EU AI Act - Annex III High-Risk System Requirements (2 Dec 2027)

Obligations for high-risk AI systems listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). Originally 2 August 2026; deferred to 2 December 2027 by the Digital Omnibus on AI (Regulation (EU) 2026/1744). Systems already on the market are caught only if substantially modified after that date.

JurisdictionEuropean Union
CategoryAI Regulations
StatusUpcoming
Effective date
Latest development

Analysis

The EU AI Act’s high-risk AI requirements introduce detailed obligations around risk management, data governance, transparency, human oversight, and quality management, with core high‑risk provisions starting to apply after the transition periods (2 years for most Annex III high‑risk systems, 3 years for embedded systems), i.e. from August 2026 onward for many high‑risk use cases in critical sectors.JRC Harmonised StandardsHigh-level Summary – artificialintelligenceact.eu

Key Requirements (High-Risk AI Systems)

According to the EU AI Act, high‑risk AI systems (including many in critical infrastructure, employment, healthcare, and justice) must comply with a set of core requirements in Section 2 (Articles 8–15) and corresponding provider obligations in Article 16.High-level Summary – artificialintelligenceact.euArticle 16 – artificialintelligenceact.euJRC Harmonised Standards

Classification and Scope of High-Risk AI

  • High-risk classification based on Annex III and sectoral impact
  • High‑risk AI systems are defined by their impact on health, safety, or fundamental rights and by specific use cases listed in Annex III (e.g. critical infrastructure management, employment-related decision tools, access to essential services, law enforcement, migration, asylum, border control, administration of justice).High-level Summary – artificialintelligenceact.euJRC Harmonised Standards
  • Article 6 sets classification rules and clarifies that Annex III systems are high‑risk unless they do not pose a significant risk to health, safety or fundamental rights, with specific conditions and documentation requirements for providers claiming non‑high‑risk status.Article 6 – artificialintelligenceact.eu
  • Profiling of natural persons within Annex III contexts is explicitly always classified as high‑risk.Article 6 – artificialintelligenceact.eu

Risk Management System (Article 9)

Data Governance and Data Quality (Article 10)

Technical Documentation and Record-Keeping (Articles 11, 12, 19)

Transparency and Instructions for Use (Article 13)

Human Oversight (Article 14)

Accuracy, Robustness, and Cybersecurity (Article 15)

Quality Management System (Article 17)

Conformity Assessment, CE Marking, and Registration (Articles 43, 47–49)

Compliance Challenges

Organizations implementing high‑risk AI under the EU AI Act face a range of practical challenges, documented in research whitepapers, Commission studies, and industry analyses.Fraunhofer IKS WhitepaperJRC Harmonised Standards

Complex Risk Management and Documentation

  • Challenge: Building end‑to‑end risk management
  • Many organizations lack mature processes for identifying and managing AI‑specific risks across the full lifecycle, especially in dynamic environments like critical infrastructure or healthcare triage systems.Fraunhofer IKS Whitepaper
  • Comprehensive technical documentation and logs can be burdensome for complex models, particularly where models are frequently updated or fine‑tuned.JRC Harmonised Standards
  • Example – Critical Infrastructure
  • Commission analysis on harmonised standards notes that high‑risk AI in critical infrastructure must combine functional safety standards with AI‑specific risk management, creating integration challenges for operators of industrial control systems.JRC Harmonised Standards

Data Governance and Bias Mitigation

  • Challenge: Ensuring representative and high‑quality datasets
  • For employment and justice use cases, organizations often struggle to obtain representative datasets that avoid historical bias while meeting the strict quality requirements of Article 10.High-level Summary – artificialintelligenceact.euFraunhofer IKS Whitepaper
  • Addressing discrimination risks in recruitment tools or risk assessment systems may require extensive re‑engineering of data pipelines and governance processes.Fraunhofer IKS Whitepaper
  • Example – Employment Screening
  • Industry reports on AI in HR highlight difficulties in validating models and datasets for fairness and non‑discrimination, especially for automated CV screening and candidate scoring tools that would fall under high‑risk employment AI.High-level Summary – artificialintelligenceact.eu

Human Oversight and Operational Integration

  • Challenge: Designing effective oversight processes
  • Implementing meaningful human oversight is complex in high‑volume decision environments, such as hospital triage support or large‑scale online job platforms, where humans must remain able to understand and override system outputs.Fraunhofer IKS Whitepaper
  • Ensuring that oversight personnel are properly trained and that workflows avoid “rubber‑stamping” AI decisions is a known concern in industry analyses.Fraunhofer IKS Whitepaper

