Legal requirement Technical documentation European Union Partially applicable

Providers must document and register a conclusion that an Annex III system is not high-risk

Download: JSON · MarkdownUnder EU AI Act, Article 6(4); Article 49(2)

Verified against the official source 26 Sep 2026

What this label means

Verified: — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review: — linked to the official source and in the queue for a reviewer to confirm.
Source-linked: — linked to the official source, not yet confirmed by a reviewer.

No change recorded as of 26 Sep 2026 · official source last checked 26 Sep 2026

Open official source Sign in to follow

Report a correction How we verify

On this page 9 sections

In brief

Providers must document and register a conclusion that an Annex III system is not high-risk is a legal requirement under the EU AI Act in the European Union (Article 6(4); Article 49(2)). It applies from 2 December 2027. The record carries 2 evidence examples and mappings to 2 frameworks.

Instrument: EU AI Act
Jurisdiction: European Union
Nature: Legal requirement
Source reference: Article 6(4); Article 49(2)
Applies from: 2 December 2027
Who it binds: Provider / developer
Evidence examples: 2
Framework mappings: ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
Controls that meet it: 2
Official source: Open official text
Verification: Verified against the official source 26 Sep 2026

What does it require?

A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority.

Practical action

Record a reasoned Article 6(3) assessment in the design file and register the system before launch rather than relying on an informal judgement.

Who does it apply to?

Providers of AI systems in an Annex III area that they judge not to be high-risk under Article 6(3); systems that profile natural persons are always high-risk.

Actors: Provider / developer
Sectors: Cross-sector / all sectors Employment and HR Financial services and credit Public services and government
Use cases: AI in hiring and employment AI in finance, credit and insurance AI in education AI in public services

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

satisfiesProcessAI governance lead · continuous
AI system inventory and classification
Serves 11 recorded duties · evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure

Classification with recorded rationale per system.
supportsProcessRegulatory compliance lead · once per ai system
Conformity assessment, declaration and registration
Serves 4 recorded duties · evidence: Declaration of conformity or certificate, Registration record in the relevant database, Conformity evidence pack

Registration under Article 49(2).

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

AI System Inventory
Register · XLSX and DOCX · v6
EU AI Act Role and Risk Classifier
Checklist · XLSX · v4
EU AI Act Article 50 Transparency Kit
Kit · DOCX and XLSX · v44
ISO/IEC 42001 Gap Assessment and Statement of Applicability
Assessment · XLSX · v3

All 10 templates that cover it →

What evidence would a reviewer expect?

Evidence examples
Evidence	Type	Notes
Article 6(3) classification assessment	record	Reasoned analysis of which condition applies, dated before market placement.
EU database registration entry	register

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Framework mappings table
Framework	Reference	Note	Confidence
ISO/IEC 42001:2023	Clause 6.1.2; Annex A.6.2.7	Risk-based classification recorded in the technical documentation.	medium
NIST AI RMF 1.0	MAP 1.5, MAP 3.1	Scoping and classification of the system's impact.	medium

Frequently asked questions

Is this a legal requirement?

Yes. It is a legal requirement under EU AI Act (Article 6(4); Article 49(2)).

Who must comply with this obligation?

Providers of AI systems in an Annex III area that they judge not to be high-risk under Article 6(3); systems that profile natural persons are always high-risk.

When does this obligation apply?

It applies from 2 December 2027.

What evidence shows compliance?

A reviewer would expect: Article 6(3) classification assessment; EU database registration entry.

Which frameworks map to this obligation?

It is mapped to ISO/IEC 42001:2023 Clause 6.1.2; Annex A.6.2.7, NIST AI Risk Management Framework 1.0 MAP 1.5, MAP 3.1. These are editorial crosswalks with a stated confidence, not official mappings.

Which controls satisfy this obligation?

AI system inventory and classification; Conformity assessment, declaration and registration.

What should an organisation do in practice?

Record a reasoned Article 6(3) assessment in the design file and register the system before launch rather than relying on an informal judgement.

Cite this record

AIPolicyTracker (2026). “Providers must document and register a conclusion that an Annex III system is not high-risk (EU AI Act)” [AIPT-OBL-0031, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0031 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0031: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

BibTeX

@misc{aipolicytracker2026_providersmustdocumentand,
  author       = {{AIPolicyTracker}},
  title        = {{Providers must document and register a conclusion that an Annex III system is not high-risk (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.

Similar obligations in other instruments

Draw up technical documentation before placing a high-risk system on the market — EU AI Act, European Union
Providers of GPAI models must maintain technical documentation and inform downstream providers — EU AI Act, European Union
Developers must document high-risk systems and disclose known risks — Colorado AI Act, Colorado (United States)
Developers must supply deployers with documentation of the technology — Colorado ADMT law (SB 26-189), Colorado (United States)

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.