EU AI Act rules Draft Guidelines Outline High-Risk AI Classification Criteria

EU AI Act rules took a concrete step forward on 19 May 2026 when the European Commission published draft guidelines on classifying high-risk AI systems under Article 6 of Regulation (EU) 2024/1689. The documents supply practical examples for both the Annex I product-safety route and the Annex III use-case route, helping developers and regulators apply uniform criteria ahead of later enforcement dates.

Scope and Content of the Draft Guidelines

The drafts address general principles for risk classification and then separate the two statutory pathways. Annex I covers AI systems that function as safety components or products already subject to third-party conformity assessment under listed EU harmonisation legislation. Annex III lists eight sensitive domains: biometrics, critical infrastructure, education, employment, essential services including credit and insurance, law enforcement, migration and border control, plus justice and democratic processes.

Systems falling under Annex III escape high-risk status only when they satisfy the low-impact conditions set out in Article 6(3), except for any system that performs profiling, which remains high-risk regardless of scale. The Commission retains the power to amend Annex III through delegated acts. The guidelines also list the full set of obligations that high-risk classification triggers, including risk management, data governance, technical documentation, logging, transparency measures, human oversight, accuracy and cybersecurity requirements, quality management systems, conformity assessment, CE marking and, for Annex III systems, registration in the EU database.

Timeline, Consultation and Practical Implications

A targeted stakeholder consultation on the drafts opened on 19 May 2026, originally scheduled to close on 23 June and later extended to 23 July 2026. Final non-binding guidelines are expected before the end of 2026. Meanwhile, the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on 27 July 2026, postponed application dates: Annex III high-risk provisions now apply from 2 December 2027, while Annex I embedded systems follow from 2 August 2028. These delays accommodate ongoing work on harmonised standards and supporting measures.

Earlier AI Act milestones remain unchanged. Prohibitions and AI literacy obligations started in February 2025, general-purpose AI rules took effect in August 2025, and transparency requirements under Article 50 apply from 2 August 2026. Companies developing or deploying AI systems in the listed sectors should map their products against the draft examples now, review data governance and documentation practices, and prepare for conformity assessment procedures well before the 2027 and 2028 deadlines. The guidelines will also inform national authorities responsible for enforcement once the rules become applicable.

Next Steps in Implementation

Standardisation bodies continue to develop the technical standards referenced by the AI Act, while the Commission plans additional guidance on the concrete obligations that accompany high-risk classification. Organisations can participate in remaining standardisation meetings and monitor the publication of the final classification guidelines expected before December 2026. Early alignment with the classification criteria reduces the risk of late-stage redesigns and supports smoother market access once the postponed application dates arrive.