Article 6 doesn’t say what you think it says. Here’s the plain-language version — and the three workpaper questions that follow.
The EU AI Act is the first serious attempt to regulate machine learning at the level of the system, not the sector. Which means, for the first time, the same instrument reaches insurance pricing engines, hiring screeners, and medical triage models. This is the point most compliance summaries miss.
Article 6, in plain English
Strip the recitals and Article 6 does something narrow: it defines what makes a system ‘high-risk.’ Two paths qualify a system. Either it is a safety component of a product already covered by EU harmonized rules, or it is used in one of the domains listed in Annex III.
“The classification isn’t about the model. It’s about the deployment context. The same algorithm can be low-risk in one product and high-risk in another.”
Three workpaper questions
Where does the system sit in the Annex III taxonomy — and can we evidence that placement?
If the system is a safety component, which harmonized standard governs the parent product?
What documentation exists to prove the classification decision was made and reviewed?
None of these questions require an engineer to answer. All three require someone to walk into the room and ask them — which is the entire premise of AI governance as a discipline.
