Builds on AR-000200 (The EU AI Act Explained) for shared vocabulary — provider/deployer definitions and the four-tier risk structure are not re-derived here. Article 14 (human oversight), one of the six substantive requirements below, is covered in depth in AR-000142 and only summarised here.
Executive summary
What this means
Who this applies to
Regulatory context
Requirements
What organizations must do
- Confirm the system is an "AI system" within Article 3(1) at all before doing anything else.
- Run the Article 6 classification test against both the Annex I product-safety track and the Annex III use-case track.
- If Annex III applies, check whether the narrow Article 6(3) derogation removes the system from high-risk status — remembering profiling always overrides the derogation.
- For any system that remains high-risk, begin work against all six Chapter III Section 2 pillars together — they are cumulative, not alternative, requirements.
- If relying on the Article 6(3) derogation, document that assessment before market placement — Article 6(4) makes this a legal requirement, not a best practice.
- Start the classification exercise well ahead of the 2 December 2027 (Annex III) or 2 August 2028 (Annex I) deadlines — classification alone can be genuinely difficult at the margins.
Common mistakes
Treating the Annex I and Annex III tracks as mutually exclusive is a common error — a system embedded in Annex-I-covered machinery that is also used for one of the Annex III purposes can be caught by both tracks, each with its own conformity-assessment mechanics.
Relying on the Article 6(3) derogation without documenting the assessment is a second common mistake — Article 6(4) makes the documentation itself a legal requirement, and an undocumented "not high-risk" call carries the same registration exposure as an undocumented high-risk one.
Assuming the Article 6(3) derogation is available whenever a system merely "assists" a human decision is a third mistake worth flagging — the derogation's own text preserves high-risk status wherever the system performs profiling, and the "narrow procedural task" and "improves the result of a previously completed human activity" categories are narrower in practice than they may sound, since Commission guidance is intended to clarify exactly where that line sits.
Open questions
- Whether the Digital Omnibus changed the substance of Article 6's classification mechanics or the Annex I legislation list, beyond the dates. The AI Act Service Desk's own pages for Article 6 and Annex I carry the same Commission disclaimer seen in AR-000200 for Article 3: both provisions have "been amended by the Digital Omnibus on AI" and the displayed text "has not yet been updated to reflect those amendments." This article cites the pre-Omnibus text, cross-checked against the Omnibus's own confirmed effect on application dates — but whether the substance changed beyond the dates is unconfirmed.
- Whether the Commission met its Article 6(5) statutory deadline (2 February 2026) for high-risk classification guidelines. Not independently confirmed against a primary Commission source on this research pass.
- Where the practical boundary of the Article 6(3) derogation categories sits — particularly "narrow procedural task" and "improves the result of a previously completed human activity" — pending the Article 6(5) guidelines' worked examples.