High-Risk AI System
Definition
An AI system classified under Annex III of the EU AI Act as requiring mandatory technical documentation, risk management, human oversight, transparency, and post-market monitoring before deployment in the EU. Biometric identification and categorisation systems are included.
- Source
- EU AI Act, Annex III
- Pre-deployment requirements
- Technical documentation, risk management, human oversight
- Ongoing requirement
- Post-market monitoring
- Includes
- Biometric identification and categorisation systems
Common questions
What does classifying a biometric system as high-risk change in practice for its developer?+
It shifts the system from general obligations into a mandatory compliance package before it can go to market: a documented risk management process, a conformity assessment, human oversight mechanisms built into the deployment, and continued monitoring once it is in use, rather than a one-time approval.
Are all biometric identification systems automatically high-risk under the EU AI Act?+
Most biometric identification and categorisation uses fall under Annex III and are treated as high-risk, though the Act also separately restricts or bans certain real-time remote biometric identification uses outright, so a given deployment can face rules beyond the standard high-risk package.
Related terms
- BIPA
- Illinois Biometric Information Privacy Act (740 ILCS 14, 2008). Requires informed written consent before collecting biometric identifiers and prohibits their sale. The...
- Clearview AI
- New York company that built a face-recognition database of approximately 30 billion images scraped from public websites without consent; subject to BIPA...
- Conformity Assessment
- The process by which a provider of a high-risk AI system (such as a face recognition database for law enforcement) demonstrates compliance...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- EU AI Act 2024
- Regulation (EU) 2024/1689, the first comprehensive AI regulatory framework, which prohibits real-time biometric identification in publicly accessible spaces with three narrow exceptions,...
- Law Enforcement Directive (LED)
- EU Directive 2016/680, which governs the processing of personal data by competent authorities for the purposes of prevention, investigation, prosecution and execution...
- PACE S.78
- Section 78 of the Police and Criminal Evidence Act 1984 (England and Wales), which gives courts discretion to exclude prosecution evidence if...
- Purpose-Limitation
- The data protection principle prohibiting processing of personal (including biometric) data for any purpose other than the one for which it was...
- Puttaswamy V. Union of India
- The Supreme Court of India's 2017 nine-judge bench decision recognising the right to privacy as a fundamental right under Article 21 of...