---
title: "European Economic Area — High-Risk Systems | Global AI Monitor"
canonical: https://artificial-intelligence.gi/jurisdictions/european-economic-area/high-risk-systems/
source_html: /jurisdictions/european-economic-area/high-risk-systems/index.html
description: "European Economic Area — High-Risk Systems: 03 High-Risk Systems Active Under review ▾ # Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose A"
generated_at: 2026-10-25T22:24:54Z
content_sha256: 96394c43ac59815ce985bebbdb7e52902bc38d3cb0506e2526faba2610d21bb9
generator: "fe-fleet/md-twin@1.0"
---
# European Economic Area — High-Risk Systems | Global AI Monitor

### 03High-Risk SystemsActive Derived: Probable▾#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

4 instruments · 7 obligations · 9 claims · Next: 2 Dec 2026 (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

4 instruments (4 current) · 7 obligations · 9 claims · 13 milestones

Instruments

- Artificial Intelligence Act Valid from 2024-08-01Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified 8 Oct 2026 · [Official text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- Digital Omnibus on AI Valid from 2026-07-27Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.Binding · Authority: European AI Office (European Commission) · Verified 8 Oct 2026 · [Official text](https://publications.europa.eu/resource/cellar/b459c07f-86fb-11f1-bf5e-01aa75ed71a1.0006.01/DOC_1)
- Draft Commission guidelines on classification of high-risk AI systems Draft, no legal forceDraft guidelines on Article 6 classification with examples for Annex I and Annex III.Verified 8 Oct 2026 · [Official text](https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems)
- German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified 8 Oct 2026 · [Official text](https://www.recht.bund.de/bgbl/1/2026/223/regelungstext.pdf?__blob=publicationFile)

Obligations

- Article 16Providers of high-risk AI systems must ensure Section 2 compliance, run a quality management system, keep documentation and logs and complete conformity assessment before placing the system on the market.conformity assessment · Applies to: provider · Artificial Intelligence Act
- Article 26(1)-(2)Deployers of high-risk AI systems must use them per instructions for use and assign human oversight to competent, trained and authorised natural persons.human oversight · Applies to: deployer · Artificial Intelligence Act
- Article 73(1)-(2)Providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member State where it occurred, immediately and in any event within 15 days of awareness.incident reporting · Applies to: provider · Artificial Intelligence Act
- Article 4a(1)Providers of high-risk AI systems may exceptionally process special categories of personal data where strictly necessary for bias detection and correction, with appropriate safeguards.data governance · Applies to: provider · Artificial Intelligence Act
- Article 27(1)Public-law bodies, private entities providing public services and deployers of certain Annex III point 5 systems must assess the impact on fundamental rights before deploying a high-risk AI system referred to in Article 6(2).fundamental rights impact assessment · Applies to: deployer · Artificial Intelligence Act
- § 18When a provider or German authorised representative ceases business, the person responsible for liquidation or dissolution of the legal entity must discharge the Article 18(1) document-retention duty.record keeping · Applies to: provider · German AI market surveillance and innovation promotion act (KI-MIG)
- Article 12, inserting Article 437-bis of the Criminal CodeOmitting the technical safety measures or human oversight measures required for high-risk AI systems is a crime punished with one to five years' imprisonment where danger to life or public or individual safety results.prohibition · Applies to: provider · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)

Milestones

- 1 Aug 2024Entry into force of the AI Act MetArtificial Intelligence Act
- 2 Feb 2025Chapters I and II (definitions, prohibitions) apply MetArtificial Intelligence Act
- 2 Aug 2025Governance, GPAI obligations and penalties apply; Member States designate authorities MetArtificial Intelligence Act
- 27 Jul 2026Omnibus enters into force MetDigital Omnibus on AI
- 29 Jul 2026German KI-MIG enters into force MetGerman AI market surveillance and innovation promotion act (KI-MIG)
- 2 Aug 2026General application; Article 50 transparency rules and enforcement start MetArtificial Intelligence Act
- 2 Dec 2026Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply UpcomingDigital Omnibus on AI
- 2 Dec 2026Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 UpcomingDigital Omnibus on AI
- 2 Aug 2027Providers of GPAI models placed on the market before 2 August 2025 must comply UpcomingArtificial Intelligence Act
- 2 Aug 2027National AI regulatory sandbox operational in each Member State MovedDigital Omnibus on AI
- 2 Dec 2027Chapter III Sections 1-3 apply to Annex III high-risk systems MovedDigital Omnibus on AI
- 2 Aug 2028Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems MovedDigital Omnibus on AI
- 2 Aug 2028Delegated acts adding AI health and safety requirements to the Machinery Regulation apply UpcomingDigital Omnibus on AI

Claims and evidence (9)
- Derived: Probable Breach of provider, deployer, importer, distributor, transparency or GPAI obligations is subject to fines of up to EUR 15 million or 3% of turnover, whichever is higher.Confidence: Confirmed · As of 2 Aug 2025 · evidencedEvidence and sources[Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) T1 · retrieved · retrieved 8 Oct 2026 · Article 99(4)Non-compliance with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to EUR 15 000 000

- High-risk AI providers must meet Article 16 duties and report serious incidents under Article 73, and deployers must meet Article 26 duties, from 2 December 2027 for Annex III systems.Confidence: Probable · As of 2 Dec 2027 · evidencedEvidence and sources[Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) T1 · retrieved · retrieved 8 Oct 2026 · Article 16(a)Providers of high-risk AI systems shall: (a) ensure that their high-risk AI systems are compliant with the requirements set out in Section 2
- [Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) T1 · retrieved · retrieved 8 Oct 2026 · Article 26(1)Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use
- [Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) T1 · retrieved · retrieved 8 Oct 2026 · Article 73(1)Providers of high-risk AI systems placed on the Union market shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred.
- [Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) T1 · retrieved · retrieved 8 Oct 2026 · Article 73(2)not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident.
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text](https://publications.europa.eu/resource/cellar/b459c07f-86fb-11f1-bf5e-01aa75ed71a1.0006.01/DOC_1) T1 · retrieved · retrieved 8 Oct 2026 · Recital on application dates for high-risk systems2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.

