What is a high-risk AI system?

A high-risk AI system, under the EU AI Act, is one whose intended use could significantly affect people's health, safety or fundamental rights, and which must therefore meet strict requirements. Annex III lists such uses, among them credit scoring of individuals and pricing of life and health insurance. An AI agent is high-risk when its use is one of them.

Why does high-risk status matter for AI agents?

It decides how much work an agent needs before it may be used. A high-risk agent brings requirements on risk management, data governance, logging, transparency to deployers, human oversight, and accuracy and cybersecurity, plus deployer duties and, for some, a fundamental rights impact assessment. A minimal-risk agent brings far fewer.

Classification follows use, not technology. The same agent platform can host a minimal-risk agent that summarises internal meetings and a high-risk agent that assesses loan applicants. Whether an AI agent is a high-risk AI system explains how to reason through it.

How does classification work in practice?

Ask, for each agent and each capability:

1. What is it used for? Describe the intended purpose specifically.
2. Is that use listed in Annex III, or is the system a safety component of a product covered by EU product law?
3. Does it affect natural persons in the way the listing describes?
4. Does any exception apply, for example where the system performs only a narrow preparatory task and does not materially influence the outcome? Exceptions are narrow and must be documented.

Record the answer and the reasoning. Revisit it whenever the agent's role changes.

What does an example look like?

A bank runs three agents. The first answers customers' questions about card delivery. It is not high-risk, though customers must be told they are dealing with AI; see whether a customer support chatbot is high-risk. The second assesses personal loan applicants' creditworthiness and drafts decisions. Creditworthiness assessment of natural persons is listed in Annex III, so it is high-risk; whether a credit scoring agent is high-risk covers that case. The third assesses small companies' credit for loans to limited companies only. That is not creditworthiness of natural persons, so it may fall outside the listing, but the bank documents the reasoning and keeps the agent under the same controls, because the line is fine and its business risk is real.

What do high-risk requirements mean for an agent that acts?

The requirements were written for systems that inform decisions. An agent takes them. That means:

• Human oversight (Article 14) must work at the moment of action, with actions above the agent's bounds held for a named person.
• Record-keeping (Article 12) must capture what the agent did, not only what it recommended.
• Accuracy (Article 15) must be shown on the cases the agent actually handles, and kept current as those cases change.
• Risk management (Article 9) must cover tool use and actions, not just outputs.

How is a high-risk AI system different from a general-purpose AI model?

A general-purpose AI model is a component that can do many things. A high-risk AI system is a complete system, classified by a specific use. The same model can sit inside a high-risk agent and a minimal-risk one. Model providers have their own obligations; the high-risk requirements fall on the provider of the system and its deployer.

For the wider picture, see our guide to AI agent regulation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.