The European Commission has published draft guidelines to help businesses navigate one of the EU AI Act's most consequential determinations: whether their AI systems fall into the high-risk category. In this episode of “Bytes,” Emily Griffin from Skadden's IP and Technology team in London breaks down the two routes to a high-risk classification under Article 6: the product safety route, covering AI systems that are regulated products or safety components subject to third-party conformity assessment, and the use-case route, covering systems whose intended purpose falls into one of eight sensitive areas. She also highlights a self-assessment “safety valve” under Article 6(3) and updated compliance timelines, with a clear message: start the classification work now.
“SkadBytes” is presented by Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates. This podcast is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.
Transcripts
Voiceover (:
Welcome to “Bytes” from “SkadBytes,” jargon-free, byte-size insights from Skadden's IP and tech team on the key issues shaping the tech landscape.
Emily Griffin (:
Hello, I'm Emily Griffin from the IP and technology team here at Skadden London. In this “Byte,” we're giving a headline summary of the European Commission's draft guidelines on classifying high-risk AI systems under the EU AI Act, published for stakeholder consultation in May 2026. By way of context, the AI Act provides for different sets of obligations on AI systems by the risks they pose to health, safety and fundamental rights. High-risk systems sit below systems that are prohibited outright, but above systems that are low and pose no risk. High-risk systems therefore track the bulk of the AI Act's obligations, including requirements relating to data governance, technical documentation, human oversight, accuracy and robustness. The classification question matters because the obligations that attach to high risk systems as opposed to limited or minimal risk are materially more onerous than for lower-risk systems. There are two routes to being classed as high risk under Article 6 of the AI Act.
(:
First, the product safety route under Article 6(1) and Annex I. These are AI systems that are themselves regulated products or safety components of products subject to third-party conformity assessment. Think machinery, lifts, toys, medical devices, radio equipment and vehicles. Second, the use-case route under Article 6(2) and Annex III. These are standalone systems whose intended purpose falls into one of eight sensitive areas — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and the administration of justice. On route 1, the product safety route, the commission stresses it's a cumulative test. The AI system must be a safety component or itself a regulated product, and the product has to be subject to a third-party conformity assessment. “Safety component” has its own AI Act definition under Article 3(14). The system must either perform a safety function or its failure must endanger health and safety. By way of example, a lane assist function in a vehicle qualifies. Even if it is touted as a convenience or comfort feature, a malfunction could still cause a collision.
(:
On route 2, the use-case route, classification rests on the system's intended purpose, not on whether a human is in the loop. Human oversight is a compliance requirement, not a way out. The list is exhaustive, but Article 6(3) provides a safety valve. A provider can self-assess out where the system performs only a narrow procedural task, improves a previously completed human activity, detects decision-making patterns without replacing judgment or performs a preparatory task — provided it does not profile. To illustrate: in the administration of justice, an AI tool that helps a judge research the law and apply it to the facts is high risk. Two final points. The guidelines are draft and non-binding and, as always, subject to CJEU interpretation. Under the current Digital Omnibus proposal, Annex III obligations now apply from the 2nd of December 2027 and Annex I obligations apply from the 2nd of August 2028. So more runway than was initially envisaged, but the classification work is fact specific. It's worth businesses starting to think about it now rather than later.
Voiceover (:
Thanks for listening to “Bytes.” Be sure to subscribe for more tech insights. Additional information about Skadden can be found at skadden.com.
