High-risk AI systems carry the heaviest obligations under the EU AI Act. This guide sets out what providers and deployers of high-risk AI must actually do — the controls, the documentation and the conformity assessment. Part of our guide to the EU AI Act.
A system is high-risk if it's used in one of the Annex III areas (employment, credit, education, essential services, biometrics, law enforcement, migration, critical infrastructure) or as a safety component of a regulated product under Annex I. If you're not sure, start with EU AI Act risk categories.
The provider must establish and maintain:
Deployers — organisations using a high-risk system — must use it in line with the instructions, assign competent human oversight, monitor its operation, keep logs, inform affected people where required, and in certain cases (e.g. public bodies and essential services) carry out a fundamental-rights impact assessment.
Most high-risk systems can be self-assessed against the requirements; some — particularly certain biometric systems — require a third-party notified body. Either way the outcome is a declaration of conformity and CE marking. We cover this in depth in EU AI Act conformity assessment.
After the 2026 Digital Omnibus, the high-risk obligations apply from 2 December 2027 for standalone (Annex III) systems and 2 August 2028 for AI embedded in regulated products (Annex I) — a deferral from the original August 2026/2027 dates. See the full timeline.
The Act's requirements map closely onto an ISO/IEC 42001 management system — risk management, data governance, human oversight, monitoring and documentation are common to both. Building on ISO 42001 is the most efficient path to meeting the high-risk obligations. See ISO 42001 certification.
AramGRC produces the Annex IV technical documentation and conformity readiness the Act requires for high-risk systems, and validates it independently.
A risk-management system, data governance, technical documentation, logging, transparency, human oversight, accuracy/robustness/cybersecurity, a quality management system, conformity assessment, EU-database registration and CE marking, plus post-market monitoring.
The documentation a provider of a high-risk AI system must prepare to demonstrate the system meets the Act's requirements — covering its design, development, data, and risk controls.
Most high-risk systems can be self-assessed, but certain systems (particularly some biometric ones) require conformity assessment by a third-party notified body.
After the 2026 Digital Omnibus, from 2 December 2027 for standalone (Annex III) systems and 2 August 2028 for AI embedded in regulated products (Annex I).
What the EU AI Act is, the risk categories, obligations, timeline and penalties.
A step-by-step guide and checklist to comply with the EU AI Act.
The four risk tiers, prohibited practices and high-risk AI systems.
What providers and deployers of high-risk AI must do.
You're here
The phased dates — and what the 2026 Digital Omnibus changed.
Fines up to €35M or 7% of global turnover — the full structure.
AI compliance across the EU AI Act, ISO 42001, NIST AI RMF and India's DPDP.