AI Act Article 6: Classification rules for high-risk AI systems

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 6 is the question behind the Article 22 appointment: is your system high-risk. There are two routes in. Either it is a safety component of, or is itself, a product covered by the Annex I legislation that needs third-party conformity assessment, or it is listed in Annex III. Annex III carries a derogation with four conditions, and one thing overrides all of them.

Who it binds

• Providers of AI systems, who have to classify their own system before placing it on the market. Article 6(4) requires a provider claiming an Annex III system is not high-risk to document that assessment BEFORE the system is placed on the market or put into service.
• It reaches a system whether or not it is placed on the market independently of the product it sits in (Article 6(1)), so an AI component inside somebody else's regulated product is assessed on its own terms.
• It does not classify by sector or by company size. Both routes turn on what the system does and what legislation covers the product.

What it makes somebody do

• You, the provider. Classify against Article 6(1): is the system a safety component of, or itself, a product covered by Annex I Union harmonisation legislation, AND does that product require third-party conformity assessment. Both conditions have to be met.
• You, the provider. Classify against Article 6(2): is the system listed in Annex III. If it is, it is high-risk unless the Article 6(3) derogation applies.
• You, the provider. If you rely on the Article 6(3) derogation, document the assessment before the system is placed on the market or put into service (Article 6(4)).
• You, the provider. Register under Article 49(2) where you have claimed the derogation (Article 6(4)). Claiming a system is not high-risk therefore creates a registration obligation rather than removing every obligation.
• You, the provider. Provide the documentation of that assessment to national competent authorities on request (Article 6(4)).

What it does not say

• The Article 6(3) derogation is not a general low-risk exemption. It applies only where the system does not pose a significant risk of harm AND one of the four listed conditions holds: a narrow procedural task, improving a previously completed human activity, detecting decision-making patterns without replacing human assessment, or a preparatory task.
• Profiling ends the argument. Article 6(3) says notwithstanding the derogation, an Annex III system that performs profiling of natural persons is ALWAYS high-risk. No condition rescues it.
• Claiming the derogation is not free. Article 6(4) turns it into a documentation duty and an Article 49(2) registration duty, so the choice is between two sets of obligations rather than between obligations and none.
• Article 6 is not static. Article 6(6) and 6(7) let the Commission add to, modify or delete the derogation conditions by delegated act, so a classification made today is a classification under today's text.
• It does not tell you what to DO about a high-risk system. The requirements are in Section 2 and the provider obligations in Article 16; Article 6 only decides whether they apply.

How it sits beside the other mandates

• Article 6 is what makes Article 22 engage. A third-country provider only needs an authorised representative under Article 22 if the system is high-risk, so this article is upstream of the appointment.
• Article 49 is where the registration duties sit, both for high-risk systems under Article 49(1) and for a derogation claim under Article 49(2), and Article 22(3)(e) puts part of that on the representative.
• A company whose system is high-risk under Article 6 and which is established outside the EU commonly needs a GDPR Article 27 representative as well, because the systems in Annex III overwhelmingly process personal data.