EU AI Act High-Risk AI Systems: What Businesses Need to Do Before December 2027

The EU AI Act high-risk compliance deadline is now 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products under Annex I. If your organisation builds, deploys, or distributes AI systems that fall under Annex III, the obligations themselves are unchanged and the penalties still reach €35M or 7% of global turnover. This article explains what high-risk means, who is affected, and what needs to happen before the deadline.

What makes an AI system high-risk

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) classifies AI systems into four risk tiers: unacceptable, high-risk, limited risk, and minimal risk. The vast majority of commercial AI systems fall into either high-risk or minimal risk. The distinction matters because high-risk systems face mandatory compliance obligations, including technical documentation, risk management systems, conformity assessments, and EU database registration, while minimal risk systems face only transparency requirements.

Annex III of the Act defines the categories of high-risk AI systems. These include AI used in biometric identification and categorisation of natural persons, management and operation of critical infrastructure, education and vocational training (including exam scoring and admissions), employment and worker management (including CV screening, interview evaluation, and promotion decisions), access to essential private services and public services (including credit scoring, insurance pricing, and benefits eligibility), law enforcement, migration and border control, and administration of justice.

The practical implication: if your organisation uses AI for hiring decisions, credit assessments, insurance underwriting, patient triage, student evaluation, or infrastructure monitoring, you are almost certainly operating a high-risk system. The same applies if you build or sell AI tools used by others for these purposes, because the Act applies to providers (who build), deployers (who use), importers, and distributors.

Provider vs Deployer: both have obligations

One of the most common misunderstandings is that compliance is only the provider's problem. It is not. The EU AI Act assigns distinct obligations to both providers and deployers, and many organisations are both simultaneously, using AI systems built by others while also building internal tools that qualify as AI systems under the Act's broad definition.

Providers must implement a risk management system (Article 9), ensure data governance for training data (Article 10), maintain technical documentation to Annex IV specifications (Article 11), design for transparency (Article 13), enable human oversight (Article 14), ensure accuracy and robustness (Article 15), operate a quality management system (Article 17), complete conformity assessment (Article 43), and register the system in the EU database (Article 49).

Deployers must implement appropriate technical and organisational measures, use the system in accordance with its instructions for use, ensure human oversight, monitor the system's performance, report serious incidents, and conduct a fundamental rights impact assessment for certain high-risk use cases. Deployers who substantially modify a provider's system may become providers themselves under Article 25.

The 9-step compliance framework

Compliance with the EU AI Act for high-risk systems is not a single action. It is a structured programme covering nine distinct areas, each mapped to specific articles in the regulation.

Step 1: Classification. Determine whether each AI system is high-risk under Annex III. Document the classification with evidence, rationale, and a named owner. This is the foundation, and everything else depends on getting it right.

Step 2: Risk Management (Article 9). Implement a continuous lifecycle risk management system, not a one-time risk assessment. This includes risk identification, analysis, evaluation, and mitigation, with a quarterly review cadence at minimum.

Step 3: Data Governance (Article 10). Training, validation, and test datasets must be fit for purpose, traceable, and free from material bias. This is where GDPR and the AI Act intersect most directly, because data used to train AI systems that process personal data must comply with both frameworks.

Step 4: Technical Documentation (Article 11). Annex IV specifies the required structure and content. This is the primary evidence file for regulatory scrutiny, and it must describe the system's intended purpose, design choices, training methodology, performance metrics, and known limitations.

Step 5: Human Oversight (Article 14). Systems must be designed so that humans can effectively monitor, interpret, and intervene in the system's operation. This is not just a design requirement, because it also requires documented procedures, trained personnel, and override capabilities.

Step 6: Transparency (Article 13). Deployers must receive sufficient information to understand the system's capabilities, limitations, and intended use. Instructions for use must be clear, comprehensive, and accessible.

Step 7: Accuracy and Robustness (Article 15). Systems must perform consistently under expected conditions and be resilient against adversarial manipulation and cybersecurity threats. Performance must be measurable and documented.

Step 8: Quality Management (Article 17). Providers must operate a documented quality management system covering the full AI product lifecycle, from design and development through testing, deployment, monitoring, and decommissioning. This is not a one-time checkbox.

Step 9: Conformity Assessment and Registration (Articles 43, 49). Complete the conformity assessment procedure, sign the EU declaration of conformity, affix the CE marking, and register the system in the EU database. This must happen before the system is placed on the market or put into service.

Why AI alone cannot get you compliant

AI tools can draft risk management policies, generate technical documentation templates, and produce data governance frameworks. The output is typically 70–80% of what is needed. The remaining 20–30%, meaning the interpretation, the judgement, the context-specific adaptation, and the accountability, is where AI falls short.

When the AI Office or a national competent authority reviews your conformity documentation, they are not checking whether the document exists. They are checking whether it is accurate, complete, and reflects your actual system. An AI-generated risk assessment that lists generic risks without addressing your specific deployment context will not survive scrutiny, and a technical documentation package that follows the Annex IV structure but contains vague descriptions instead of precise specifications will be challenged.

More fundamentally, someone must sign the declaration of conformity. Someone must be the named contact for the national competent authority. Someone must take accountability for the programme's integrity. That someone cannot be a chatbot.

The Morclear approach

Morclear uses AI to deliver compliance faster and more affordably than traditional consultancy. We then layer expert regulatory oversight on top so the output is defensible, and we manage it continuously so your compliance programme evolves alongside regulations and your organisation.

A CORA™ (Compliance Operations & Risk Automation) Gap Assessment (€999, two weeks) maps your obligations, classifies your systems, scores your current maturity, and produces a prioritised remediation roadmap. From there, CORA™ Implementation builds the full programme of policies, documentation, controls, and procedures in 8–12 weeks. CORA™ Ongoing then manages the programme continuously, monitoring for regulatory changes, updating documentation, detecting drift, and reporting compliance status to the board.

The timeline moved. The work did not.

2 December 2027 is now a fixed calendar date in law rather than a conditional one. The Commission's November 2025 proposal had tied the deferral to a later assessment that harmonised standards and support tools were ready, which would have left the date open, and the adopted text removed that condition. There is no grace period beyond it, no phased enforcement, and no self-certification route for high-risk systems that require third-party conformity assessment.

The date that did not move is 2 August 2026. From then the Article 50 transparency obligations apply, meaning telling people when they are interacting with an AI system, marking synthetic audio, image, video and text in machine-readable form, disclosing deepfakes, and disclosing AI-generated text published to inform the public on matters of public interest. Those duties are not limited to high-risk systems, and from the same date the Commission and national market surveillance authorities gain the power to fine for breaches of them, so most organisations reading this are in scope of the near date even where the high-risk date sits sixteen months further out. A narrow transition to 2 December 2026 applies only to the Article 50(2) marking obligation for generative systems already placed on the market before 2 August 2026.

A gap assessment takes two weeks and full implementation takes 8–12 weeks. The deferral buys planning room rather than a pause, and the organisations in the strongest position in December 2027 will be the ones that spent the extra time on conformity assessment, technical documentation and human oversight design rather than standing the programme down. Notified body capacity for Annex III systems is finite and the queue does not get shorter by waiting.

The free AI Act assessment tool takes 10 minutes. It costs nothing, requires no commitment, and gives you a scored report showing exactly where your obligations sit and which of the two dates you are facing. If you have not yet classified your AI systems under the Act, that is the place to start.

Morclear resources are independently produced. They do not constitute legal, regulatory, financial, or professional advice.