devices, cars, elevators, or toys. If AI helps control the brakes in a car, that AI system is high-risk because the product itself is regulated for safety.

The Annex III List

The second path is more relevant to most businesses. Annex III of the EU AI Act lists specific areas where AI use is automatically considered high-risk. These include biometric identification, management of critical infrastructure, education and vocational training decisions, employment and recruitment, access to essential services like credit and insurance, law enforcement, immigration and border control, and administration of justice.

If your business uses AI for any purpose on this list, your AI system is high-risk and you must follow a detailed set of requirements including risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy standards.

When Standard Business Tools Are Not High-Risk

Here's the reassuring news for most small businesses: using ChatGPT to help write marketing copy, using AI to manage your calendar, or using an AI-powered accounting tool to categorize expenses does not make those tools high-risk. The classification depends on what the AI is being used for, not just what the AI is capable of.

However, be careful about edge cases. If you start using that same ChatGPT to screen job applications or assess employee performance, you've moved into high-risk territory — not because the tool changed, but because the use case did.

A Practical Test for Your Business

Ask yourself this question for each AI tool you use: does this AI system make or significantly influence decisions about people's access to employment, education, essential services, or safety? If the answer is yes, it's likely high-risk. If the AI is just helping you work more efficiently without making consequential decisions about people, it's probably not. When uncertain, consult the Annex III list directly or seek guidance.

Check your AI compliance readiness — free.

Take the Readiness Check 3 minutes · 10 questions · no signup required

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.