Update, 28 July 2026: the public consultation closed on 23 July 2026. The Article 6(5) guidelines, due by 2 February 2026, were not on record as published by this date.
If your company uses AI in recruitment, credit, education or another sensitive area, there's one question that decides more about what the AI Act demands from you than any other: is my system high-risk? The answer determines whether your obligations stop at those that don't depend on high risk — the AI literacy measures of Article 4 and, if the system falls within one of its cases, the transparency of Article 50 — or whether you fall under the full regime of Chapter III, with its documentation, its reinforced oversight and, for certain deployers, the fundamental rights impact assessment. It's also one of the questions with the most grey areas in the Regulation. The European Commission is tasked with narrowing those areas: Article 6(5) requires it to provide classification guidelines for high-risk systems, whose draft was open for public consultation until 23 July 2026.
Why guidelines are needed
On paper, classification looks like an exercise in reading: Annex III lists eight high-risk areas by use — among them employment and staff selection, education, biometrics in so far as their use is permitted, critical infrastructure, and access to essential services, such as evaluating the creditworthiness of natural persons other than for detecting financial fraud — and Annex I, through Article 6(1), covers the route for regulated products, with two cumulative conditions: the AI system is a safety component of a product covered by Annex I, or is itself such a product, and that product must undergo a third-party conformity assessment. In practice, the hard questions start straight away:
- Where does the system that informs end, and where does the one that evaluates or pre-selects begin? In staff selection, that boundary decides the whole classification — and it's the system's intended purpose, not its commercial name, that governs.
- When does the filter in Article 6 itself apply, whose paragraph 3 excludes from high-risk classification an Annex III system that does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons and meets one of its four conditions — performing a narrow procedural task, improving the result of a previously completed human activity, detecting decision-making patterns without replacing or influencing the previous human assessment without proper human review, or performing a preparatory task — unless it performs profiling of natural persons, in which case it is always high-risk?
- How are adapted general-purpose systems used for an Annex III purpose classified, or AI modules embedded in larger software?
Each of these questions is answered today through reasoned interpretation. The guidelines are intended to give that interpretation a common reference — the Commission's own — instead of leaving it to the judgement of each advisor, each provider or each national authority: Article 6(5) requires the Commission, after consulting the Board, to provide guidelines specifying the practical implementation of the Article, together with a comprehensive list of practical examples of use cases of AI systems that are high-risk and not high-risk.
The figure shows the eight areas of Annex III and recalls that classification is done system by system, against the specific letter of each point and its exceptions.
What the consultation phase was
The draft was published in May and went through open public consultation: any organisation — including a Spanish SME — could submit comments until 23 July. There was no need to be a lobby group or a law firm; the channel was designed to capture the experience of those who develop and deploy these systems.
Contributions from those operating in an Annex III area, or selling software that brushes against that boundary, have a legitimate reason to be useful: the grey cases known first-hand are exactly the material good guidelines need. Pointing out where a draft is ambiguous for a real case is the most direct way for the final version to resolve it.
Two cautions for reading all this rigorously: a draft is not the final guidelines — the text can change through the consultation —, and guidelines are not the law: they guide interpretation, but the binding classification remains that of the Regulation. They're the official compass, not a new map.
How it fits the calendar
This piece also lands at the logical moment. With the dates deferred by Regulation (EU) 2026/1744, Sections 1, 2 and 3 of Chapter III apply from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 for those under Article 6(1) and Annex I; for Annex I, Section B products, Article 2(2) applies only Article 6(1), Article 60a and Articles 102 to 112, and Articles 57, 58 and 59 only in so far as the high-risk requirements have been integrated in that legislation. That makes the current period the preparation phase with the best effort-to-value ratio: if the classification guidelines are published in good time, there will be room to apply them calmly, classify correctly and build the file without a deadline bearing down.
The sensible sequence for a company in Annex III territory is the usual one, with one new step at the start:
- Follow the publication of the final guidelines — they'll be the reference test for your classification.
- Classify (or reclassify) with them in hand, documenting the reasoning: why this system falls in, why that one relies on the Article 6(3) filter and does not perform profiling, who decided it and when.
- Use the months until 2 December 2027 — or until 2 August 2028 if your system falls under Annex I — for the file, not for waiting: auditable evidence of a good classification is built, not improvised.
High-risk classification is the hinge of all the high-risk preparation work. The Commission fine-tuning the compass is good news; until it arrives, as always, the compass only helps those who are already walking.
This article is for informational purposes only and does not constitute legal advice. It reflects Regulation (EU) 2026/1744, in force since 27 July 2026.