Providers must document and register a conclusion that an Annex III system is not high-risk
Context fileUnder EU AI Act, Article 6(4); Article 49(2)
What does it require?
A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority.
Practical action
Record a reasoned Article 6(3) assessment in the design file and register the system before launch rather than relying on an informal judgement.
Who does it apply to?
Providers of AI systems in an Annex III area that they judge not to be high-risk under Article 6(3); systems that profile natural persons are always high-risk.
- Actors
- Provider / developer
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessAI governance lead · continuousAI system inventory and classification
Serves 11 recorded duties · evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure
Classification with recorded rationale per system.
-
supportsProcessRegulatory compliance lead · once per ai systemConformity assessment, declaration and registration
Serves 4 recorded duties · evidence: Declaration of conformity or certificate, Registration record in the relevant database, Conformity evidence pack
Registration under Article 49(2).
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Article 6(3) classification assessment | record | Reasoned analysis of which condition applies, dated before market placement. |
| EU database registration entry | register |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Clause 6.1.2; Annex A.6.2.7 | Risk-based classification recorded in the technical documentation. | medium |
| NIST AI RMF 1.0 | MAP 1.5, MAP 3.1 | Scoping and classification of the system's impact. | medium |
Cite this record
AIPolicyTracker (2026). “Providers must document and register a conclusion that an Annex III system is not high-risk (EU AI Act)”. https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation (accessed 24 September 2026). Data licensed CC BY 4.0.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
Similar obligations in other instruments
- Draw up technical documentation before placing a high-risk system on the market — EU AI Act, European Union
- Providers of GPAI models must maintain technical documentation and inform downstream providers — EU AI Act, European Union
- Developers must document high-risk systems and disclose known risks — Colorado AI Act, Colorado (United States)
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.