The AI Act is the first EU regulation on artificial intelligence. It imposes specific duties on providers and users of AI systems, particularly systems classified as high-risk. Full application of the rules for high-risk systems is scheduled to begin in August 2026. Below is a practical explanation of what these systems are, who has duties, what consequences may follow and how to prepare.
Context: the AI Act and its implementation timeline
Artificial intelligence keeps surprising us. Only a few years ago it was seen as a technology experiment; today it is becoming an integral part of how most businesses operate. AI supports recruitment, analyzes client data, automates credit decisions and, in doing so, raises legitimate questions:
- Can these systems be used without limits?
- Who is responsible for their decisions?
- How can AI systems be made compliant with the rules?
The European Union responded by adopting the AI Act, the first regulation on the development, supply and use of AI. It entered into force in August 2024 and is being implemented in stages:
- February 2025: a ban on AI systems presenting unacceptable risks.
- August 2025: rules concerning general-purpose AI models.
- August 2026: full application of the rules, including duties concerning high-risk systems.
This means businesses have only a few months to fully adapt to the requirements.
Pay particular attention to high-risk systems. They are permitted, but subject to close oversight and a range of duties. Ignoring these rules may result not only in financial penalties of up to EUR 15 million, but also liability for infringing the fundamental rights of users or clients.
This article explains what the AI Act means by high-risk AI systems, who must meet particular duties and when, and how to prepare for requirements scheduled to apply in the coming months.
If you have questions after reading, our law firm is available to help. We have advised businesses on IT law for years.
What are high-risk AI systems?
The AI Act introduces a risk-based classification of AI systems. A risk-based approach differentiates rules according to the possible impact of an AI system on people’s health, safety and fundamental rights.
Four categories of AI systems under the AI Act
- Prohibited systems: AI that may pose a serious threat to people’s rights and safety, such as mass-surveillance technologies and certain forms of biometrics. The prohibition has applied since February 2025.
- High-risk systems: AI associated with greater risk that may be used if strict requirements are met. Examples appear below.
- Limited-risk systems: AI that may be subject to certain information duties but is not regulated as strictly as high-risk systems.
- Low-risk systems: AI that does not pose a significant threat and is not subject to detailed rules.
Areas in which high-risk systems are used
High-risk AI systems can particularly affect individuals’ lives or society. Examples include:
- Recruitment and employment: systems that assess employee skills, make recruitment decisions or monitor performance.
- Education: AI that assesses students’ skills, recommends educational paths or awards scholarships.
- Healthcare: systems that support diagnosis, predict treatment outcomes or make decisions about allocating medical resources.
- Critical infrastructure management: AI used in energy, water supply, public transport or power-grid management.
- Public services: systems that award social assistance or assess applications for benefits or services.
- Justice: tools used to analyze evidence, judgments or liability.
These areas involve risks from errors that may have serious consequences for people, such as unfairly rejecting a job application, making an incorrect medical diagnosis or wrongly assessing credit risk.
Compliance with the AI Act for high-risk systems is not a formality. It involves specific duties that must be met for a system to be placed into service and lawfully operate on the EU market. The rules will fully apply in August 2026, leaving little time to implement the necessary procedures.
Examples of high-risk AI systems
High-risk AI systems are not merely abstract technologies. They can affect people’s daily lives and businesses across industries. The AI Act focuses particularly on areas where AI may have a decisive effect on people’s lives or social groups.
The following examples illustrate how the rules may apply in practice.
1. Recruitment and personnel management
Many businesses use AI to screen job applicants, assess their skills and even predict future performance. AI recruitment systems can process many applications quickly, review CVs and assess candidates using data from different sources, such as LinkedIn, psychological tests and social media. These tools may also cause discrimination if their algorithms are not sufficiently differentiated or do not take full context into account. Poorly designed systems may unintentionally favor particular groups, for example based on sex, age or race, or rely on biases in the data.
Under the AI Act, these systems must be transparent, meaning users must know how they work and what data they rely on, and must be assessed for discrimination risk.
2. Credit scoring and financial-risk assessment
AI used to assess credit risk is one of the most common examples of a high-risk system. Banks and financial institutions in the EU increasingly use AI algorithms to assess clients’ creditworthiness. AI analyzes large datasets to predict whether a person is likely to repay a loan. These solutions can speed up decisions, but may also produce flawed assessments, especially if input data is poorly selected or contains errors. Incorrect decisions may lead to clients being unfairly rejected or offered worse credit terms, with serious financial consequences.
Under the AI Act, these systems must be assessed for fairness and transparency in decision-making, and people assessed by AI must have access to explanations of the decision.
