SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillshochrisiko-klassifizierung

hochrisiko-klassifizierung

General & other

View repository

Updated 10-15 20:08

About this skill

/ki-vo-compliance:hochrisiko-klassifizierung

Purpose

The high-risk classification determines the applicable obligations of the AI Act: conformity assessment, risk management, data quality, transparency, human oversight, logging, accuracy/robustness/cybersecurity. A misclassification can trigger fines of up to EUR 15 million or 3% of global annual turnover (Art. 99(4) AI Act).

⚠️ Applicable dates under the Digital Omnibus on AI (as of 2026-07): The high-risk obligations are postponed. The AI Act simplification package was definitively adopted by the European Parliament on 16.06.2026 and by the Council on 29.06.2026 .

Regulatory scope Applicability
Prohibitions Art. 5, AI literacy Art. 4 02.02.2025 (applies)
GPAI Art. 51–55 02.08.2025 (applies) — not postponed
General application + transparency Art. 50 02.08.2026 — remains
High-risk Annex III (Art. 6(2), standalone systems) 02.12.2027 (previously 02.08.2026)
High-risk Annex I (Art. 6(1), safety component) 02.08.2028 (previously 02.08.2027)
Regulatory sandboxes Art. 57 02.08.2027 (previously 02.08.2026)
New prohibitions (NCII, CSAM) 02.12.2026
Legacy GPAI models (Art. 111(3)) 02.08.2027

No blanket postponement: The classification must still be carried out on a case-by-case basis — what has been postponed are the consequences of obligations, not the classification. Art. 50 applies independently of the high-risk classification. Official Journal reference of the amending regulation [unverifiziert - prüfen].

Inputs

  • Function of the AI system (use case)
  • Area of application (check Annex III: biometrics, critical infrastructure, education, employment, access to services, law enforcement, migration, justice, democracy)
  • Role of the client (provider, deployer, importer, distributor — Art. 3)
  • Is the AI system a safety component of a product falling under Annex I?
  • Does an exception under Art. 6(3) apply (preparatory task, no significant influence)?

Procedure

1. Scope of the high-risk classification (Art. 6)

Two paths:

  • Art. 6(1) – The AI system is a safety component of a product falling under the harmonisation legislation listed in Annex I (e.g. Machinery Regulation, Medical Devices Regulation, Toys).
  • Art. 6(2) – The AI system falls within one of the 8 areas of application of Annex III.

2. Annex III – the 8 high-risk areas

  1. Biometrics – remote identification, emotion recognition/categorisation systems
  2. Critical infrastructure – Transport, water, gas, electricity, heating, digital infrastructure
  3. Education & vocational training – access/assessment/monitoring
  4. Employment & personnel management – selection, promotion, termination, task allocation, evaluation
  5. Access to essential services – credit scoring (except fraud), insurance risk, emergency call prioritization
  6. Law enforcement
  7. Migration, asylum, border control
  8. Justice & democratic processes

3. Exception Art. 6(3)

AI system is NOT classified as high-risk if it does not pose a significant risk to health, safety or fundamental rights and fulfils at least one of the four conditions:

a) performs a narrowly limited procedural task b) improves the result of a previously completed human activity c) detects decision patterns or deviations without replacing/influencing the human assessment d) performs a preparatory task for an assessment within the meaning of Annex III

Profiling of natural persons is excluded from the exception — always remains classified as high-risk (Art. 6(3) last subparagraph).

4. Consequent obligations upon high-risk classification

Provider:

  • Risk management system Art. 9
  • Data and data governance Art. 10
  • Technical documentation Art. 11
  • Record-keeping obligations / logging Art. 12
  • Transparency and provision of information Art. 13
  • Human oversight Art. 14
  • Accuracy, robustness, cybersecurity Art. 15
  • Quality management system Art. 17
  • Conformity assessment Art. 43, Annex VI/VII
  • CE marking, registration in EU database Art. 48, 71

Deployer:

  • Use in accordance with provider instructions Art. 26(1)
  • Human oversight by trained persons Art. 26(2)
  • Input data relevant and representative Art. 26(4)
  • Monitoring of operation Art. 26(5)
  • Keep records Art. 26(6)
  • Information obligations to employees and their representatives Art. 26(7)
  • DPIA linkage Art. 26(9), Art. 27 (fundamental rights impact assessment)
  • Marking vis-à-vis natural persons Art. 50(3)

5. Sanctions Art. 99

  • Prohibited practices (Art. 5) → up to EUR 35 million / 7 %
  • Breach of obligations Art. 16/Art. 26 etc. → up to EUR 15 million / 3 %
  • False information → up to EUR 7.5 million / 1 %

Sources

Statute

Guidelines

  • European Commission, AI definition guidelines (February 2025)
  • European Commission, guidelines on the application of prohibitions pursuant to Art. 5 KI-VO
  • Annex III Use-Case Directory of the AI Act

Secondary Literature

  • Hilgendorf/Roth-Isigkeit, KI-VO, 1st ed. 2024
  • Spindler, in: Hofmann-Riem et al., Handbook of Digital Administration
  • BeckOK KI-VO (Online)

Output Format

HOCHRISIKO-KLASSIFIZIERUNG — <System-Bezeichnung> — <Datum>

I.    Rolle Mandant                 [Anbieter / Betreiber / Importeur / Händler]
II.   Anwendungsbereich Anhang III  [Nr. <X> / N/A]
      Begründung: <…>
III.  Sicherheitsbauteil Anhang I   [ja / nein]
IV.   Ausnahme Art. 6 Abs. 3        [a / b / c / d / nicht anwendbar]
      Profiling-Einschränkung: <…>
V.    Ergebnis                       [🟢 nicht hochrisiko / 🔴 HOCHRISIKO]
VI.   Folgepflichten (falls 🔴)
      - Risikomanagement Art. 9      …
      - Datengovernance Art. 10      …
      - …
VII.  Bußgeldrisiko Art. 99          [bis X Mio. EUR / Y %]

Empfehlung: <…>
Nächste Schritte: <…>

Risks / Typical Errors

  • Exception under Art. 6(3) misinterpreted — the exception applies only cumulatively with "no significant risk"; mere preparation is not sufficient.
  • Profiling overlooked — Art. 6(3) excludes profiling, in which case the exception never applies.
  • Role not clearly determined — provider/operator obligations differ fundamentally. Self-build = often provider AND operator.
  • Outdated applicability dates used — under the Digital Omnibus, the high-risk obligations apply only from 02.12.2027 (Annex III) or 02.08.2028 (Annex I). Clients still working toward 02.08.2026 are planning against repealed law; conversely, Art. 50 remains applicable unchanged as of 02.08.2026 and is often overlooked because of the high-risk postponement.
  • Postponement mistaken for all-clear — what has been postponed are the consequences of the obligations, not the classification. GPAI obligations (Art. 51–55) are not postponed and are subject to fines from 02.08.2026.
  • National competence incorrectly addressed — the market surveillance authority is the Federal Network Agency (residual competence, KI-MIG), not the data protection supervisory authority; for biometrics in law enforcement, the independent AI Market Surveillance Chamber. [unverifiziert - prüfen]
  • Interaction with the GDPR — Art. 27 of the AI Act requires a fundamental rights impact assessment in addition to the DPIA under Art. 35 GDPR.