Is My Use Case a High-Risk AI System? Applying the Commission’s Guidelines and Next Steps

This article for Norton Rose Fulbright’s Data Protection Report by authors Rosie Nance & Marcus Evans looks at the European Commission’s newly published guidelines on high-risk AI systems under the EU AI Act. Focusing on Annex III standalone AI systems, the guidance clarifies which AI applications qualify as “high-risk,” explains the limited scope of exemptions under Article 6(3), and provides practical examples to help organizations determine whether their systems fall within the regime.

The authors highlight the significant compliance obligations that attach to high-risk AI systems. Providers must implement product-specific risk management, governance, technical documentation, conformity assessments, and registration requirements throughout the AI system’s lifecycle. The guidance also warns that organizations can inadvertently become providers—and inherit these obligations—through activities such as deploying general-purpose AI tools for high-risk purposes, creating AI agents for recruitment or workforce management, or substantially modifying existing systems.

A key takeaway is the Commission’s confirmation that human oversight does not, by itself, remove an AI system from the high-risk category. The Article 6(3) derogations are intended to be interpreted narrowly and apply only in specific circumstances, such as narrow procedural, preparatory, or support tasks. Even where an exemption applies, providers must document their reasoning and, in many cases, register the system in the EU database.

The article also examines employment-related use cases, which have broad relevance across industries. High-risk examples include AI systems used for candidate ranking, automated job matching, employee performance evaluation, task allocation based on personal characteristics, and compensation decisions. By contrast, tools used for activities such as interview scheduling, CV parsing, bias detection in job descriptions, or refining human-generated evaluations may qualify for the Article 6(3) exemption. The authors advise both providers and deployers to use the guidance now to assess their AI systems, prepare compliance programs, and avoid unintentionally triggering provider-level obligations under the AI Act…

CONTINUE READING…