← Back to scanner

High-Risk AI System Requirements

High-risk AI systems face the strictest operational requirements under the EU AI Act. Common examples include AI used in employment, education, credit, essential services, law enforcement, migration, and critical infrastructure.

The compliance burden is not just a legal memo. It requires product controls, technical evidence, logs, monitoring, and human oversight that can be shown to regulators or customers.

Articles 8-15 control areas

Most high-risk readiness work maps to eight control families that product and engineering teams can implement.

  • Article 9: risk management system
  • Article 10: data governance and data quality
  • Article 11: technical documentation
  • Article 12: automatic logs and record keeping
  • Article 13: transparency and instructions for use
  • Article 14: human oversight
  • Article 15: accuracy, robustness, and cybersecurity

What regulators and buyers expect

A credible high-risk compliance file should connect each obligation to concrete product behavior: what is logged, who can override, how model performance is monitored, and how failures are escalated.

Common gaps

The most common gaps are missing human oversight procedures, no bias or data-quality evidence, weak incident handling, and documentation that describes the product but not the AI system lifecycle.

Direct answers

What makes an AI system high-risk?

An AI system is generally high-risk when it falls under Annex III use cases or is a safety component of regulated products covered by EU harmonization law.

Are hiring AI tools high-risk?

Yes. AI used for recruitment, candidate screening, worker management, promotion, or termination can fall under high-risk employment categories.

When do high-risk obligations apply?

The main high-risk obligations apply from August 2, 2026, with some product categories following later timelines.

Related resources

Check your product now — free

No sign-up required. Results in 60 seconds.