European UnionAI Act, Article 6(1) and Annex I (high-risk classification of a safety component or product under Annex I harmonisation legislation: provider duties)
Regulation (EU) 2024/1689, Article 6(1) and Annex I
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance, DPIA
- Audit expectation
- none
As of .
What it requires
- This duty takes effect on (Article 113, third paragraph, point (c)(ii), as replaced by Regulation (EU) 2026/1744) for a high-risk AI system classified under Article 6(1) and Annex I, the only classification Article 6(1) reaches, so the earlier date of for one classified under Article 6(2) and Annex III adds no system to it; for a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- It reaches you if you are the provider of an AI system that you intend to be used as a safety component of a product, or that is itself a product, covered by the Union harmonisation legislation listed in Annex I, where that product is required to undergo a third-party conformity assessment, with a view to its placing on the market or putting into service, pursuant to that legislation: Article 6(1) makes it a high-risk AI system whether or not you place it on the market independently of the product, and you are its provider if you develop it, or have it developed, and place it on the market or put it into service under your own name or trademark.
- Treat the system as a high-risk AI system and meet the obligations of a provider under Article 16, each set out in its own Article: ensure the system complies with the Chapter III, Section 2 requirements, have a quality management system (Article 17), keep the documentation (Article 18) and the logs under your control (Article 19), take corrective actions and provide information (Article 20), draw up an EU declaration of conformity (Article 47), affix the CE marking (Article 48), comply with the registration obligations of Article 49(1), and ensure the system complies with the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882.
- Follow the conformity assessment procedure that the Union harmonisation legislation listed in Section A of Annex I requires for the product, with the Chapter III, Section 2 requirements as part of that assessment, and also undertake the assessment of the quality management system set out in Article 17 (Article 43(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4), point (a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. The provider of an Article 6(1) system carries the Article 16 obligations because Article 6(1) classifies the system as high-risk; for a system related to a Section B product only Article 6(1), Article 60a and Articles 102 to 112 apply, so no Article 16 obligation reaches it directly. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Which AI systems are used solely for the non-safety aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control that Article 6(1a) excludes from safety components, when Article 6(1b) makes a system whose failure or malfunctioning would endanger health and safety a safety component?
What it makes you log
Logging duty
Article 6(1) classifies a system as high-risk and states no logging or record-keeping duty of its own. The provider duties that follow from the classification keep the logs in Article 19, the documentation in Article 18 and the capability in Article 12, each on its own page.
- Kind
- None
- As of
What this law does
Article 6(1) makes an AI system high-risk where both of two conditions are fulfilled: the AI system is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I, and that product is required to undergo a third-party conformity assessment, with a view to its placing on the market or putting into service, pursuant to that legislation.
The classification applies irrespective of whether the AI system is placed on the market or put into service independently of those products. Annex I, Section A, lists Union harmonisation legislation based on the New Legislative Framework. As amended by Regulation (EU) 2026/1744, point 1 of Annex I, Section A, is deleted and Section B gains point 21, Regulation (EU) 2023/1230 on machinery.
For an AI system classified as high-risk under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, Article 2(2), as replaced by Regulation (EU) 2026/1744, applies only Article 6(1), Article 60a and Articles 102 to 112, and applies Articles 57, 58 and 59 only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.
Article 3, point (14), as amended by Regulation (EU) 2026/1744, defines a safety component as a component of a product or of an AI system which fulfils a safety function for that product or AI system, or the failure or malfunctioning of which endangers the health and safety of persons or property, and a component fulfils a safety function where its intended purpose is to prevent or mitigate risks to health and safety of persons or property.
Article 6(1a), inserted by Regulation (EU) 2026/1744, provides that AI systems solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components. Article 6(1b), inserted by Regulation (EU) 2026/1744, provides that, notwithstanding paragraph 1a, AI systems the failure or malfunctioning of which would endanger health and safety qualify as safety components.
Article 6(1c), inserted by Regulation (EU) 2026/1744, provides that a product required to undergo a third-party conformity assessment solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, is not considered as fulfilling the condition in Article 6(1), point (b).
A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Article 16 sets out the obligations of providers of high-risk AI systems, the first of which is to ensure that their high-risk AI systems are compliant with the requirements set out in Section 2.
For a high-risk AI system covered by the Union harmonisation legislation listed in Section A of Annex I, Article 43(3), as replaced by Regulation (EU) 2026/1744, requires the provider to follow the relevant conformity assessment procedure required in accordance with that legislation, and the Section 2 requirements apply to the system and are part of that assessment.
Under Article 2(13), inserted by Regulation (EU) 2026/1744, the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 to a high-risk AI system referred to in Article 6(1) may be limited where and to the extent that Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights, and the limitation does not reduce the overall level of protection provided for by the Regulation.
By , the Commission is to adopt delegated acts under Article 97 specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which the limitation applies, and the scope of the limitation. Article 6 sits in Chapter III, Section 1, which is headed Classification of AI systems as high-risk.
Under Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply from for a system classified as high-risk under Article 6(2) and Annex III, and from for a system classified as high-risk under Article 6(1) and Annex I. Under the original text of Article 113, Article 6(1) and the corresponding obligations applied from .
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 99(6a), inserted by Regulation (EU) 2026/1744, provides that in the case of small mid-cap enterprises each fine referred to in paragraphs 4 and 5 of Article 99 is up to the percentages or amount referred to there, whichever is lower.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.