High-Risk AI System

Under the Act, a system is high-risk in two main ways. It may be a safety component of a product already covered by EU product-safety law, such as medical devices or machinery. Or it may fall in a listed use area, including recruitment, education and exams, credit scoring, access to essential public services, law enforcement, migration and the administration of justice. Providers must run a risk management process, use good-quality data, keep technical records and logs, give clear instructions, allow human oversight, and reach suitable accuracy and security. They also complete a conformity assessment, apply a CE marking and, for most listed uses, register the system in an EU database. Deployers have duties too, such as using the system as instructed and monitoring it. A product team learns early whether it falls under this label, because the label alone brings the largest set of duties under the Act.

A manufacturer buys a vendor tool that ranks job applicants for its plants in the EU. Recruitment is a listed high-risk use. The vendor supplies technical documentation and a conformity declaration, and the manufacturer, as deployer, assigns trained staff to oversee the rankings, keeps system logs, and checks that the input data matches its own applicant pool.