What is high risk?
The EU AI Act sorts AI uses into four tiers: prohibited, high, limited and minimal. High risk is the tier that carries the substantial duties, and it is defined by what the system is used for, not by how advanced it is. A simple system in a high-risk area is high risk; a sophisticated one in a harmless area is not.
The two routes to high risk (Art. 6)
Safety component of a regulated product
The system is a safety component of a product already covered by EU product-safety law (for example machinery or medical devices), or is itself such a product (Art. 6(1)).
A use listed in Annex III
The system is used in one of the areas the Act lists as high risk in Annex III. This is the route most organizations meet.
The Annex III areas, in plain words
Biometrics; critical infrastructure; education and vocational training; employment, worker management and access to self-employment; access to essential private and public services (including creditworthiness and insurance pricing); law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. A narrow carve-out exists where the system does not pose a significant risk, for example purely preparatory tasks; note that financial-fraud detection is treated as minimal risk, not high.
What follows if you are high risk
A high-risk system draws the substantial duties: risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity. Providers carry out a conformity assessment; certain deployers carry out a fundamental rights impact assessment. AI Sentinel raises exactly these once a system is classified high risk.