European Commission publishes draft Article 6 guidelines on high-risk AI

What it is

On May 19, 2026, the European Commission published draft guidelines on the classification of high-risk artificial intelligence under Article 6 of the EU AI Act and launched a public consultation open until June 23, 2026.

The draft guidelines, which have been issued under Article 6(5) of the EU AI Act, are intended to assist providers, deployers and market surveillance authorities in determining whether an AI system falls within a high-risk category under Article 6 of the EU AI Act.

Guidance on high-risk classification had initially been expected by February 2, 2026, ahead of the EU AI Act's original compliance milestones for high-risk systems.

What it requires

An AI system shall be considered high-risk in 2 scenarios, following the structure Article 6 sets out.

If the system is intended to be used as a safety component of a product, or the AI system itself is a product, covered by the EU harmonisation legislation listed in Annex I, and is required to undergo a third-party conformity assessment, the system will be classified as high-risk pursuant to Article 6(1) AI Act.

If the system falls into one of the use cases listed under the areas in Annex III AI Act, it will be classified as high-risk pursuant to Article 6(2) AI Act.

The Guidelines set out the Commission's interpretation of certain concepts that are relevant for classification purposes and, in accordance with Article 6(5) AI Act, contain practical examples of AI systems that should or should not be classified as high-risk.

One part of the draft addresses classification under Article 6(1) and Annex I, covering AI systems that are safety components of products, or are themselves products, subject to specified EU product safety legislation, while another part addresses classification under Article 6(2) and Annex III, covering certain stand-alone AI systems used in areas identified by the AI Act as presenting significant risk, including biometrics, education, employment, essential services and law enforcement.

The European Commission also emphasizes that the guidelines are not legally binding and that authoritative interpretation of the EU AI Act ultimately rests with the Court of Justice of the European Union.

Under the revised timetable, requirements for stand-alone high-risk AI systems are now due to apply from December 2, 2027, while obligations for high-risk AI systems embedded in products will apply from August 2, 2028.

What security leaders should do

Use the draft text now, while it is open for comment, to run a first-pass classification of every AI system your organization builds or deploys against the Article 6(1) safety-component test and the Article 6(2) Annex III use-case list. Pay particular attention to any system touching biometrics, employment, critical infrastructure or essential services, since those are the areas the draft addresses in detail, and route borderline cases to legal and compliance review before relying on an internal not-high-risk determination. Because the guidance is not binding and the final version may differ, track the consultation outcome and the eventual published text rather than freezing controls against the May 2026 draft alone. Finally, do not let the later 2027 and 2028 application dates slow preparation: documentation, intended-purpose statements and exemption records described in the draft are easier to build into systems now than to retrofit once enforcement begins.