Which AI systems are high-risk under the EU AI Act?

Article 6 sets out the two routes into the high-risk tier.

Annex I route. The AI system is a safety component of a product already covered by EU harmonisation legislation — medical devices, machinery, lifts, toys and the rest — or is itself such a product.

Annex III route. The system falls into one of eight standalone categories:

1. Biometrics
2. Critical infrastructure
3. Education and vocational training
4. Employment and workers’ management
5. Access to essential private and public services
6. Law enforcement
7. Migration, asylum and border control
8. Administration of justice and democratic processes

Category 4 catches more European SMEs than any other: recruitment and selection, including systems that place targeted job advertisements, filter applications or evaluate candidates. Most applicant-tracking and candidate-scoring products land here.

The carve-out. Article 6(3) lets a system that would otherwise be Annex III escape the tier when it performs a narrow preparatory task and does not materially influence the decision’s outcome. It is narrower than it first appears, and claiming it requires you to document the assessment. Guessing at it is one of the more expensive mistakes available.