EU AI Act Art.6: Classification rules for high-risk AI systems
Article 6 of the EU AI Act binds the operator (see the article). It requires Determine and record, for each AI system, whether it is high-risk. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.6 |
| Binds | Operator (see the article) |
| Group | High-Risk Classification and Requirements |
| Evidence items | 5 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 0 |
| Last updated |
Who does Art.6 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.6 require?
Determine and record, for each AI system, whether it is high-risk. A system is high-risk where it is intended to be used as a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I and that product must undergo third-party conformity assessment, or where it falls within an Annex III use case. Where the provider concludes that an Annex III system is not high-risk because it performs only a narrow procedural task, improves the result of a previously completed human activity, detects decision patterns without replacing or influencing human assessment, or performs a preparatory task, that assessment must be documented before the system is placed on the market or put into service and produced to authorities on request. A system that performs profiling of natural persons is always high-risk and the derogation is not available to it.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.6 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.6?
| Category | Evidence to keep |
|---|---|
| Risk classification | A classification record per AI system naming the Annex I legislation or the Annex III use case considered, and the conclusion reached |
| Risk classification | The documented Art.6(3) assessment where an Annex III system is judged not high-risk, dated before placing on the market |
| Risk classification | Evidence the profiling rule was applied, so any system profiling natural persons is classified high-risk regardless of the derogation |
| Risk classification | A trigger that re-runs classification when Annex III is amended or the intended purpose changes |
| Risk classification | Registration of the not-high-risk conclusion in the EU database as required by Art.49(2) |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.6?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-1.1 | Legal and regulatory requirements involving AI are understood, managed, and documented The recorded high-risk determination per system is documented understanding of which legal regime binds it. | high |
AIRMF-GV-1.3 | Processes and procedures are in place to determine the needed level of risk management activities based on the organization's risk tolerance Classification determines which obligation set applies, which is the same tiering-drives-effort mechanism. | high |
AIRMF-MP-3.3 | Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization The documented classification bounds the application scope by function, capability and intended purpose. | high |
Which ISO/IEC 42001 controls line up with Art.6?
No ISO/IEC 42001 control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.
What does the conformance kit add for Art.6?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.