Topic starter
18/08/2026 2:11 pm
TL;DR: Determining whether an AI system is high-risk under the EU AI Act requires assessing Annex III use cases, harmonised product legislation, transparency duties, and extra obligations for general-purpose AI models integrated into high-risk systems, according to Holistic AI. The practical issue is governance readiness: inventory, classification, documentation, oversight, and cybersecurity now determine compliance exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “Identify High-Risk AI Systems Under the EU AI Act”.
Key questions
A: The main failure is legal and governance failure, not just technical noncompliance.
Q: When should organisations treat a GPAI model as part of a high-risk system?
A: They should do so when the model is integrated into a broader AI system whose use case or deployment context places it in the high-risk category.
Q: What are the signs that an AI inventory is too weak for EU AI Act readiness?
A: Common signs include missing use-case descriptions, unclear ownership, no record of whether Annex III applies, and no documented exception analysis for borderline systems.
Practitioner guidance
- Map every AI use case to its legal classification Record whether the system is prohibited, falls under Annex III, is covered by harmonised product legislation, or uses a GPAI model inside a broader system.
- Document the high-risk exception test For borderline use cases, capture why the system performs only a narrow procedural task, supports rather than replaces human assessment, or otherwise falls outside high-risk status.
- Separate model governance from system governance Track the GPAI model, the integration layer, the user interface, and the feedback mechanisms as distinct control objects so that high-risk obligations are not lost at integration time.
Bottom line: The main governance issue is not just what the model does, but whether the system falls into a high-risk category that triggers specific obligations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:03 pm
Classification, not deployment, is the first governance failure mode: many AI programmes focus on model quality and user experience, but the EU AI Act starts by asking what the system does and where it is used. If the inventory is incomplete or the use case is under-described, the organisation can miss a high-risk classification entirely. That makes intake governance the decisive control point, and practitioners should treat system classification as a documented compliance gate.
A question worth separating out:
Q: Which teams should own EU AI Act high-risk compliance decisions?
A: Ownership should be shared across AI governance, legal, security, privacy, product, and operational teams, with a named decision owner for each system. The reason is simple: classification, documentation, oversight, and cybersecurity are connected obligations, so no single function can evidence readiness alone.
👉 Read our full editorial: High-risk AI systems under the EU AI Act demand stronger governance