Skip to content
NewOFAC Watcher checks your watchlist each day and emails you when a sanctions-list change looks like a possible match.See OFAC Watcher · USD 29 a month
Get the free snapshot
Covered
  • OFAC SDN list
  • UN sanctions list
  • EU sanctions list
  • Public on-chain data
  • MiCA
  • EU AI Act
  • GDPR
  • DORA
  • FinCEN BOI
  • VARA
  • SOC 2
  • AML / KYC
EU AI Act · Annex III high-risk from 2027-12-02 · Article 6 / Annex III

Classify your AI system before 2027-12-02.

Under Regulation (EU) 2026/1744, high-risk obligations for stand-alone Annex III systems apply from 2 December 2027, and for AI in Annex I regulated products from 2 August 2028. Article 50 transparency duties still apply from 2 August 2026. Misclassification can mean fines up to €35M or 7% of global turnover. Tell us how your system works; we'll classify it into minimal / limited / high / unacceptable, cite the specific Article 6 + Annex III provisions that govern, and produce a documentation checklist for your compliance file. Free preview classification, no card.

Six structured questions (yes/no)
Free preview classification. Decision-support intelligence — not a legal opinion.

Your description is sent to our AI provider (Anthropic) to produce the result. We store your email, description and result so we can follow up by hand if you ask. Nothing is emailed to you automatically. Privacy policy

— Beyond the preview

Full report or ongoing monitoring.

The free preview gives you the tier + the top-level Article references. A full one-time report (adding the conformity-assessment outline and Article 50 transparency-notice templates) and a monitoring tier (quarterly re-classification + alerts when a Commission Implementing Regulation affects your tier) are planned. Neither is on sale yet: join the waitlist below.

Not on sale yet: join the waitlist

We will email you once, when it opens. No other mail.

We keep your email only to tell you when this opens. Nothing is sent before then. Privacy policy.

FAQ

What is the EU AI Act?

Regulation (EU) 2024/1689, in force since 1 August 2024, establishes a risk-based framework for AI systems in the EU. It classifies AI into four tiers (unacceptable / high-risk / limited / minimal), imposes pre-market conformity assessment for high-risk systems, bans certain practices outright, and creates the EU AI Office as the central regulator. Fines reach €35M or 7% of global annual turnover, whichever is higher.

When do EU AI Act obligations actually apply?

Prohibited AI practices: 2 February 2025 (already applicable). General-purpose AI (GPAI) model obligations: 2 August 2025. Article 50 transparency obligations and most of the rest of the Act: 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744 (published in the Official Journal on 24 July 2026, in force since 27 July 2026), deferred the high-risk obligations: stand-alone Annex III systems (biometrics, education, employment, essential services, law enforcement, etc.) now apply from 2 December 2027 instead of 2 August 2026, and AI in products covered by Annex I product safety legislation from 2 August 2028 instead of 2 August 2027. If your system could fall under an Annex III category, classify it well before 2 December 2027.

What is Article 6 risk classification?

Article 6 defines the two-step test for "high-risk AI." Step 1: is the system a safety component of a product covered by Annex I legislation (medical devices, machinery, civil aviation, etc.)? Step 2: is the system listed in Annex III categories — biometric categorization, critical infrastructure, education, employment decisions, access to essential services, law enforcement, migration, or administration of justice? A yes to either step means high-risk obligations apply.

Does the EU AI Act apply to non-EU companies?

Yes. The EU AI Act applies extraterritorially to AI systems placed on the EU market or whose output is used in the EU, regardless of where the provider is established. A US startup with EU users, an EU-facing SaaS product, or a model accessed via API from the EU is within scope. The territorial logic mirrors GDPR's extra-EU application.

How is AI Act compliance different from GDPR compliance?

GDPR governs personal data processing. The AI Act governs AI system design and deployment regardless of whether personal data is processed. A model trained on public data that makes decisions affecting EU individuals still triggers AI Act obligations even if GDPR is not engaged. For AI systems processing personal data, both regimes apply simultaneously.

Curious about the rule itself? Read the EU AI Act Compliance Hub or browse the rest of the agent fleet.

Contact