Consolidated Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, is binding law. Article 6(3) is a narrow derogation for an AI system referred to in Annex III; the Article 6(2)/Annex III route applies from 2 December 2027. Draft Commission guidance published on 19 May 2026 provides non-exhaustive examples but remains draft and non-binding. A provider relying on Article 6(3) must document the Article 6(4) assessment before placing the system on the market or putting it into service and meet Article 49(2) registration. A deployer may retain and challenge provider evidence, but its internal note does not replace the provider record.
Apply the cumulative Article 6(3) conditions.
A provider can rely on Article 6(3) only for a system referred to in Annex III that does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing decision-making, and that satisfies at least one statutory task condition. No single score or task answer completes that assessment.
Annex III precondition
Identify the relevant Annex III intended-purpose route first. Profiling blocks Article 6(3) only for an AI system referred to in Annex III; it does not independently place every profiling system in Annex III.
Significant risk and influence
Assess the complete workflow for significant risk of harm to health, safety or fundamental rights, including material influence on decision-making. A “no” answer in this tool is necessary but not sufficient.
One statutory task condition
Keep the four routes separate: narrow procedural task; improvement of a previously completed human activity; pattern or deviation detection that does not replace or influence the completed human assessment and receives proper human review; or a preparatory task to an Annex III assessment.
Build the Article 6(3) filter decision record.
Use this subordinate tool only after an Annex III route has been identified or is being assessed. It cannot complete the wider significant-risk assessment. Use redacted facts and do not enter personal data, trade secrets, employee records, patient data, privileged legal advice, production credentials, or client-confidential information.
Use the result in the right sequence.
If the record confirms or cannot exclude high-risk status, continue to the High-Risk Deployer Guide.
Article 6(3) filter questions
These answers are designed for working records and vendor review, not final legal determinations.
No. It records an operational Article 6(3) derogation review, not a legal exemption or non-high-risk determination. A provider relying on Article 6(3) must complete the Article 6(4) assessment and Article 49(2) registration; a deployer may retain and challenge provider evidence but its internal note does not replace that provider record.
Use it only after an Annex III intended-purpose route has been identified or is being assessed. Article 6(3) is a narrow derogation from that route: the system must not pose a significant risk of harm, including by not materially influencing decision-making, and at least one of the four statutory task conditions must apply.
For an AI system referred to in Annex III, yes: if it performs profiling of natural persons, it is always considered high-risk and Article 6(3) cannot be relied upon. Profiling does not by itself place a system outside Annex III into Annex III, and ordinary personal-data processing is not automatically profiling.
Providers should retain the Article 6(4) assessment completed before placing the system on the market or putting it into service, intended purpose, Annex III area, task rationale, profiling and significant-risk analysis, evidence reviewed, reviewer and date, plus Article 49(2) registration evidence. Deployers should retain the actual-use record, provider evidence request and response, and any inconsistency or changed-use escalation.
Use the High-Risk Classification Router first when Annex III status is not established. This page is a subordinate record-building step for an indicated Annex III route; it does not assess systems outside Annex III or replace the router's separate Annex I review. The Article 6(2)/Annex III route applies from 2 December 2027.
This tool is designed to run the assessment logic in your browser. Do not enter confidential, personal, client-sensitive, privileged, trade-secret, employee, patient, credential, or production data. Use working names, internal IDs, or redacted summaries for internal review.
Source basis: Binding law: consolidated Regulation (EU) 2024/1689, Articles 6(2) to 6(4), 49(2) and 113, as amended by Regulation (EU) 2026/1744. Draft, non-binding guidance: Commission draft high-risk classification guidelines, published 19 May 2026 and updated 23 July 2026. Draft examples are non-exhaustive and are not encoded here as binding rules. Last reviewed: 4 September 2026. Use qualified legal, privacy, security, or sector counsel for final decisions.