Why it matters
High-risk systems carry the Act's heaviest obligations, and the label depends on the use, not the technology. The same general-purpose model is minimal risk when it drafts marketing copy and high-risk when it ranks job applicants. That is why classification has to be done per system and per purpose, and why the reasoning should be written down.
For organisations that use AI rather than build it, the obligations sit in Article 26: follow the provider's instructions for use, assign human oversight to people with the competence and authority to intervene, keep the system's logs for at least six months, and inform workers before a high-risk system is used in the workplace.
In the EU AI Act
Article 6, Annex III and Article 26
The high-risk obligations for Annex III systems apply from 2 December 2027. High-risk systems that are safety components of products regulated under Annex I follow on 2 August 2028. Regulation (EU) 2026/1744 moved both dates back.
How Qastel handles it
Qastel scores every discovered system across eight weighted dimensions, including its EU AI Act risk class, and keeps the classification current as the system and its use change.