After months of delays, the European Commission published its long-awaited draft guidelines on the classification of high-risk AI systems on 19 May 2026. The release opens a targeted stakeholder consultation running until 23 June 2026.
For many organisations, this is more than just another regulatory publication. One of the biggest unanswered questions under the AI Act has been whether a particular AI system falls inside or outside the high-risk regime, because the answer determines whether a far more demanding set of AI Act obligations applies. The draft guidelines provide the clearest indication yet of how that assessment is likely to be made in practice.
More importantly, they reveal something broader: compliance under the AI Act will depend not only on what an AI system does, but also on how organisations describe it, market it, document it, and govern its use. In that sense, the classification exercise is becoming as much about evidence and accountability as it is about technology.
While the guidelines are still in draft form, they offer the most detailed roadmap to date for organisations seeking to understand their future obligations under the AI Act.
Here is what you need to know.
New Timelines, More Time to Prepare
The guidelines had originally been expected by 2 February 2026, ahead of the AI Act’s initial compliance milestones for high-risk systems. Their absence had become a genuine source of frustration for businesses and public authorities alike, who were being asked to prepare for obligations without clear guidance on who those obligations would actually apply to.
The publication of the draft guidelines comes alongside the AI Omnibus, which has postponed the application dates for high-risk AI systems. Under the revised timeline, obligations for stand-alone high-risk AI systems will apply from 2 December 2027, while obligations for high-risk AI systems embedded in products will apply from 2 August 2028.
The revised deadlines provide organisations with additional time to prepare, but they should not be mistaken for a pause in compliance planning. High-risk AI obligations may now apply later than originally expected, yet organisations still need to assess their AI systems, determine whether they fall within the high-risk regime, understand their role in the AI value chain, and begin building the governance structures that compliance will require.
With the draft guidelines now published, the picture is beginning to come into focus, though it is not yet the full picture.
What Do the Guidelines Actually Cover?
The guidelines are structured across three documents.
- The first covers general principles: how to read the classification rules, what concepts such as “safety component” and “intended purpose” mean, and how the two routes interact.
- The second addresses Article 6(1) and Annex I in detail: when is an AI system a product or safety component, and when does the relevant EU product safety legislation apply?
- The third covers Article 6(2) and Annex III in detail: which use cases fall within the eight listed areas, and how should borderline situations be assessed?
Together, they offer, for the first time at this level of detail, a practical framework for working through the classification question step by step.
Does This Bring Legal Certainty?
The guidelines are not legally binding. Only the Court of Justice of the European Union can give an authoritative interpretation of the AI Act. As the Commission has expressly indicated, the guidelines are designed to evolve over time and will be updated when necessary, taking into account practical experience and new issues that may arise.
That said, these are the clearest indication yet of how the Commission and enforcement bodies will approach the classification question in practice. For most organisations, understanding how the rules are likely to be applied is most of what they need in order to make sensible compliance decisions.
The guidelines remain open for feedback until 23 June 2026. The Commission has not announced a formal adoption timeline for the final version.
Two Important Points Organisations Should Pay Particular Attention To
While the draft guidelines cover a wide range of issues, two themes are likely to have a significant practical impact on organisations.
Intended purpose matters more than many organisations realise
The Commission places significant emphasis on the intended purpose of an AI system. Importantly, this assessment is not limited to technical documentation. Marketing materials, sales presentations, product descriptions and user instructions all contribute to determining how a system is intended to be used.
For providers of AI systems built to work across multiple contexts or use cases, a contractual disclaimer excluding high-risk applications will not be sufficient if the system’s marketing or documentation tells a different story. Under the draft guidelines, intended purpose is assessed across all materials, not just the fine print.
Human oversight does not automatically remove a system from the high-risk category
Many organisations assume that adding a human review step automatically prevents an AI system from being classified as high-risk. The draft guidelines explicitly reject this assumption.
Human oversight is an important compliance obligation under Article 14, but it does not generally change the classification analysis under Article 6. The reason is straightforward: the classification under Article 6(2) depends solely on the intended purpose of the system. Since human involvement cannot change the purpose for which a system is designed to be used, it has no effect on whether that system falls within one of the Annex III use cases.
What Makes an AI System “High-Risk”?
The guidelines follow the structure of Article 6 of the AI Act, which sets out two routes to a high-risk classification.
Route 1: AI as a product or safety component of a regulated product. If an AI system is itself a product, or a safety component within a product, that falls under EU product safety legislation and requires third-party conformity assessment, it is classified as high-risk. Think medical devices, machinery, lifts, toys, and similar regulated equipment where AI performs a function that could affect the safety of the product.
