Source: Lewis Silkin LLP

A legal gap between everyday regulated activities (such as food hygiene) and AI deployment is closing as the EU AI Act will impose binding obligations on builders and deployers of AI systems, including those classified as high‑risk, with potential fines up to €15 million or 3% of global annual turnover. The European Commission has published draft guidelines on classifying high‑risk AI systems and a separate report reviewing prohibited and high‑risk categories; the guidelines aim to clarify current coverage while the report identifies areas that might be regulated in future. The Commission’s proposed Digital Omnibus delays the dates when obligations take effect — notably 2 December 2027 for high‑risk systems used in specified areas and 2 August 2028 for high‑risk systems integrated into regulated products — giving organisations more time than the original 2 August 2026 deadline, though the guidelines remain non‑binding and open for consultation until 23 June 2026.

Classification under the AI Act follows two routes: Article 6(1) (AI as a safety component or product covered by harmonised EU legislation in Annex I) and Article 6(2) (intended purpose falling within exhaustive use cases listed across eight Annex III areas such as biometrics, employment, law enforcement, education and critical infrastructure). The guidelines explain the Article 6(3) exception mechanism allowing providers to demonstrate that some Annex III systems do not pose a significant risk, while noting any system that profiles natural persons is always high‑risk. Businesses are advised to map AI systems to the classification criteria, document any Article 6(3) assessments before market placement (Article 6(4)) and register under Article 49 where required, build compliance infrastructure covering risk management, data governance, technical documentation, record‑keeping, transparency, human oversight, accuracy, robustness and cybersecurity, and consider responding to the consultation. The Commission’s report flags potential future high‑risk extensions (for example AI companions, non‑consensual deepfakes, AI for scams, debt collection, tenant screening and critical infrastructure), but it does not change the law today.