High-risk AI system
An AI system placed in the EU AI Act's high-risk tier, triggering risk management, data governance, logging and human-oversight obligations.
Updated
High-risk classification depends on the use case and context, not on how advanced the model is. Common triggers include employment decisions, access to essential services, credit and insurance, education, and use as a safety component of a regulated product.
Obligations differ by role: providers carry the heaviest set, deployers carry oversight, monitoring and information duties. Establishing role and tier per system is the prerequisite for any compliance work. The Act's original text set 2 August 2026 for these obligations to apply, but the Commission's Digital Omnibus on AI proposes deferring that to December 2027 — as of mid-2026 not yet formally adopted, so the exact effective date should be confirmed before relying on it.
Related
EU AI Act readiness
A practical sequence for AI Act readiness: inventory, classification, obligations mapping, documentation and human oversight evidence — plus the current state of the Digital Omnibus timeline changes.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Compliance readiness
Gap assessment and remediation planning for DORA, NIS2, ISO 27001, GDPR and the EU AI Act — mapped to controls and evidence, not paperwork.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
DORA, NIS2 and the AI Act
A control-level comparison of DORA, NIS2, the EU AI Act, ISO/IEC 42001 and ISO 27001 — what you can evidence once and reuse across all of them.
Disclosure as a control
Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.