From the journal

European Commission Publishes Draft Guidelines on High-Risk AI Classification Under Article 6, 2026

The European Commission has published draft guidelines clarifying when AI systems qualify as high-risk under Article 6 of the EU AI Act (Regulation (EU) 2024/1689). The guidelines address two classification routes and provide practical examples of in-scope and out-of-scope AI systems. Public consultation closes 23 June 2026.

2 min read

The European Commission published draft guidelines on the classification of high-risk AI systems under Article 6(5) of the EU AI Act (Regulation (EU) 2024/1689). The guidelines are at consultation stage. The Commission invites feedback from providers, deployers, public authorities, academia, and research institutions by 23 June 2026. The Commission will consider responses before finalising the guidelines.

Article 6 sets two routes to high-risk classification. Under Article 6(1), an AI system is high-risk if it is a safety component of a product covered by EU harmonisation legislation listed in Annex I and the product requires third-party conformity assessment. Under Article 6(2), an AI system is high-risk if it falls within a use case listed in Annex III, covering biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration management, and administration of justice. Article 6(5) allows providers to rebut the Annex III classification by demonstrating the system poses no significant risk of harm. The draft guidelines clarify these classification concepts and provide practical examples of systems that should or should not be classified as high-risk.

Providers must classify their AI systems before the mandatory application dates: 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in regulated products. Classification as high-risk triggers obligations including conformity assessment, EU AI database registration, technical documentation, and post-market monitoring under Chapter III of the AI Act. Deployers in regulated sectors (banks, public authorities, insurers, law enforcement agencies) face additional transparency and human oversight obligations.

The final guidelines will not have binding legal force but will represent the Commission's authoritative interpretation and will guide national market surveillance authorities in enforcement. Open questions about how the guidelines interact with the revised application dates agreed in the Omnibus political agreement of 7 May 2026 will be resolved in final published text. The Article 6(5) rebuttal procedure allows providers to argue that an Annex III system poses no significant risk, but the evidentiary standard is not yet settled.

Licentium advises on EU AI Act classification analysis and has a partner network for EU-regulated entities. Work we undertake includes high-risk AI system classification reviews, Article 6(5) rebuttal assessments, Annex III use case mapping, and compliance planning for providers and deployers.

Source: European Commission, Draft Commission Guidelines on the Classification of High-Risk AI Systems (Article 6(5) AI Act), 2026

AI Regulatory

More from the journal

See all
Illia Prokopiev

Crypto Vaults and Lending Strategies Under U.S. Federal Securities Law

Commissioner Hester M. Peirce’s July 22, 2026 statement does not establish binding law, but it identifies the principal federal securities-law questions raised by crypto vaults and onchain lending strategies. This analysis examines when vault interests, lending claims, receipt tokens, and related service-provider activities may trigger the Securities Act, Exchange Act, Investment Company Act, and Investment Advisers Act.

MiCAR Transitional Regime for CASPs Expires Across the EU, July 2026

On 1 July 2026, the MiCAR transitional period under Article 143(3) of Regulation (EU) 2023/1114 expired across the EU. Former virtual asset service providers operating under national registrations must now hold a MiCAR crypto-asset service provider authorisation or cease providing crypto-asset services. In Luxembourg, the CSSF confirmed that VASP registration under the 2004 AML Law no longer provides a sufficient legal basis for market activity.

EDPB Adopts Final GDPR Guidelines on Blockchain Data Processing, EU, 8 July 2026

On 8 July 2026, the European Data Protection Board adopted the final version of Guidelines 02/2025 on the processing of personal data through blockchain technologies. The guidelines confirm that encrypted and hashed on-chain data remains personal data under the GDPR and that blockchain immutability does not override data subjects' right to erasure under Article 17. Controllers must address architecture choices and data minimisation before any on-chain recording of personal data.