On May 19, 2026 the European Commission published draft guidelines on classifying high-risk AI systems under Article 6 of the AI Act, originally due by February 2, 2026. The draft has three parts — general principles, Annex I (AI as a safety component of regulated products) and Annex III (the eight listed use-case areas, including credit scoring) — with practical examples the Commission says it will update over time. A targeted consultation ran to July 23, 2026 and final guidelines are expected by end-2026.
| Document | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act |
| Issued by | Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act |
| Type | Consultation |
| Status | Proposed · comment period closed |
| Published | May 19, 2026 |
| Comment deadline | Jul 23, 2026 |
| Applies to | Providers and deployers assessing whether an AI system is high-risk under Article 6 and Annexes I and III, including banks with credit-scoring and HR systems |
| Official source | digital-strategy.ec.europa.eu ↗ |
| Use cases | Credit scoring & underwriting · Model risk management · Fraud detection · AI governance (general) |
What are the key points of Draft Commission guidelines on high-risk classification?
- Intended purpose as documented by the provider is determinative for classification and must be described consistently across technical documentation, instructions and marketing.
- Building in human oversight or human-in-the-loop review does not take a system out of the high-risk category — oversight is a compliance requirement for high-risk systems, not a classification escape.
- Explains the Article 6(3) exemptions (narrow procedural tasks, improving prior human activity, detecting decision patterns, preparatory tasks) and the duty to document and register systems a provider considers exempt.
- Provides non-exhaustive worked examples for each Annex III area; the credit and insurance area (point 5) includes the fraud-detection carve-out.
- Non-binding, but sets the interpretation supervisors will apply when the Annex III regime starts on December 2, 2027.
- Final guidelines to be complemented later by guidance on the substantive high-risk requirements (Articles 8–15).
What did Draft Commission guidelines on high-risk classification change for banks?
The draft is the first official reading of the boundary that decides whether a bank's model triggers the full high-risk regime. It closes off the widely discussed argument that a human final decision or a 'decision-support' label avoids Annex III 5(b), and it fleshes out the Article 6(3) exemptions on which many analytics and pre-screening tools will rely.
Can a bank avoid high-risk classification by keeping a human in the loop?
No. The draft guidelines state that human oversight is a requirement for high-risk systems, not a factor that removes a system from the high-risk category; classification turns on intended purpose and the Annex III list.
When will the final high-risk classification guidelines be adopted?
The Commission has indicated final adoption by the end of 2026, after the consultation that closed July 23, 2026 — a year before the Annex III regime applies on December 2, 2027.
| Date | Document | Status |
|---|---|---|
| Jul 24, 2026 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) | In force |
| Nov 21, 2025 | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) | Final |
| Jul 10, 2025 | General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) | In force |
| Feb 4, 2025 | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) | In force |
| Jul 12, 2024 | Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) | In force |
| Oct 30, 2023 | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →