In this article (8 sections)
When a system’s use falls under Annex III, the first reaction is often: “Our system only supports people, so surely it is not high-risk?” The AI Act does leave this route open, in Article 6(3). But the exception comes with clear conditions, one limit that cannot be crossed, and a procedure under which “if you claim it, you answer for it”. This article explains how the exception is established, what you need to keep on file, and how the authorities review it.
Key takeaways
- An Annex III AI system that does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making, may be considered not high-risk (Article 6(3)).
- It must meet one of four conditions: a narrow procedural task, improving a previously completed human activity, detecting deviations from decision-making patterns without replacing human assessment, or performing only a preparatory task to an assessment.
- Any system that performs profiling of natural persons is always high-risk, and none of the four conditions can be used.
- A provider claiming the exception must document the assessment before placing the system on the market, register in the EU database, and provide the documentation on request by the authorities; the authorities can reassess under Article 80, and misclassification to circumvent the requirements can be fined.
The four conditions in Article 6(3)
| Condition | Wording of the provision | How to read it |
|---|---|---|
| (a) | Perform a narrow procedural task | For example, turning unstructured data into structured data, classifying incoming documents, detecting duplicates |
| (b) | Improve the result of a previously completed human activity | A person has already made the judgement; the AI only polishes or adds to it |
| (c) | Detect decision-making patterns or deviations from prior decision-making patterns, and is not meant to replace or influence the previously completed human assessment without proper human review | Checks consistency after the fact and takes no part in the decision itself |
| (d) | Perform a preparatory task to an assessment relevant for the purposes of the Annex III use cases | Organising, translating and compiling data for a person to assess |
The four conditions are only the “entry point”. The premise of the whole sentence remains that the system does not pose a significant risk of harm, including by not materially influencing the outcome of decision-making. A system that fits the wording of one condition but in practice shapes the decision still cannot claim the exception.
Profiling: the line that cannot be crossed
The third subparagraph of Article 6(3): an AI system listed in Annex III is always considered high-risk where it performs profiling of natural persons.
Profiling follows the definition in GDPR Article 4(4): automated processing of personal data to evaluate certain aspects of a person, in particular to analyse or predict their performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
This line is especially important for workplace AI. Many dispatch, scheduling, performance analysis and recruitment screening systems are, by their nature, evaluating people’s performance or behaviour. The scenarios in Part 7 and Part 8 must first get past the profiling test before the four exceptions even come into play.
Can your system claim the exception? Start with three questions
- Does the system evaluate or predict the performance, behaviour or reliability of specific individuals?
- Does the system's output materially change the final decision?
- Would the decision be different without the system?
If the answer to any of these is "yes", be very careful about claiming the exception.
Claiming the exception: which three things must you do?
Article 6(4) and Article 49(2):
- Document the assessment before placing on the market: a provider that considers an Annex III system not to be high-risk must document that assessment before placing it on the market or putting it into service.
- Register in the EU database: the provider (or its authorised representative) must register itself and the system in the EU database under Article 71.
- Provide it on request: on request of the national competent authorities, provide the documentation of the assessment.
In other words, the exception does not mean “nothing to do”. It replaces the full set of high-risk obligations with an assessment that must stand up to scrutiny and a public registration.
How do the authorities review it?
Article 80 deals specifically with systems that the provider has classified as not high-risk:
- where a market surveillance authority has sufficient reason to consider that a system is in fact high-risk, it will reassess it against the conditions in Article 6(3) and the Commission guidelines;
- if the assessment finds the system is high-risk, the provider must complete all compliance actions and corrective measures within a deadline, and failure to do so can be fined;
- if the provider is found to have misclassified the system in order to circumvent the requirements of Chapter III, Section 2, the provider can be fined (Article 80(7)).
Under Article 6(5), the Commission has published guidelines on the practical implementation of the high-risk classification together with a list of practical examples, available on the AI Act Service Desk under “High-risk AI Systems Guidelines”. The authorities refer to these guidelines when they assess systems, and providers should also check against them when documenting their assessment.
The three most common problems when claiming the exception
- Using product copy instead of an assessment: the marketing material says the system “only recommends”, but the functional description shows it ranking, scoring and filtering. The intended purpose is also determined by promotional and sales materials (Article 3(12)).
- Assessing only once: when the system is updated, new functions are added or its use expands, the original assessment may no longer hold.
- Reading the provision but not the actual use: how deployers actually use the system affects whether it “materially influences the outcome of decision-making”.
Your assessment must stand up to Article 80 review
Whether the exception can be claimed, how detailed the assessment needs to be, and whether to reassess after an update all depend on the system's functions, data and how it is actually used. The cost of getting it wrong is the full set of high-risk obligations plus fines.
Annex III high-risk: applies from 2 December 2027.
FAQ
Are all Annex III systems high-risk?
In principle, yes (Article 6(2)), but Article 6(3) allows a system not to be considered high-risk where it does not pose a significant risk of harm and meets one of the four conditions. Systems that perform profiling of natural persons cannot use the exception.
If we claim the system is not high-risk, do we still have to register it?
Yes. Article 6(4) and Article 49(2): the provider must document the assessment before placing the system on the market and register itself and the system in the EU database.
Does the Commission give examples to help with the assessment?
Yes. Under Article 6(5), the Commission has published guidelines on the practical implementation of the high-risk classification, with a list of high-risk and non-high-risk use cases, available on the AI Act Service Desk.
Will the conditions for the exception change?
Article 6(6) and (7) empower the Commission to add, modify or delete the four conditions by delegated act, but amendments must not lower the overall level of protection (paragraph 8).
Next in the series
Part 10: What changed in the AI literacy obligation?
Previous: Part 8: Your European subsidiary uses AI to screen CVs. What is the deployer responsible for?
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help companies review the AI Act classification of Annex III systems and any claim to the exception.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 6, 49, 71 and 80, Annex III: EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
- European Commission, AI Act Service Desk: ai-act-service-desk.ec.europa.eu
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · AI Act consolidated text (27 July 2026) · European Commission, AI Act Service Desk: High-risk AI Systems Guidelines. This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI ActArticle 6(3)high-risk exceptionprofilingregistrationArticle 80high-risk classification2024/1689