Route 2: AI used in high-stakes use cases listed in Annex III. A set of eight areas has been identified by the AI Act as presenting significant risk to people’s rights, safety, or access to essential services. These are:
- Biometrics: including remote biometric identification systems
- Critical infrastructure: AI used in the management of water, gas, heating, or electricity networks
- Education and vocational training: systems that determine access, assess students, or monitor learners
- Employment and workforce management: recruitment tools, CV-screening software, performance monitoring, and task allocation
- Access to essential services: credit scoring, insurance risk assessment, and social benefit eligibility
- Law enforcement: tools used to assess the risk of a person becoming a victim or perpetrator of a crime, polygraph systems, and similar applications
- Migration, asylum, and border control: risk assessment, document authentication, and examination of applications
- Administration of justice and democratic processes: AI assisting courts or used in electoral contexts
The draft guidelines provide practical examples of systems that would, and would not, fall into each category. These examples are explicitly non-exhaustive, the list will be updated over time, and the inclusion of a use case in the guidelines does not mean that use case is automatically lawful under other applicable law.
A note on the Article 6(3) exemption
Importantly, falling within an Annex III use case does not automatically mean that an AI system will be classified as high-risk. Article 6(3) provides a limited exemption for systems performing narrowly defined procedural, preparatory, or supportive tasks that do not materially influence decision-making outcomes. However, the Commission makes clear that this exemption should be interpreted narrowly and relied upon with caution, as Article 6(3) represents an exception to rules aimed, among other things, at protecting fundamental rights.
In particular, AI systems that perform profiling within the meaning of EU data protection law cannot benefit from the exemption, even where one of the Article 6(3) conditions might otherwise apply.
For many organisations, Article 6(3) will be a key part of the classification exercise. Any decision to rely on the exemption should be carefully documented and supported by a clear assessment of the system’s role and impact.
What Should You Do If Your Organisation Falls under the High-Risk Classification?
- Assess your AI systems now. Do not wait for the guidelines to be finalised. The draft represents the current interpretive baseline, and starting your assessment now means you will be well-placed when the final version arrives. Work through the Article 6 structure: is your AI system embedded in a regulated product? Does it fall into any of the eight Annex III areas?
- Document your reasoning. Whatever conclusion you reach, record how you got there. If your system is on the borderline, document why you consider it to fall outside (or inside) the high-risk category. Regulators are likely to focus not only on the outcome of the classification exercise but also on the reasoning behind it. This is particularly important where an organisation relies on the Article 6(3) exemption or concludes that a system falls outside Annex III despite operating in a sensitive area.
- Consider submitting feedback. The consultation is open until 23 June 2026. If the draft guidelines create uncertainty for your sector, or if the examples do not reflect how your technology actually works, this is the moment to say so. The Commission is still shaping the final text.
- Prepare for the obligations. If your system is, or is likely to be, classified as high-risk, the obligations under the AI Act are significant. They include: a risk management system (Article 9), data and data governance requirements (Article 10), technical documentation (Article 11), transparency obligations toward deployers (Article 13), human oversight mechanisms (Article 14), accuracy and robustness testing (Article 15), and registration in the EU database (Article 49). The extended deadlines of 2027 and 2028 give you time, but not unlimited time. Start scoping the work now.
A Final Word
The publication of the draft guidelines is good news for organisations that have been waiting for clarity. The Commission has now set out, in concrete terms, how it reads one of the most consequential classification questions under the EU AI Act. That does not resolve every uncertainty, and the guidelines are not yet final. But for the first time, organisations have a detailed, practical document to work with.
The window to shape the final text is open until 23 June 2026. After that, the focus shifts firmly to preparation, bearing in mind that the document will remain open to updates as implementation progresses and new practical questions arise.
Sources
Primary sources — European Commission
- European Commission, Draft Guidelines on the Classification of High-Risk AI Systems under Article 6 of Regulation (EU) 2024/1689, 19 May 2026.
- European Commission, Targeted Consultation on the Draft Guidelines for the Classification of High-Risk AI Systems (open 19 May to 23 June 2026).
- European Commission, Guidelines on the AI System Definition (separate earlier guidelines on the definition of an AI system under the AI Act).
Primary source — legislation
- Regulation (EU) 2024/1689 of the European Parliament and of the Council (EU AI Act), in particular: Article 6 (classification rules), Articles 9 to 15 (obligations for high-risk AI systems), Article 49 (registration), Article 111 (transitional provisions), and Annexes I and III.
Secondary sources
- IAPP, “European Commission Delivers Draft High-Risk AI Guidelines After Delays”, 19 May 2026.