# Extract — AI Act Articles 6, 8, 9: High-risk classification and risk management **Source**: `sources.yaml` id `ai-act-en-eurlex` **Document**: Regulation (EU) 2024/1689 **Accessed**: 2026-04-25 **Licence**: EU legislative text — public domain **Citation**: Regulation (EU) 2024/1689, Articles 6, 8, 9 --- ## Article 6 — Classification rules for high-risk AI systems **1.** Irrespective of whether an AI system is placed on the market or put into service independently of the products referred to in points (a) and (b), that AI system shall be considered to be high-risk where both of the following conditions are fulfilled: - **(a)** the AI system is intended to be used as a **safety component** of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in **Annex I**; - **(b)** the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a **third-party conformity assessment**, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I. **2.** In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in **Annex III** shall be considered to be high-risk. **3.** **By derogation from paragraph 2**, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision-making. The first subparagraph shall apply where any of the following conditions is fulfilled: - (a) the AI system is intended to **perform a narrow procedural task**; - (b) the AI system is intended to **improve the result of a previously completed human activity**; - (c) the AI system is intended to **detect decision-making patterns or deviations** from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; - (d) the AI system is intended to **perform a preparatory task to an assessment** relevant for the purposes of the use cases listed in Annex III. Notwithstanding the first subparagraph, **an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons**. **4.** A provider who considers that an AI system referred to in Annex III is not high-risk shall **document its assessment** before that system is placed on the market or put into service. Such provider shall be subject to the **registration obligation** set out in Article 49(2). Upon request of national competent authorities, the provider shall provide the documentation of the assessment. **5.** The Commission shall, after consulting the European Artificial Intelligence Board, and no later than 2 February 2026, provide guidelines specifying the practical implementation of this Article in line with Article 96 together with a comprehensive list of practical examples of use cases of AI systems that are high-risk and not high-risk. **6, 7, 8.** [Power to amend Annex III by delegated acts; review obligations.] --- ## Article 8 — Compliance with the requirements **1.** High-risk AI systems shall comply with the requirements laid down in this Section, **taking into account their intended purpose** as well as the generally acknowledged state of the art on AI and AI-related technologies. The risk management system referred to in Article 9 shall be taken into account when ensuring compliance with those requirements. **2.** Where a product contains an AI system, to which the requirements of this Regulation as well as requirements of the Union harmonisation legislation listed in Annex I, Section A apply, **providers shall be responsible for ensuring that their product is fully compliant with all applicable requirements** under applicable Union harmonisation law. In ensuring compliance with the requirements set out in this Section, and in order to ensure consistency, avoid duplication and minimise additional burdens, providers shall have a choice of integrating, as appropriate, the necessary testing and reporting processes, information and documentation they provide with regard to their product into documentation and procedures that already exist and are required under the Union harmonisation legislation listed in Annex I, Section A. --- ## Article 9 — Risk management system **1.** A risk management system shall be **established, implemented, documented and maintained** in relation to high-risk AI systems. **2.** The risk management system shall be understood as a **continuous iterative process** planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating. It shall comprise the following steps: - **(a)** the identification and analysis of the **known and the reasonably foreseeable risks** that the high-risk AI system can pose to the health, safety or fundamental rights when the high-risk AI system is used in accordance with its intended purpose; - **(b)** the estimation and evaluation of the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of **reasonably foreseeable misuse**; - **(c)** the evaluation of other risks possibly arising, based on the analysis of data gathered from the **post-market monitoring system** referred to in Article 72; - **(d)** the **adoption of appropriate and targeted risk management measures** designed to address the risks identified pursuant to point (a). **3.** The risks referred to in this Article shall concern only those which may be reasonably mitigated or eliminated through the development or design of the high-risk AI system, or the provision of adequate technical information. **4.** The risk management measures shall give due consideration to the effects and possible interaction resulting from the combined application of the requirements set out in this Section, with a view to minimising risks more effectively while achieving an appropriate balance in implementing the measures. **5.** The risk management measures shall be such that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems, is judged to be **acceptable**. In identifying the most appropriate risk management measures, the following shall be ensured: - **(a)** elimination or reduction of risks identified and evaluated pursuant to paragraph 2 in so far as technically feasible through adequate design and development of the high-risk AI system; - **(b)** where appropriate, implementation of adequate **mitigation and control measures** addressing risks that cannot be eliminated; - **(c)** provision of **information** required pursuant to Article 13 and, where appropriate, **training to deployers**. With a view to eliminating or reducing risks related to the use of the high-risk AI system, due consideration shall be given to the technical knowledge, experience, education, training to be expected by the deployer and the presumable context in which the system is intended to be used. **6.** High-risk AI systems shall be **tested** for the purpose of identifying the most appropriate and targeted risk management measures. Testing shall ensure that high-risk AI systems perform consistently for their intended purpose and they are in compliance with the requirements set out in this Section. **7.** Testing procedures may include testing in real-world conditions in accordance with Article 60. **8.** The testing of high-risk AI systems shall be performed, as appropriate, at any time throughout the development process, and, in any event, **prior to their being placed on the market or put into service**. Testing shall be carried out against prior defined metrics and probabilistic thresholds that are appropriate to the intended purpose of the high-risk AI system. **9.** When implementing the risk management system as provided for in paragraphs 1 to 7, providers shall give consideration to whether in view of its intended purpose the high-risk AI system is likely to have an adverse impact on persons under the age of 18 and, as appropriate, other vulnerable groups. **10.** For providers of high-risk AI systems that are subject to requirements regarding internal risk management processes under other relevant provisions of Union law, the aspects provided in paragraphs 1 to 9 may be part of, or combined with, the risk management procedures established pursuant to that law. --- ## Notes for the skill - Article 6(1) (Annex I products with third-party CA) applies from **2 August 2028** (Art. 113 as amended by Reg. (EU) 2026/1744; originally 2 August 2027). - Article 6(2) (Annex III stand-alone) applies from **2 December 2027** (Art. 113 as amended by Reg. (EU) 2026/1744; originally 2 August 2026). - Note the "safety component" definition in Art. 3(14) was **narrowed** by Reg. (EU) 2026/1744, excluding assistive and performance-optimising AI from Annex I high-risk classification. - Article 6(3) derogation requires **documented assessment** and **registration in the EU database** (Art. 49(2)). It is not self-applying. - The **profiling exception** in Art. 6(3) last subparagraph means: any Annex III system that performs profiling on natural persons is high-risk regardless of the four conditions. - Risk management is **lifecycle, iterative**, and feeds back from post-market monitoring (Art. 72). - For Annex I products, providers may **integrate AI Act requirements with existing sectoral requirements** (Art. 8(2)) — combine, don't duplicate.