High-risk AI system
Also called high-risk AI, annex III AI system
A high-risk AI system is an AI system that the EU AI Act classes as posing significant risk to health, safety or fundamental rights. It covers AI in regulated products and AI used in Annex III areas, including credit scoring of individuals and life and health insurance pricing. Such systems face strict obligations before and after launch.
How it works
A bank or insurer first inventories its AI systems and checks each against Annex I and Annex III. Providers of high-risk systems run a risk management system, govern training data, keep technical documentation and logs, design for human oversight and pass a conformity assessment before registering the system. Deployers use systems as instructed, assign trained oversight staff, keep logs and, for credit and insurance uses, carry out a fundamental rights impact assessment.
Financial firms are directly affected because creditworthiness assessment and insurance pricing are listed in Annex III. The digital omnibus, Regulation 2026/1744, moved the start of Annex III duties to 2 December 2027 and Annex I duties to 2 August 2028. Breaches can lead to fines under Article 99 of the Act. Firms are building inventories and model governance now.
The rules
Classifies AI by risk and sets obligations for high-risk systems under Article 6 and Annexes I and III.
Providers and deployers of AI systems in the EUMoves Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028.
Providers and deployers of high-risk AI systemsCommon questions
Is credit scoring a high-risk AI use?
Yes. Annex III of the EU AI Act lists AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high risk. AI used only to detect financial fraud is excluded from this category.
When do high-risk AI rules apply?
After the digital omnibus, Regulation 2026/1744, obligations for Annex III high-risk systems apply from 2 December 2027. Obligations for AI that is a safety component of products covered by Annex I apply from 2 August 2028.
Can an Annex III system avoid the high-risk label?
Under Article 6(3), a provider can show that an Annex III system does not pose a significant risk, for example because it performs a narrow procedural task. The provider documents that assessment. Systems that profile individuals are always high risk.
What is the difference between a provider and a deployer?
A provider develops an AI system or has it developed and places it on the market under its own name. A deployer uses the system in its professional activity. A bank that buys a credit scoring model is usually a deployer, with lighter but still binding duties.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech PostFrom Chatbots to Credit Scoring: Europe Redefines AI RiskRead the article →RegTech PostEU AI Act: A Global Benchmark for Governing Artificial IntelligenceRead the article →
