An AI system is high-risk under the AI Act (Tulafono Faatonutonu (EU) 2024 / 1689) if it is part of a product covered by the EU product legislation in Annex I, or if it is used in one of the areas listed in Annex III, such as recruitment, credit scoring or education. An Annex III system can fall outside the category if it poses no significant risk and does not materially influence decisions, but never if it profiles natural persons.
The heavy high-risk obligations do not apply yet. Under the Omnibus AI, on which EU negotiators reached agreement on 6 May 2026, they apply at the latest from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The ban on faiga fa'asaina o le AI in Article 5 has applied since 2 February 2025.
O afea e maualuga ai le lamatiaga o se faiga fa'a-AI?
There are two routes. The first covers AI that is part of, or a safety component of, a product under the EU legislation in Annex I, such as certain medical devices, machinery, lifts and toys; the AI Act builds on the existing conformity assessment for those products.
The second route covers AI used in the areas in Annex III: biometrics, critical infrastructure, education, employment and workforce management, access to essential private and public services, law enforcement, migration and border control, and the administration of justice and democratic processes. The area alone is not decisive: the specific function of the system counts.
When does an Annex III system fall outside the high-risk category?
When it poses no significant risk to health, safety or fundamental rights and does not materially influence the outcome of decisions. That may be the case if it only performs a narrow procedural task, improves the result of an activity already done by a person, detects deviations from earlier human decisions without replacing them, or does preparatory work.
A provider relying on this exception must document its assessment before placing the system on the market. A system that profiles natural persons is always high-risk. The Omnibus AI proposal would drop the registration duty for systems that providers consider not high-risk; the Dutch government objected to that change, so check the final text before relying on it.
Are you a provider or a deployer?
You are a provider if you develop an AI system, or place it on the market under your own name or trademark. You are a deployer (gebruiksverantwoordelijke) if you use a system in your business without having developed it.
These roles can shift. If you substantially modify a purchased system, change its intended purpose or supply it under your own name, you may become a provider and take on the heavier obligations. Record your role for each system.
What must providers of high-risk AI do?
Providers carry the heaviest set of obligations. Before placing a high-risk system on the market, they must have in place:
- a risk management system for the entire lifecycle;
- data governance, including checks for bias in training, validation and testing data;
- technical documentation and automatic event logging;
- clear instructions for use for deployers;
- a design that allows effective human oversight;
- appropriate accuracy, robustness and cybersecurity;
- a quality management system, a conformity assessment, an EU declaration of conformity, CE marking and registration in the EU database.
What must deployers of high-risk AI do?
Deployers must use the system according to the instructions, assign human oversight to competent staff, monitor its operation and report serious incidents and risks. They must keep the automatically generated logs for the minimum period the AI Act sets, and inform employees and other people affected in advance.
Public bodies, private parties providing public services and certain other deployers named in the AI Act, for instance in the financial sector, must also carry out a fundamental rights impact assessment before first use.
O le ā le taimi faatulagaina?
The AI Act entered into force on 1 August 2024 and applies in phases. The prohibited practices of Article 5 have applied since 2 February 2025, and the Omnibus AI does not change that date. Most other provisions, including the transparency duties for deepfakes and synthetic content, were set to apply from 2 August 2026.
The Commission proposed the Omnibus AI in November 2025. Its proposal linked the high-risk obligations to the availability of standards and support tools, with outer dates of 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, a delay of 16 and 12 months. Agreement in the trilogue followed on 6 May 2026. Plan your high-risk documentation against those outer dates and do not count on a further delay.
The Omnibus AI also adds a ban on AI systems that can generate child sexual abuse material or non-consensual nude images. The proposal also changed the AI literacy duty for organisations; check the final published text for the exact scope.
O ai e vaʻavaʻaia le Tulafono o le AI i Netherlands?
The Dutch implementing act is not yet in force, and the government expects it to take effect later than the AI Act requires. Under the government’s plan, ten market surveillance authorities each supervise their own domain, with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Dutch Authority for Digital Infrastructure (RDI) coordinating uniform application.
The AI Act sets maximum fines by category: the highest for prohibited practices, a lower one for other breaches, including high-risk obligations, and the lowest for giving incorrect or misleading information to authorities. Each category is linked to a fixed amount or a percentage of worldwide annual turnover, with a more lenient regime for SMEs and start-ups.
O a mea e tatau ona e siakiina i le avea ai ma se tautua?
- List every AI system you develop or sell under your own name, and classify it under Annex I or Annex III.
- Document any reliance on the no-significant-risk exception before placing the system on the market.
- Check whether the system profiles natural persons; if so, it is always high-risk.
- Set up risk management, data governance, technical documentation and logging.
- Prepare instructions for use that enable deployers to exercise human oversight.
- Plan the conformity assessment, CE marking and EU database registration before December 2027.
O a mea e tatau ona e siakiina i le avea ai ma se tagata fa'apipi'i?
- List every AI system you purchase or use, and the purpose for which you use it.
- Check whether you have become a provider by modifying the system or using it under your own name.
- Assign trained staff to human oversight and record who they are.
- Agree with your supplier on instructions, logs, incident reporting and audit rights.
- Inform employees and other people affected before you use a high-risk system.
- Check whether you must carry out a fundamental rights impact assessment.
What can we do for you with high-risk AI systems?
O lo tatou Loia IT help organisations prepare for the AI Act. For a broader overview, see our complete guide to the EU AI Act.
- We make an inventory of your AI systems and classify them under the AI Act.
- We assess whether you act as provider or deployer for each system.
- We document the assessment of the no-significant-risk exception.
- We review and draft contracts with AI suppliers on roles, information and audit rights.
- We set up AI governance and a fundamental rights impact assessment.
aotelega
- High-risk AI is AI in Annex I products or in Annex III areas such as recruitment and credit scoring.
- An Annex III system can fall outside the category if it poses no significant risk, but never if it profiles people.
- Providers carry the heaviest obligations; deployers must ensure oversight, monitoring and information.
- High-risk obligations apply at the latest from 2 December 2027 (Annex III) and 2 August 2028 (Annex I); prohibited practices have been banned since 2 February 2025.
- In the Netherlands, the AP and the RDI coordinate supervision once the implementing act is in force.
Soo fesili
O le ā le Tulafono o le AI?
The AI Act is Regulation (EU) 2024/1689, the EU regulation on artificial intelligence. It takes a risk-based approach: the higher the risk to health, safety and fundamental rights, the heavier the obligations. It applies directly in the Netherlands, without implementing legislation for the obligations themselves.
Can an Annex III system fall outside the high-risk category?
Yes, if it poses no significant risk and does not materially influence decisions, for example because it only performs a narrow procedural or preparatory task. The provider must document that assessment. If the system profiles natural persons, it is always high-risk.
Have the high-risk obligations been postponed?
Yes. Under the Omnibus AI, agreed by the EU negotiators on 6 May 2026, the high-risk obligations apply at the latest from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The ban on prohibited practices has applied since 2 February 2025 and was not postponed.
O ai e vaʻavaʻaia le Tulafono o le AI i Netherlands?
The Dutch implementing act is not yet in force. Under the government plan, ten market surveillance authorities supervise their own domains, and the Autoriteit Persoonsgegevens and the RDI coordinate uniform application.
O le ā e tatau ona fai e la'u fa'alapotopotoga i le taimi nei?
Make an inventory of all AI systems you develop, buy or use, record your role and the risk category for each, and check your supplier contracts. That classification work takes time and cannot easily be compressed before December 2027.
