附件 III 高风险人工智能系统：第 6 条分类指南
欧盟人工智能法案的第 6 条定义了两种高风险分类途径。本指南将引导您了解这两种途径、附件 III 的用例类别、第 6 条（3）的豁免以及自我评估流程图。
附件 III 高风险人工智能系统：第 6 条分类指南
欧盟人工智能法案的第 6 条定义了两种高风险分类途径。本指南将引导您了解这两种途径、附件 III 的用例类别、第 6 条（3）的豁免以及自我评估流程图。
上次更新: 2026年7月4日
是什么使人工智能系统成为高风险系统？
第 6 条创建了两种独立的途径。符合任何一种途径都会使您成为高风险系统——并触发完整的附件 IV 文档、第 9-15 条的控制措施和符合性评估义务。
这两种途径：第 6 条（1）涵盖了用作受监管产品中安全组件的人工智能。第 6 条（2）+ 附件 III涵盖了八个特定用例类别中的独立人工智能。
途径 1：安全组件（第 6 条（1））
如果您的 AI 是受欧盟行业立法（医疗设备、车辆、机械、电梯、玩具等）涵盖的产品的安全组件，或者本身就是此类产品，则它会自动被视为高风险。
必须由指定的机构进行符合性评估。
途径 2：附件 III 用例（第 6 条（2））
八个用例类别会触发高风险分类，而与底层技术无关：
- 生物识别：远程生物识别和情感识别系统
- 关键基础设施：人工智能在能源、水、天然气、供暖和数字基础设施中的应用
- 教育：人工智能用于学生评估、考试评分和学习分析
- 就业：简历筛选、面试分析、任务分配、绩效评估、解雇决策
- 基本服务：信用评分、贷款审批、保险定价、紧急服务调度
- 执法：风险评估、测谎仪、证据评估、画像
- 移民和庇护：签证申请、庇护处理、边境控制
- 司法：量刑辅助、案件结果预测、法律研究
第六条（3）款豁免
如果附件 III 中的人工智能系统不会对健康、安全或基本权利造成重大风险，则可以对其进行豁免。
已确定的案例包括狭窄的程序性任务、改进先前完成的人工活动的结果、检测决策模式而不取代人工评估，或为后续的人工决策准备任务。个人资料分析始终属于高风险。如果系统对自然人进行个人资料分析，则不得适用该豁免。
如果您声称符合豁免条件，请详细记录理由。监管机构可能会对该理由提出质疑。
如果属于高风险，则需要提供的文档
高风险人工智能系统必须维护全面的合规文档：
- 附件 IV 技术文档
- 第九条风险管理系统
- 第十条数据治理记录
- 第十二条生产环境中的日志记录
- 第十四条人工监督设计
- 符合性评估 + CE 标志
- 欧盟人工智能数据库注册
How AIAgentree helps
If your system is high-risk, AIAgentree produces the ongoing evidence that classification triggers:
- Article 12 automatic decision logging — tamper-evident, captured via SDK, MCP, A2A, or the OpenTelemetry bridge with no rewrite
- Article 14 human-oversight and approval workflows that record who overrode what, when, and why
- Audit-fit retention (at least six months) plus Annex IV-aligned exports for your technical file, with EU data residency (Germany)
Frequently Asked Questions
How do I know if my AI system is high-risk under Annex III?
Work through the two Article 6 pathways: (1) your system is a safety component of a product covered by the EU legislation in Annex I, or (2) it falls into one of the Annex III use cases (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). If either applies and no Article 6(3) exemption holds, it is high-risk.
What is the Article 6(3) exemption?
An Annex III system can avoid high-risk status if it does not pose a significant risk to health, safety, or fundamental rights — for example narrow procedural tasks or preparatory work for a human decision. Profiling of natural persons is always high-risk, and you must document your exemption reasoning because regulators can challenge it.
When do high-risk obligations start applying?
For stand-alone Annex III high-risk systems, full obligations apply from August 2, 2026. AI that is a safety component of products regulated under existing EU sectoral law reaches full applicability on August 2, 2027.
What happens once my system is classified high-risk?
You must implement Article 9 risk management, Article 10 data governance, Article 11/Annex IV technical documentation, Article 12 logging, Article 14 human oversight, complete a conformity assessment, affix CE marking, and register in the EU database. AIAgentree covers the logging, oversight, and audit-evidence portion of that stack.
Continue exploring the EU AI Act guide
EU AI Act Compliance Guide
The complete guide to EU AI Act compliance for AI agents — start here.
Article 12 — Record-Keeping & Logging
What every high-risk AI system must log, and how to capture it.
Article 14 — Human Oversight
Designing effective human-in-the-loop controls for AI decisions.
EU AI Act Compliance Checklist
A step-by-step checklist to reach and document compliance.
Compliance Cost Calculator
Estimate your EU AI Act compliance effort and cost.
Deadlines & Timeline
Key enforcement dates, including the August 2, 2026 deadline.
Fines & Penalties
Penalty tiers up to €35M or 7% of global annual turnover.
Transparency Obligations (Art. 13 & 50)
Disclosure duties for AI systems and their outputs.
Risk Management & Conformity Assessment
Build a risk management system and assess conformity.
GPAI Obligations
Rules for providers of general-purpose AI models.
EU AI Act for US Companies
Extraterritorial scope and what US providers must do.
Omnibus Update
The latest changes to the EU AI Act timeline and rules.
Penalty Calculator
Estimate your maximum fine under the Article 99 tiers.
Article 11 + Annex IV
What technical documentation the EU AI Act requires.
Article 26: Deployer Obligations
What deployers of high-risk AI must do, including log retention.
Article 17: Quality Management
The QMS providers of high-risk AI must document.
Article 10: Data Governance
Data quality, bias mitigation, and governance duties.
Article 4: AI Literacy
The staff AI-literacy duty in force since February 2025.
Deployer vs Provider
Who bears which obligation — and when a deployer becomes a provider.
FRIA (Article 27)
Who must run a Fundamental Rights Impact Assessment, and how.
Who Does It Apply To?
Scope, operators, and the extraterritorial reach of the EU AI Act.
Post-Market Monitoring
Articles 72–73: ongoing monitoring and incident reporting.
ISO 42001 vs EU AI Act
How the voluntary standard and the binding law fit together.
NIST AI RMF vs EU AI Act
A practical crosswalk between the framework and the law.
EU AI Act for Healthcare
High-risk medical AI, MDR/IVDR interplay, and clinician oversight.
EU AI Act for Financial Services
Credit scoring, insurance pricing, and existing financial regulation.
EU AI Act for HR & Employment
Hiring AI as high-risk, plus NYC LL144 and EEOC overlap.