High-Risk Classification

Systems that use biometric data for remote identification or the inference of sensitive personal characteristics are automatically designated as high-risk. This encompasses both real-time and post-hoc processing of physical, physiological, or behavioral signals.

• Remote biometric identification in publicly accessible spaces is prohibited except for narrowly defined law enforcement exceptions
• Biometric categorization systems that infer race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation are high-risk
• Emotion recognition systems in workplace and educational contexts are explicitly classified as high-risk
• The regulation distinguishes between verification (one-to-one matching) and identification (one-to-many matching) for risk tiering

AI systems deployed in the management and operation of critical digital infrastructure receive high-risk designation when failure could endanger life, health, or fundamental rights at population scale.

• Covers road traffic management, water supply, gas distribution, heating, and electricity grids
• Includes AI systems managing critical digital infrastructure such as DNS root servers, top-level domain registries, and internet exchange points
• The key determinant is whether a malfunction or adversarial compromise could cause cascading societal disruption
• Safety components within critical infrastructure are subject to the most stringent conformity assessment procedures under Annex III

AI systems that determine eligibility for essential public and private services are classified as high-risk due to their direct impact on fundamental rights and socioeconomic opportunity.

• Education and vocational training: Systems determining admission, evaluating learning outcomes, or detecting prohibited behavior during examinations
• Employment and worker management: AI used for recruitment, task allocation, performance evaluation, or promotion decisions
• Essential private and public services: Creditworthiness assessment, insurance pricing, and eligibility for welfare benefits
• Law enforcement: Individual risk assessments, polygraph tools, evidence reliability evaluation, and predictive policing
• Migration and border control: Asylum application triage, visa eligibility, and risk assessments for irregular migration
• Administration of justice: AI assisting judicial authorities in researching and interpreting facts and law

AI systems intended to be used to influence the outcome of elections or referenda are classified as high-risk when they manipulate individual voting behavior at scale. This addresses the systemic risk to democratic institutions.

• Includes AI systems that generate and disseminate personalized political content designed to influence voting intentions
• Covers algorithmic amplification of political messaging through recommender systems on large online platforms
• The classification applies regardless of whether the system is deployed by political actors, platforms, or third-party intermediaries
• Does not cover AI systems used for administrative election management or legally authorized political communications that do not manipulate individual behavior

General Purpose AI (GPAI) models are classified as presenting systemic risk when they exceed specific computational or capability thresholds. This triggers additional obligations beyond standard GPAI requirements.

• The primary quantitative threshold is cumulative compute used for training exceeding 10^25 FLOPs
• The European Commission may also designate models based on qualitative capability benchmarks or deployment scale
• Systemic GPAI models must conduct adversarial testing, report serious incidents, and ensure cybersecurity protection
• Providers must perform and document model evaluations including red-teaming for dangerous capabilities such as CBRN proliferation or autonomous replication
• The classification can be triggered retroactively if a deployed model demonstrates emergent dangerous capabilities not apparent during initial evaluation

A structured evaluation conducted before deployment to identify and document the potential societal, ethical, and human rights consequences of an automated decision system. Key components include:

• Stakeholder consultation with affected communities
• Disparate impact analysis across demographic groups
• Documentation of mitigation measures and residual risk This is often a prerequisite for high-risk classification under emerging global regulatory frameworks.

A governance model where a qualified human operator continuously monitors an AI system's actions and retains the authority to intervene or override decisions. Distinct from human-in-the-loop, this does not require approval for every individual output. Essential for high-risk systems where:

• Full manual approval would create unacceptable latency
• The operator must detect automation bias and system drift
• A kill switch mechanism must be immediately accessible

The immutable, chronological recording of every AI-driven decision, including its input features, model version, confidence score, and output. Required under GDPR Article 22 and the EU AI Act for high-risk systems to enable:

• Right to explanation fulfillment for affected individuals
• Forensic auditability during incident investigations
• Continuous compliance monitoring against drift and degradation Logs must be cryptographically signed to ensure non-repudiation.

The quantification of risk that remains after all mitigating controls and safeguards have been applied to a high-risk AI system. This score determines:

• Whether the system is acceptable for deployment
• The intensity of ongoing post-market surveillance
• Required transparency disclosures to end-users A residual risk that remains unacceptably high despite mitigation must prevent deployment, regardless of the system's performance benefits.

A transparency artifact documenting the safety evaluation and operational context of an entire AI system, not just its underlying model. Unlike a model card, a system card captures:

• The specific deployment environment and user interface
• Human oversight mechanisms and their effectiveness
• Results of red-teaming and adversarial robustness benchmarks
• Known failure modes observed during pre-deployment certification