From the journal

EU Commission Publishes Draft High-Risk AI Classification Guidelines Under AI Act, May 2026

On 19 May 2026, the European Commission published draft guidelines under Article 6(5) of the EU AI Act (Regulation 2024/1689) to help providers, deployers, and market surveillance authorities determine when an AI system qualifies as high-risk. The guidelines cover two classification routes: systems used as safety components in products subject to Annex I harmonisation legislation, and systems falling within the Annex III use-case list. A targeted consultation closes 23 June 2026.

3 min read

On 19 May 2026, the European Commission published draft guidelines on the classification of high-risk AI systems under Article 6(5) of Regulation (EU) 2024/1689, the EU AI Act. The document is at the consultation stage. The Commission has invited input from providers, deployers, and market surveillance authorities until 23 June 2026 at 22:00 CET. Following that deadline, the guidelines will be revised before adoption as a non-binding Commission interpretive instrument.

Article 6 of the AI Act establishes two routes for high-risk classification. Under the Annex I route, a system qualifies as high-risk if it functions as a safety component of a product covered by EU harmonisation legislation listed in that Annex and the product must undergo third-party conformity assessment. Under the Annex III route, a system qualifies if it falls within one of the eight enumerated use-case areas, unless the provider demonstrates under Article 6(3) that it poses no significant risk to health, safety, or fundamental rights. The draft guidelines interpret each element of these tests, including the meaning of 'safety component,' 'intended purpose,' and the conditions for invoking the Article 6(3) exception.

AI system providers and deployers operating in the EU will use these guidelines to determine conformity assessment obligations, registration requirements in the EU AI Act database, and post-market monitoring duties that attach to high-risk classification. Market surveillance authorities in each Member State will reference the guidelines when assessing compliance. Providers of AI used in recruitment, credit scoring, critical infrastructure, biometric identification, and law enforcement face the most immediate classification questions under Annex III.

The guidelines are not legally binding; the Commission's interpretation does not foreclose readings by national courts or the Court of Justice. The Article 6(3) exception, allowing providers to self-assess that an Annex III system poses no significant risk, remains a contested mechanism. The draft sets out criteria for its application, but providers and deployers may argue the test is too narrow or too broad. Ambiguous cases involving general-purpose AI integration and downstream fine-tuning are not fully resolved in the draft.

Licentium advises AI providers, deployers, importers, and regulated-sector clients on EU AI Act classification, conformity assessment preparation, and regulatory strategy. We may assist directly or connect clients with specialist EU regulatory counsel through our partner network. Work we undertake includes AI Act compliance mapping, high-risk classification analysis, conformity assessment support, and regulatory submissions to Commission consultations.

Source: European Commission, Draft Guidelines on the Classification of High-Risk AI Systems, Article 6(5) EU AI Act (Regulation 2024/1689), 19 May 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.