European UnionAI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification)
Regulation (EU) 2024/1689, Article 6(3) and (4)
An AI risk obligations rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting
- Obligation class
- Governance, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator, Self
What it requires
- This duty takes effect on (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744) for a system classified as high-risk under Article 6(2) and Annex III, the only route Article 6(3) and (4) concern, so the later date of for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If your AI system is listed in Annex III but performs only a narrow procedural task, improves the result of a previously completed human activity, detects deviations from prior human decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review, or performs a preparatory task to an Annex III assessment, and does not pose a significant risk of harm, you may treat it as not high-risk, unless it profiles natural persons, in which case it is always high-risk.
- Document your assessment that the system is not high-risk before placing it on the market or putting it into service.NIST AI RMFMAP 3.3
- You are subject to the Article 49(2) EU database registration obligation.NIST AI RMFGOVERN 1.1
- Provide the documentation of your assessment to national competent authorities on request.NIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
National market surveillance authorities, at least one designated by each Member State under Article 70(1); the AI Office for an AI system within its exclusive competence under Article 75(1).
Settledness
The Commission's guidelines on the classification of high-risk AI systems are a draft, circulated for stakeholder consultation before adoption.
- As of
- Open questions
- Can a provider rely on the Article 6(3) derogation for an Annex III system that performs a 'narrow procedural task' under point (a) while its output materially influences the outcome of decision making, or must the system also pose no significant risk of harm under the first subparagraph?
- Does 'without proper human review' in Article 6(3), point (c), require review by a person with authority to depart from the system's output?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A provider relying on the Article 6(3) derogation must document its assessment before placing the system on the market or putting it into service, and provide that documentation to national competent authorities on request.
- Kind
- Explicit
- As of
- Provision
- Article 6(4)
- Trigger
- high_risk_systems
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
By derogation from the default rule that every AI system listed in Annex III is high-risk, Article 6(3) provides that an Annex III system is not high-risk where it does not pose a significant risk of harm to health, safety, or fundamental rights, including by not materially influencing a decision's outcome, and it performs only a narrow procedural task, improves the result of a previously completed human activity, detects deviations from prior human decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review, or performs a preparatory task to an Annex III assessment; a system that profiles natural persons is always high-risk regardless.
A provider who relies on this derogation must document the assessment before placing the system on the market or putting it into service, is subject to the Article 49(2) EU database registration obligation, and must provide the documentation of the assessment to national competent authorities on request.
Article 6 sits in Chapter III, Section 1, so like Articles 9, 10, 12, 14, 15, 19, 21 and 26 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, the only route this provision concerns, rather than the Regulation's general application date.
Article 6(5), the Commission's duty to publish classification guidelines by , is expressly excluded from that deferral.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 6(3) and (4) do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .