Safety component of a regulated product

It is a product, or a safety component of a product, covered by existing EU safety legislation listed in Annex II. This includes a wide range of goods where safety is critical, such as toys, medical devices, elevators, and machinery. If an AI system is a safety component for one of these products, it is automatically considered a high-risk AI system.

High-stakes use case

It falls into one of the specific high-stakes use cases listed in Annex III. This annex is the core of the high-risk definition. It identifies areas where AI could seriously harm people’s fundamental rights, safety, or well-being.

Biometric Identification and Categorisation

This category covers AI systems for biometric purposes. It is vital to separate ‘identification’ (matching one person to many) from ‘verification’ (matching one to one). The main concern is using ‘remote’ biometric identification systems in public spaces. While real-time remote biometric ID is mostly banned, law enforcement can use it after the fact under strict conditions, making it a high-risk application. This category also includes systems that group people based on sensitive data like race, political views, or sexual orientation.

Management and Operation of Critical Infrastructure

AI systems used as safety components to manage critical infrastructure are deemed high-risk. A failure in these systems could endanger the lives and health of many people. Examples include AI used to manage road traffic, water supplies, heating, and the electricity grid. The goal is to keep essential services safe and reliable as they become more automated.

Education and Vocational Training

This category targets AI that determines a person’s access to education and their professional future. High-risk systems in this area include those used for:

• Admissions or access to educational institutions.
• Evaluating learning outcomes, such as automated exam scoring.
• Guiding students toward certain educational paths.
• Monitoring students during tests to find cheating.

The regulation aims to stop bias and ensure fairness in these major life decisions.

Employment, Workers Management, and Access to Self-Employment

Like education, AI in the workplace has great power over people’s jobs. The Act classifies the following as ai act high-risk applications:

• AI used for recruitment, like filtering CVs or assessing candidates in interviews.
• Systems that make decisions about promotions or ending contracts.
• AI used for assigning tasks and monitoring worker performance.

These rules fight discriminatory hiring and ensure transparency in managing the workplace.

Access to Essential Private and Public Services and Benefits

This broad category covers AI systems that control access to basic services. Key examples of these high-risk AI systems include:

• AI systems used by public authorities to decide eligibility for social security benefits.
• Systems that perform credit scoring, which determines access to loans and finance.
• AI used for risk assessment and pricing in health and life insurance.
• Systems that dispatch emergency services like ambulances or firefighters.

Because these services are so critical, the Act places strict controls to prevent errors and discrimination.

Law Enforcement

The use of AI by law enforcement agencies creates clear risks to fundamental rights. High-risk applications in this area include:

• AI used to assess the risk of a person committing a crime (predictive policing).
• Polygraphs and similar tools meant to detect a person’s emotional state.
• Systems for detecting deepfakes.
• AI used to evaluate the reliability of evidence in criminal cases.

These requirements ensure that authorities use AI tools responsibly and avoid unjust outcomes.

Migration, Asylum, and Border Control Management

AI systems used in the sensitive area of migration and border control are also classified as high-risk. This includes technology used for:

• Assessing security or health risks from people entering the EU.
• Checking if travel documents are authentic.
• Helping authorities review asylum and visa applications.

The goal is to protect the fundamental rights of vulnerable people who interact with these powerful systems.

Administration of Justice and Democratic Processes

The final category addresses AI’s potential effect on the rule of law and democracy. High-risk systems include:

• AI intended to help a judicial authority research and interpret facts and the law.
• Systems used to influence the outcome of an election or referendum.

These rules protect judicial independence and the integrity of our democratic systems.

Risk Management System

Providers must create, use, and maintain a continuous process to identify, analyze, and reduce risks from the AI system.

Data Governance and Management

The datasets used to train, validate, and test the AI must be high quality. They must be relevant, representative, error-free, and complete, with strong processes to manage potential biases.

Technical Documentation

Providers must create and update extensive technical documentation. It must explain the system’s capabilities, limits, and design to show it complies with the Act.

Record-Keeping

The system must be able to automatically log events (like the data used for a decision) to ensure its operations can be traced.

Transparency and Information to Users

The system must be designed for sufficient transparency. Providers must give users clear and full instructions to help them interpret the system’s output correctly.

Human Oversight

People must be able to effectively oversee high-risk systems. This includes measures that let a person intervene, stop, or override the system’s decisions.

Accuracy, Robustness, and Cybersecurity

Systems must perform with high accuracy. They must be resilient against errors, failures, and attacks from third parties trying to alter their performance.

Conformity Assessment

Before entering the market, the system must pass a conformity assessment to prove it meets all requirements. For some systems, a third-party Notified Body must be involved.