Conformity Assessment and Standards Gap

  • Challenge: Interpreting requirements without complete harmonised standards
  • The JRC report notes that harmonised standards for the AI Act are still being developed, creating uncertainty for providers on how to demonstrate compliance for risk management, data governance and robustness.JRC Harmonised Standards
  • This complicates conformity assessment planning, especially for complex systems in healthcare diagnostics or industrial automation that must align with both sectoral and AI‑specific standards.JRC Harmonised Standards

Implementation Best Practices

Best practices draw on the EU AI Act requirements, Commission guidelines drafts, and expert frameworks from research organizations.Guidelines for AI High-Risk Systems – European CommissionFraunhofer IKS WhitepaperJRC Harmonised Standards

Establish an AI-Specific Governance and QMS

  • Action: Create an AI governance framework aligned with Article 17
  • Implement a quality management system specifically covering AI, integrating roles, responsibilities, procedures, and technical measures for compliance with Articles 9–15.Article 16 – artificialintelligenceact.euJRC Harmonised Standards
  • Align with emerging harmonised standards that the JRC and European standardization bodies are developing for risk management, data, transparency and robustness.JRC Harmonised Standards

Implement Structured Risk Management and Testing

  • Action: Operationalize Article 9 risk management
  • Define risk identification frameworks, including hazard analyses and impact assessments for health, safety, and fundamental rights in each high‑risk use case (e.g. critical infrastructure outage risks, employment discrimination risks).Fraunhofer IKS Whitepaper
  • Set up testing strategies, including real‑world pilot testing under controlled conditions to evaluate residual risks and verify compliance before market placement.Fraunhofer IKS Whitepaper

Strengthen Data Governance and Bias Controls

  • Action: Comprehensive data governance program
  • Create data management policies covering data sources, collection, labeling, preprocessing, and retention that meet Article 10’s quality requirements.High-level Summary – artificialintelligenceact.eu
  • Use bias assessment and mitigation techniques, including fairness metrics, re‑sampling, and re‑weighting, aligned with guidance from the Commission and J

Recent developments

  • — The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force, deferring Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I obligations to 2 August 2028. (source)
  • — The European Commission says that, following the political agreement on the AI Omnibus, high-risk AI systems used in areas such as biometrics, critical infrastructure, education, employment, migration, asylum, and border control would apply from 2 December 2027. It also says AI embedded in regulated products would apply from 2 August 2028, indicating a major delay versus the earlier 2026/2027 timeline.[8] (source)
  • — The Commission’s AI Act policy page now reflects the updated timeline for high-risk systems, stating that rules for certain high-risk areas apply from 2 December 2027 and product-embedded systems from 2 August 2028. This is the clearest official policy update in the results about the “Phase 3” high-risk requirements.[3] (source)
  • — This industry FAQ reports that a political agreement reached on 7 May 2026 would move the Annex III high-risk deadline from 2 August 2026 to 2 December 2027, but notes that the change was not yet law. It reflects active industry attention to the compliance reprieve and uncertainty around final adoption.[9] (source)
  • — WeeSec summarizes the EU AI Act as having a staggered rollout and highlights the August 2, 2026 date as the key milestone for high-risk systems, while also mentioning later full-application timing. The article shows that some compliance guidance still centered on the original 2026 deadline even as the policy debate shifted.[6] (source)
  • — The Cloud Security Alliance warns that enterprises should still treat 2 August 2026 as the operative deadline because the proposed delay had not been enacted into law. It also says the gap between policy proposals and legal effect is creating readiness risk for affected organizations.[5] (source)
  • — Dataiku’s guidance still presents 2 August 2026 as the date when core high-risk requirements such as risk management, data governance, and conformity assessment apply. This suggests vendors and compliance teams were actively preparing for the original implementation schedule.[4] (source)
  • — The AI Act summary page describes the core obligations for high-risk AI providers, including risk management, data governance, technical documentation, record-keeping, accuracy, robustness, cybersecurity, and quality management. These are the main requirements likely to dominate implementation planning for the high-risk regime.[1] (source)
  • — The Commission states that high-risk AI systems face strict obligations before market placement, including risk assessment and mitigation, high-quality datasets, logging, documentation, human oversight, and robustness and cybersecurity measures. This continues to frame the compliance burden even as the deadline debate changes.[3] (source)
  • — Article 6 of the AI Act defines when an AI system is classified as high-risk, including when it is a safety component of a product covered by EU harmonisation law and that product requires third-party conformity assessment. This classification rule is central to deciding which systems are affected by the Phase 3 requirements.[2] (source)
  • — The Commission notes that the transparency rules for AI Act are due in August 2026 and that GPAI obligations have already taken effect. The staggered rollout means high-risk system compliance is now being discussed alongside broader AI Act obligations, which is shaping industry implementation priorities.[3] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates