EU AI Act Article 6(2)-(4) + Annex III — Classification of AI systems as high-risk
Every AI system must be classified against Article 6(2) and Annex III; a system in an Annex III area is high-risk unless a documented Article 6(3) derogation applies, and profiling of natural persons always makes it high-risk
Where this comes from
Provision: Article 6(2)-(4) + Annex III — Classification of AI systems as high-risk
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 6(2), 6(3) and 6(4) + Annex III, Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Checked against the source: 2 September 2026
Who it applies to
AI system in scope of the Act (Art. 2) — all of these:
- Service deploys AI systems in a professional capacity
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 16(a) ('Providers of high-risk AI systems shall …'), read with Art. 3(3): the actor develops the system or has it developed and places it on the market or puts it into service under its own name or trade mark — or is its authorised representative under Art. 22
- Art. 6(2): the AI system falls within one of the eight Annex III areas (biometrics; critical infrastructure; education; employment; essential private/public services; law enforcement; migration and border control; administration of justice and democratic processes), so the classification duty arises
What engineering work it implies
- FRIA / DPIA Assessment ScaffoldFoundation only
An assessment record carrying the Article 27(1)(a)-(f) headings and the WP248 DPIA sections in one artefact, stored with the project and linked to the evidence that...
Sample acceptance criteria Landfall generates for this obligation:
- Every AI system in use or in development appears in an inventory with an owner
- Each entry records its classification against Art. 6(2) and the Annex III point it falls under, or states none applies
- Where an Art. 6(3) derogation is relied on, the reasoning is documented BEFORE the system is used and names which of (a)-(d) applies
- Any system that performs profiling of natural persons is classified high-risk regardless of the derogation (Art. 6(3), final subparagraph)
- A derogated system is still registered in the EU database before it is placed on the market or put into service (Art. 6(4), Art. 49(2))
Evidence an auditor expects
- Assessment documentDocument reviewReviewed before placing on the market, and on each substantial modification
Annex III classification assessment for each AI system, and the Art. 6(4) derogation documentation where high-risk status is disclaimed
Per-system record mapping the intended purpose to each of the eight Annex III areas with a reasoned in/out conclusion. Where the Art. 6(3) derogation is relied on: the limb relied on ((a) narrow procedural task, (b) improving a completed human activity, (c) detecting decision patterns without replacing human assessment, (d) preparatory task), the evidence for it, and an express finding that the system does NOT perform profiling of natural persons. Art. 6(4): the assessment must be documented BEFORE the system is placed on the market or put into service and produced to national competent authorities on request
- Process recordDocument review
AI system inventory with role and risk tier per system
Register listing every AI system in use, the organisation's role for it (provider / deployer / both / importer / distributor), the intended purpose, and the classification outcome. This is the artefact every other AI Act duty is indexed against
- Process recordDocument reviewRecommended
Art. 49(2) registration reference for a system classified as NOT high-risk under Art. 6(3)
EU database registration reference recorded against the system, evidencing that the Art. 49(2) duty that survives the derogation has been discharged
Questions people ask
- Does EU AI Act Article 6(2)-(4) + Annex III — Classification of AI systems as high… apply to my service?
- It applies when Service deploys AI systems in a professional capacity. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 6(2)-(4) + Annex III — Classification of AI systems as high… is enforceable from 2 August 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Annex III classification assessment for each AI system, and the Art. 6(4) derogation documentation where high-risk status is disclaimed; AI system inventory with role and risk tier per system; Art. 49(2) registration reference for a system classified as NOT high-risk under Art. 6(3).
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.