When does AI become “high-risk”?
The European Commission recently published draft guidelines on the classification of high-risk AI systems under Article 6 of the AI Act. Although the document is non-binding and still open for feedback, the draft guidelines provide the clearest indication to date of how the Commission is likely to interpret one of the most debated aspects of the AI Act in practice: what actually qualifies as a “high-risk AI system”?
This question is particularly important given that classification as a high-risk AI system triggers extensive compliance obligations, including requirements relating to risk management, documentation, human oversight, monitoring, and governance.
HR AI does not automatically mean “high-risk”
One of the most important clarifications in the guidelines concerns the interpretation of Annex III of the AI Act, which lists a series of sensitive areas where AI systems may qualify as high-risk, including: recruitment and hiring, employee management, promotion and termination decisions, and employee monitoring.
Until now, many organisations have interpreted Annex III broadly, assuming that the mere use of AI in one of these areas automatically results in high-risk qualification.
The guidelines clarify that this is not necessarily the case. The Commission is effectively saying that:
- not every AI system used in a sensitive area automatically becomes high-risk; but also
- simply describing a system as “assistive” or “human-in-the-loop” will not automatically exempt it, either.
Article 6(3): The exception companies are closely watching
A central focus of the guidelines is Article 6(3) of the AI Act, which provides an exception for certain Annex III systems that do not pose a significant risk to health, safety, or fundamental rights.
According to the guidelines, certain AI systems may fall outside the high-risk regime where they perform only limited or supportive functions, such as: (i) summarising documents; (ii) improving language or formatting; (iii) organising information; (iv) supporting administrative workflow, or (v) detecting duplicates.
The underlying rationale is that such systems do not materially influence the final decision affecting the individual.
This clarification is particularly relevant for employers increasingly using generative AI tools internally for operational or HR-related support activities.
Why “human oversight” may not be enough
At the same time, the guidelines also make clear that companies will not automatically avoid high-risk classification simply because a human formally remains involved in the process.
According to the Commission, the practical reality of how decisions are made remains relevant. In particular, where decision-makers systematically rely on:
- AI-generated rankings;
- candidate scoring;
- productivity indicators;
- algorithmic recommendations; or
- automated risk flags
the AI system may still qualify as high-risk, even if the final decision is formally adopted by a human.
As such, the guidelines suggest that regulators are likely to assess not only the formal governance structure surrounding the AI system, but also the degree of influence the system exercises in practice.
Workplace AI remains under scrutiny
Although the guidelines introduce additional nuance into the classification analysis, it does not reduce regulatory attention on workplace AI systems.
The Commission repeatedly emphasises the potential impact of such systems on equal treatment, privacy, access to employment, career progression, and fundamental employee rights.
Consequently, AI systems used for recruitment, performance evaluation, employee monitoring, promotion decisions, task allocation, or dismissal-related processes are likely to remain under heightened regulatory scrutiny.
What this means for companies
Although the guidelines remain in draft form and are not legally binding, they are likely to become highly influential in shaping the approach of national regulators and supervisory authorities.
Perhaps most importantly, the draft guidance suggests that the assessment will increasingly focus not simply on whether AI is used in a sensitive area, but on the extent to which the AI system materially influences decisions affecting individuals in practice.
For companies, this will likely require a more operational assessment of AI usage that goes beyond formal descriptions and focuses instead on how decisions are actually taken in day-to-day business processes.
