Builds on AR-000200 (The EU AI Act Explained), which introduced the four risk tiers — none of that content is re-derived here. This article covers Article 6’s classification mechanics and the Annex III category list in full. AR-000210 (High-Risk AI Systems) covers the substantive Chapter III Section 2 obligations that attach once classification is confirmed.
Executive summary
What this means
Who this applies to
Regulatory context
The Article 6(1) product-safety route
The Article 6(2) Annex III use-case route
The Article 6(3) derogation
Commission guidelines (Article 6(5))
Requirements
What organizations must do
- Run the Article 6(1) product-safety test first for any AI system that is or functions as a safety component in an Annex I product — both conditions (Annex I coverage AND third-party conformity assessment required) must be satisfied.
- Run the Article 6(2) Annex III test by intended purpose, not by system type — the categories turn on what the provider has documented the system is intended to do, not what it technically does.
- Before invoking the Article 6(3) derogation, confirm the system does not profile natural persons — that check must come before the four conditions are assessed, because profiling renders the derogation unavailable regardless.
- Document the Article 6(3) assessment in writing before market placement, not retrospectively — and register under Article 49(2) even when claiming the derogation.
- Build the Article 6 classification test into the Article 17 quality management system as its first decision point — it is the gateway that governs every downstream obligation in Chapter III.
- Monitor Article 7 delegated acts — the Commission can add or modify Annex III categories, which could reclassify a system that was not high-risk at initial assessment.
Common mistakes
Treating the Article 6(3) derogation conditions as alternatives that apply regardless of profiling is a common mistake — the profiling override is absolute and takes precedence over all four conditions.
Satisfying only one of Article 6(1)’s two conditions and treating the system as high-risk via that route is a second mistake — being a safety component in an Annex I product is necessary but not sufficient; the product must also require third-party conformity assessment.
Running the Annex III test against a system’s technical capabilities rather than its documented intended purpose is a third mistake — the classification turns on what the provider specifies in documentation, not on what the system could theoretically do.
Treating the Article 6(4) documentation duty as something to prepare if challenged rather than a precondition to market placement is a fourth mistake — the duty is prospective, and a system placed on the market before the documentation exists is non-compliant from day one.
Assuming the derogation avoids the Article 49(2) registration obligation is a fifth mistake — registration is required even when the provider concludes the system is not high-risk under Article 6(3).
Open questions
- Whether the Digital Omnibus has changed Article 6’s classification tests or derogation conditions — Article 6 carries the Digital Omnibus amendment disclaimer on the Service Desk; the pre-amendment text is what is verified here.
- Whether the Commission’s draft Article 6(5) guidelines, once formally adopted, will alter the practical interpretation of the Article 6(3) derogation — the draft guidelines were in public consultation until 23 July 2026 and are not yet formally adopted.
- Whether the Commission will exercise its Article 6(6)–(7) powers to add or delete derogation conditions — no delegated act on this point has been identified as of this research pass.
- Whether Annex III itself has been amended by any delegated act under Article 7 — no Article 7 delegated act was identified during this research pass; Annex III carries no Omnibus disclaimer.