The EU AI Act introduces a risk-based approach to artificial intelligence, meaning that organizations must determine whether their AI systems fall into the “high-risk” category. This classification isn’t just a label — it comes with significant regulatory obligations. In this blog, we break down what qualifies as a high-risk AI system and what that means for your business. But first: does your system even fall under the scope of the AI Act?

Does Your AI System Fall Under the AI Act?

According to Article 3(1) of the AI Act, an AI system is:

“A machine-based system designed to operate with varying levels of autonomy and that may adapt after deployment. It infers how to generate outputs — such as predictions, content, recommendations, or decisions — that can influence physical or virtual environments, based on the input it receives.”

In other words: if your system uses machine learning or other advanced techniques to generate outputs that can impact people or environments, it likely qualifies as an AI system under the Act. The definition is carefully crafted to align with international standards while distinguishing AI from traditional software. Key elements include autonomy, adaptability, data-driven outputs — and their real-world consequences.

 

Understanding Risk Under the AI Act

The AI Act doesn’t simply classify systems as low, medium, or high risk. Instead, it targets specific types of risk linked to different kinds of AI applications. These include:

• Unacceptable Risk: AI systems that are banned entirely (e.g. social scoring by governments).
• High Risk: Systems subject to strict obligations.
• Transparency Risks: Relevant to many AI systems, especially those interacting with users.
• General Purpose AI (GPAI): Systems trained on broad datasets, carrying their own set of challenges.

High-risk AI systems are detailed in Article 5, Annex I, and Annex III of the Act. These include systems used in safety-critical products (e.g. medical devices, elevators, aviation software) and systems that affect education, employment, and access to essential services. Some use cases are excluded, so classification isn’t always straightforward — which is why expert guidance is essential.

 

Why It Matters

If your AI system is classified as high-risk, you’re required to meet a series of obligations related to data governance, transparency, human oversight, cybersecurity, and more. This applies both to developers and deployers of AI technology. Getting the classification wrong can lead to misdirected compliance efforts — or worse, regulatory penalties.

 

What Should You Do Now?

If you’re using or developing AI systems within the EU — or offering them to the EU market — now is the time to act. Proper classification is the first step toward responsible and compliant AI deployment.

 

Need clarity on how the AI Act affects your organization?

We’re here to help. Reach out for a consultation or to discuss how we can support you in navigating the new AI regulatory landscape with confidence.