On May 19, 2026, the European Commission published draft guidelines on how to classify AI systems as high-risk under Article 6 of the EU AI Act, and opened a targeted stakeholder consultation that ran until June 23, 2026. High-risk classification is the pivot point of the entire regime: systems that fall into this category face the heaviest obligations, including risk management, data governance, logging, human oversight, and conformity assessment, so the line between high-risk and not is where most compliance cost is decided.
The guidelines address the two routes to high-risk status set out in Article 6. The first covers AI used as a safety component in products already regulated under EU law and requiring third-party conformity assessment, such as machinery, lifts, and toys. The second covers the specific use cases listed in Annex III, including biometrics, critical infrastructure, education, employment, migration and border control, and access to essential services. In line with Article 6(5), the text supplies practical examples of systems that should and should not be treated as high-risk, which is what most providers were waiting for.
The high-risk rules apply on a staggered timeline, with the Annex III areas due to apply from December 2, 2027 and product-embedded systems from August 2, 2028. The draft is non-binding and feedback will be folded into a final version before adoption, but it is the Commission’s authoritative read on the hardest classification question in the Act, and it gives companies a concrete basis to assess whether their systems will be caught.