3. Healthcare
AI is also widely used in disease diagnosis and treatment planning. Examples include systems that help doctors identify early signs of cancer, interpret medical test results such as MRI images, or predict treatment outcomes. These systems may save lives, but also pose a high risk of incorrect diagnoses, especially when data is incomplete or improperly processed. AI decisions may also raise questions about responsibility for incorrect results, particularly where systems do not work as intended or are outdated.
The AI Act places significant emphasis on monitoring system safety and transparency in decisions about patients’ health.
4. Critical infrastructure
AI systems are used to optimize management and monitor facilities important to the operation of the state and society, including power, water and transport networks. AI may predict failures, optimize energy use and respond to changes in infrastructure. If these systems malfunction, they may cause failures or interruptions to essential services, such as electricity or water supplies, with serious consequences for people’s health and lives.
These systems must meet strict safety standards, particularly for resilience to cyberattacks, and be monitored regularly to ensure they work properly.
These examples show how much high-risk AI systems can affect everyday life. They are used in many areas, and failures may have serious legal, financial and health consequences. The AI Act therefore sets requirements intended to make these systems responsible, safe and fair.
Duties of providers of high-risk AI systems
Developing, deploying and using high-risk AI systems involves many requirements intended to ensure their safety, transparency and legal compliance. The AI Act imposes particular duties on providers, meaning businesses that design, produce or deploy AI systems. These duties will fully apply in August 2026, so businesses should already be finalizing their preparations.
1. Risk-management system
Providers of high-risk AI systems must continuously manage risks arising from the system. This approach covers the system’s entire lifecycle, from design and development through testing to deployment and monitoring after it is placed on the market.
The AI Act risk-management process requires providers to:
- Identify and assess risks associated with the system, such as incorrect decisions, discrimination and privacy violations.
- Implement technical and organizational measures that reduce those risks to an acceptable level.
- Test and monitor the system regularly to detect potential problems and act preventively.
Providers must also develop oversight procedures to ensure the system does not operate in an uncontrolled or improper way.
2. Data management
Every AI system relies on data, so the AI Act emphasizes proper data management. Data must be reliable, lawful and free from bias. Providers must ensure that data used for machine learning:
- is processed in accordance with personal-data protection rules, including the GDPR,
- does not contain bias that could lead AI systems to make discriminatory decisions based on incorrect assumptions.
Providers must also minimize data collection to what is necessary. Pseudonymization and encryption are recommended to protect information and the privacy of data subjects.
3. Technical documentation and activity logging
The AI Act requires providers of high-risk systems to prepare detailed technical documentation about the system, including information about:
- the system’s functions,
- algorithm architecture,
- machine-learning methods used,
- testing and audit processes,
- remedial measures if risks are identified.
Providers must also ensure that all system activity is recorded in logs. Logs are necessary to:
- audit the system’s compliance with the AI Act,
- identify errors and establish accountability for AI decisions.
Logging is particularly important for systems that make decisions affecting individuals, such as recruitment, creditworthiness assessments and medical diagnoses.
4. Conformity assessment
Before placing a high-risk AI system on the market, providers must complete a formal conformity-assessment procedure to determine whether the system meets all AI Act requirements.
The assessment should include:
- Analysis of system risks.
- Tests and audits to check whether the system meets the adopted safety standards.
- Preparing an EU declaration of conformity confirming that the system meets legal requirements.
After the assessment, the provider should affix the CE marking to the system to indicate compliance with European legal standards.
5. Registration in the EU database
The AI Act requires providers of high-risk AI systems to register them in an EU database. The purpose is to:
- increase transparency in the AI market,
- allow supervisory authorities to monitor systems that may significantly affect people’s rights and safety.
Registration also makes it easier for the relevant authorities to carry out audits and inspections.
Providers therefore have many duties intended to support responsible and safe AI deployment. Meeting them is described as a way to prevent errors and protect users’ rights, especially where systems can affect people’s lives.
Duties of users of high-risk AI systems
The AI Act also imposes certain duties on users of high-risk systems, meaning people or organizations that use the technology. Although their responsibility is less extensive than providers’, they still have important requirements to meet for safe and lawful AI use.
1. Use in accordance with instructions
Users must operate high-risk systems in accordance with the documentation supplied by the provider. Following the provider’s instructions helps avoid errors that may create risks, such as improper decisions.
2. Human oversight
All high-risk AI systems must operate under human oversight. Users must be able to monitor AI decisions, particularly in areas that may significantly affect people, such as recruitment or credit assessment. Oversight should be provided by a suitably trained person.
3. Input-data quality
Users are responsible for the quality of the data they provide to the system. Data must be reliable and properly prepared so the AI can operate fairly and accurately. In particular, users should avoid data that may introduce bias or limit the system’s operation.
