BREAKING NEWS: EU publishes guidelines for High-Risk AI Systems TODAY The European Commission has just dropped its eagerly anticipated guidelines on high-risk AI system compliance. This comes just days after EU leaders reached a political agreement to delay the compliance date for high-risk AI systems to 2 December 2027. The guidelines published today are focused on the classification of high-risk AI systems. In particular, they support organisations in answering the following questions: ➡️ Is our AI system high-risk? ➡️ What are the general principles that make an AI system high-risk? ➡️ What is the 'filter' to exempt AI systems from being high-risk? ➡️ How can we demonstrate and document that our AI system is not high-risk (i.e., because it performs a narrow procedural task)? There is also a detailed breakdown of every type of high-risk AI system listed in Annex III. For each category, there is an overview of cross-cutting issues, as well as a deep-dive on every category and sub-category of high-risk AI system. This gets as granular as AI systems used in the context of road traffic management, evaluating learning outcomes, and evaluating credit scores. For each category and sub-category, tangible examples of high-risk AI systems are provided. This will make it much harder for organisations to claim that their AI system is not high-risk (if it is listed in the guidelines). These guidelines are vital, as they provide clarity on exactly what is and is not high-risk and how this will be determined by regulators and courts over time. However, the new guidelines are also 167 pages long! No one said understanding the EU AI Act was easy. These are draft guidelines that are open for comment. My book, Fundamentals of AI Governance, features a dedicated and up-to-date chapter on the EU AI Act. Pre-order it today in advance of the September release. I can promise that it will be more visually pleasing than any official guidance could ever dream of!
Check out the draft guidelines here: https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
Manahil A.
1w
What I find most valuable in these new EU AI Act guidelines is the level of practical clarity now being provided around “high-risk” AI classification. The detailed Annex III examples will make it significantly harder for organizations to underestimate their regulatory exposure or loosely interpret compliance obligations. This is another strong signal that AI governance is rapidly moving toward measurable accountability, documentation, and structured control environments, making frameworks like ISO/IEC 42001 increasingly relevant for organizations adopting AI at scale.
Daniel Alon
1w
We’re moving toward a world where AI systems won’t just generate recommendations. they’ll initiate actions. That shift changes the core question from: “What can the model do?” to: “Who authorizes execution?” Runtime authority may become one of the defining infrastructure layers of the agentic era.
What stands out to me is that the harder problem is no longer simply classifying AI systems as high-risk. The real challenge is operational. Specifically answering the below: 1. Can organizations continuously validate AI systems in production?2. Can they monitor drift, identity, telemetry, resilience, and control effectiveness in real time?3. Can they produce defensible evidence without relying on heavily manual governance processes?
This is where AI governance stops being theoretical and starts becoming operational. The important part is not just whether a system ends up classified as high-risk. It is whether the organisation can demonstrate how that classification decision was made, what assumptions were used, what evidence supports it, and where the boundaries of the system's intended purpose actually sit. "Not high-risk" will still need to be shown, not just asserted. That requires documentation, audit trails and a clear account of what the system does and does not do, which most teams have not built yet. The more guidance gets published, the less defensible "we were not sure if this applied to us" becomes. Classification is just the starting point. The evidence trail behind it is the real work.
One of the most difficult issues in AI governance is often not the technical definition itself, but the organizational interpretation and documentation burden that follows. These guidelines seem likely to significantly affect internal risk classification, auditability, and defensibility discussions within organizations. Especially interesting is how the guidelines appear to narrow the room for organizations to argue that systems fall outside Annex III classifications. It will be fascinating to see how companies operationalize these interpretations internally — particularly across legal, compliance, governance, engineering, and business teams.
Hans Alberts
1w
Oliver Patel, AIGP, CIPP/E, MSc this is an important step, but it also shows where the real struggle now lies: classification. The key issue is no longer whether providers describe a system as “informational” or “supportive,” but whether its practical function shapes interpretation and decision-making in ways the AI Act cannot ignore. The draft guidelines are especially significant because they narrow the Article 6(3) filter, stress that human involvement does not by itself remove high-risk status, and warn against circumvention through system design or contractual framing. In healthcare, that pushes a central question into view: when does a system that helps users interpret symptoms, test results and next steps cease to be merely preparatory and begin to exercise quasi-clinical influence? That is precisely where the gap between formal description and substantive medical function becomes legally visible. If this boundary is drawn too loosely, private platforms may acquire practical authority long before equivalent duties of accountability, review and public supervision are attached.
These guidelines add important legal clarity. But they also expose something a lot of organizations are only now starting to run into in practice: it’s much easier to classify AI systems than to rethink how people actually work with them day to day. The real challenge probably isn’t whether a system is correctly labelled as “high-risk”. It’s whether teams can still organize real oversight, responsibility and trust once AI quietly becomes part of everyday choices and routines. And honestly, I suspect that part is going to be far more chaotic than most policy discussions make it sound.I just ordered your book. Looking forward to read it.
Pre-order my book today: aigovernancebook.com