What does Draft Commission guidelines on high-risk classification say about AI in banking?

What are the key points of Draft Commission guidelines on high-risk classification?

• Intended purpose as documented by the provider is determinative for classification and must be described consistently across technical documentation, instructions and marketing.
• Building in human oversight or human-in-the-loop review does not take a system out of the high-risk category — oversight is a compliance requirement for high-risk systems, not a classification escape.
• Explains the Article 6(3) exemptions (narrow procedural tasks, improving prior human activity, detecting decision patterns, preparatory tasks) and the duty to document and register systems a provider considers exempt.
• Provides non-exhaustive worked examples for each Annex III area; the credit and insurance area (point 5) includes the fraud-detection carve-out.
• Non-binding, but sets the interpretation supervisors will apply when the Annex III regime starts on December 2, 2027.
• Final guidelines to be complemented later by guidance on the substantive high-risk requirements (Articles 8–15).

What did Draft Commission guidelines on high-risk classification change for banks?

The draft is the first official reading of the boundary that decides whether a bank's model triggers the full high-risk regime. It closes off the widely discussed argument that a human final decision or a 'decision-support' label avoids Annex III 5(b), and it fleshes out the Article 6(3) exemptions on which many analytics and pre-screening tools will rely.