- The Omnibus deletes point 1 of Annex I Section A of the AI Act and lists the Machinery Regulation (EU) 2023/1230 as point 21 of Section B.Confidence: Confirmed · As of 27 Jul 2026 · evidencedEvidence and sources[Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text](https://publications.europa.eu/resource/cellar/b459c07f-86fb-11f1-bf5e-01aa75ed71a1.0006.01/DOC_1) T1 · retrieved · retrieved 8 Oct 2026 · Article 1(41) (Annex I amendments)Annex I is amended as follows: (a) in Section A, point 1 is deleted; (b) in Section B, the following point is added: '21. Regulation (EU) 2023/1230

- New Article 4a lets providers of high-risk AI systems exceptionally process special-category personal data where strictly necessary for bias detection and correction, with safeguards.Confidence: Confirmed · As of 27 Jul 2026 · evidencedEvidence and sources[AI Act Service Desk: Article 4a (consolidated text as amended)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4a) T1 · retrieved · retrieved 8 Oct 2026 · Article 4a(1)To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards

- Article 27 requires public-law bodies, public-service deployers, and certain Annex III point 5 deployers to assess fundamental-rights impact before deploying a high-risk AI system under Article 6(2).Confidence: Confirmed · As of 27 Jul 2026 · evidencedEvidence and sources[AI Act Service Desk: Article 27](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27) T1 · retrieved · retrieved 8 Oct 2026 · Article 27(1)Prior to deploying a high-risk AI system referred to in Article 6(2)... deployers that are bodies governed by public law, or are private entities providing public services... shall perform an assessment of the impact on fundamental rights that the use of such system may produce.

- The Omnibus moves application of Chapter III Sections 1 to 3 to 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I systems.Confidence: Confirmed · As of 2 Dec 2027 · evidencedEvidence and sources[Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text](https://publications.europa.eu/resource/cellar/b459c07f-86fb-11f1-bf5e-01aa75ed71a1.0006.01/DOC_1) T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(b), amending Article 113(b) point (c) is replaced by the following: '(c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III;
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text](https://publications.europa.eu/resource/cellar/b459c07f-86fb-11f1-bf5e-01aa75ed71a1.0006.01/DOC_1) T1 · retrieved · retrieved 8 Oct 2026 · Recital on application dates for high-risk systems2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.
- [AI Act - Shaping Europe's digital future](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) T1 · retrieved · retrieved 8 Oct 2026 · Omnibus timelinesystems used in certain high-risk areas — including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027**.

- The Commission published draft guidelines on high-risk classification on 19 May 2026 and invited views by 23 June 2026.Confidence: Confirmed · As of 19 May 2026 · evidencedEvidence and sources[Draft Commission guidelines on the classification of high-risk AI systems](https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems) T1 · retrieved · retrieved 8 Oct 2026 · LeadThese Guidelines aim to support providers and deployers of AI systems, as well as competent market surveillance authorities, in assessing whether an AI system should be classified as high-risk, thereby facilitating the uniform application and effective enforcement of Article 6 AI Act.
- [Commission seeks feedback on the draft guidelines for the classification of high-risk AI systems](https://digital-strategy.ec.europa.eu/en/news/commission-seeks-feedback-draft-guidelines-classification-high-risk-artificial-intelligence-systems) T1 · retrieved · retrieved 8 Oct 2026 · ConsultationStakeholders, including providers and developers of AI systems, businesses and public authorities as well as academia, research institutions and citizens, are invited to share their views by 23 June 2026.

- Section 18 KI-MIG places the Article 18(1) AI Act documentation-retention duty on the person responsible for liquidating a provider or authorised representative that ceases business.Confidence: Confirmed · As of 29 Jul 2026 · evidencedEvidence and sources[Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)](https://www.recht.bund.de/bgbl/1/2026/223/regelungstext.pdf?__blob=publicationFile) T1 · retrieved · retrieved 8 Oct 2026 · § 18 KI-MIGWhere a provider under Article 3(3) of Regulation (EU) 2024/1689 or an authorised representative established in Germany under Article 3(5) ceases its business activity, the person responsible for the liquidation or dissolution of the legal entity bears the obligation under Article 18(1) of Regulation (EU) 2024/1689.

- Derived: Probable Article 12 of the Italian decree inserts Article 437-bis into the Criminal Code, punishing omission of required high-risk AI safety/oversight measures with one to five years' imprisonment where danger to life or safety results.Confidence: Probable · As of 30 Sep 2026 · evidencedEvidence and sources[Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)](https://portale.fnomceo.it/wp-content/uploads/2026/09/dlgs-160.26.pdf) T3 · retrieved · retrieved 8 Oct 2026 · Article 12 (inserting Article 437-bis of the Criminal Code)Whoever fails to adopt the required technical safety measures... is punished with imprisonment from one to five years, where such omissions give rise to danger to life or public or individual safety.

Open evidence