4. Responding to risk and logging events
If the system starts to operate improperly or produces incorrect results, users must stop it and inform the provider. They should also retain event logs so the problem can later be analyzed and its causes identified. Logs must be kept for at least 6 months.
Exceptions: when might an AI system not be considered high-risk?
Although the AI Act imposes specific requirements on high-risk systems, the AI Act provides exceptions that may release some systems from the full scope of the rules. They may apply to systems that initially appear to fall within the high-risk category.
When might an AI system not be considered high-risk?
A system operating in an area listed in Annex III may not be classified as high-risk if it:
- does not pose a significant risk to people’s health, safety or fundamental rights,
- does not profile individuals, meaning it does not analyze their characteristics, such as behavior or demographic data, to assign them a profile.
Examples of uses that may qualify for an exception
- Simple procedural systems, such as invoice-processing tools that do not make complex decisions about individuals.
- Pattern detection: systems that identify patterns in data but do not make decisions based on them.
- Human-support systems: AI that acts as an aid while the final decision remains with a person, such as recruitment recommendations.
Documentation when relying on an exception
Even if an exception may apply, the decision must be documented. Providers and users must prepare an assessment explaining why the system does not meet the high-risk criteria. Registration in the EU database may still be required, depending on the supervisory authorities’ decision.
Changes to Annex III of the AI Act
The European Commission may amend Annex III, which defines high-risk systems, as technology develops. New systems may be added, and existing systems may be removed or changed if they pose lower risks.
Understanding these exceptions may help assess whether a system is subject to the full AI Act requirements or may qualify for an exception, affecting how a business prepares for and implements the rules.
What may happen if a business does not comply with the AI Act?
The AI Act sets high standards for AI systems, particularly high-risk systems. Failure to comply may have serious legal and financial consequences, including penalties and civil or administrative liability.
Financial penalties
Providers and users of high-risk AI systems may face a financial penalty for an AI Act violation. The amount depends on the type of violation and the scale of the business.
- The maximum penalty for non-compliance may be as high as EUR 15 million or 3% of the company’s annual global turnover, whichever is higher.
- Additional penalties may apply in cases where an organization:
- has not assessed the conformity of the AI system,
- has ignored the system registration requirement in the EU database,
- has disregarded AI system transparency and openness requirements.
Administrative liability
In addition to financial penalties, organizations may face administrative consequences:
- A ban on operating in the EU market for AI systems that do not meet the AI Act requirements. This may include withdrawing products or prohibiting their further use.
- Suspension or cancellation of a system’s registration in the EU database, meaning it could no longer be lawfully offered or used in the EU.
Civil liability
A violation of the AI Act rules may also lead to civil liability toward people or organizations harmed by incorrect AI operation:
- Compensation for harm: if an AI system makes an incorrect decision with negative consequences, such as a wrong medical diagnosis or an unjustified rejection of a credit application, the business may have to pay compensation.
- Responsibility for incorrect decisions: businesses deploying high-risk AI may be responsible for the results if they failed to introduce appropriate oversight or risk management.
Reputational damage
Failure to comply may also damage a company’s reputation and affect:
- consumer and business-partner trust,
- risk relating to future investment and cooperation,
- eligibility for public tenders or access to EU markets.
Compliance with the AI Act is not only about avoiding penalties, but also about ensuring safe and responsible use of technology.
How does personal-data protection apply to high-risk AI systems?
Compliance with the GDPR is a separate, parallel requirement for high-risk AI systems, which often process particularly sensitive personal data. The AI Act and GDPR should be considered in parallel, especially when AI systems process individuals’ personal data, for example in recruitment or creditworthiness assessment. Under the GDPR, the controller is the entity that decides the purposes and means of processing, while the AI provider acts as a processor.
Data-processing principles for AI systems
Personal-data processing in high-risk AI systems must meet the following requirements:
- Data minimization: collect only information necessary for the specified purpose.
- Pseudonymization: process data so a person cannot be identified without access to additional information stored securely elsewhere.
- Data encryption, recommended as a privacy safeguard.
- Data-subject rights: every AI system processing personal data must enable access, rectification and erasure rights, including the so-called right to be forgotten, as described in this GDPR rights overview.
DPIAs and special categories of data
Providers must conduct a data protection impact assessment (DPIA), particularly where there is a high risk to people’s rights and freedoms. If an AI system processes special categories of personal data, such as health or biometric data, additional consent from the data subject and additional safeguards are required.
Information duties and consequences of breaches
The AI Act requires providers of high-risk AI systems to ensure transparency and inform users how their data is used. In the event of a personal-data breach, an organization must notify users and relevant supervisory authorities, including the Polish UODO, within 72 hours. Failure to meet GDPR requirements in an AI context may result in penalties of up to EUR 20 million or 4% of annual turnover, whichever is higher.
