AI Act Phase 4: high-risk obligations (Annex III)
What applies
From 2 December 2027, the full duties for high-risk AI under Annex III of the AI Act apply: risk management, data quality, technical documentation, human oversight, accuracy and robustness requirements. The Digital Omnibus Regulation pushed this date back from the originally planned schedule; for AI embedded in regulated products under Annex I, 2 August 2028 applies.
The postponement is preparation time, not an all-clear: high-risk status is reached faster than most people think. AI used in hiring, lending decisions, critical infrastructure, or education generally falls under it — even when the system is only purchased and “operated,” not built.
Who it affects
Providers and deployers of AI in sensitive use cases: HR and recruiting, lending, critical infrastructure, education, law enforcement.
Example (fictional): The recruiting tool already in use
A logistics company has used an AI tool to pre-screen driver applicants since 2024. The works council asks whether the system will meet the coming high-risk requirements — human oversight, logging, informing applicants.
The tool's provider is based outside the EU and answers evasively. Anyone who only starts this review shortly before the deadline will find themselves without an alternative — in the middle of a driver shortage. A documented deployer review today triggers a supplier switch while there's still time.
The risks, plainly stated
Fines
Violations of the high-risk duties carry fines of up to €15 million or 3% of worldwide annual turnover (Art. 99(4) AI Act). For SMEs and start-ups, the lower of the two figures applies (Art. 99(6) AI Act).
Shutdown of core operations
Non-aligned systems must, if in doubt, be taken offline — and take the process they automated down with them.
Employment-law exposure
Works councils and rejected applicants can demand information and oversight — every gap becomes an in-house precedent.
Your next steps
- 01Check every AI use case against Annex III: is any of it high-risk?
- 02For purchased systems, request conformity evidence from the provider
- 03Anchor human oversight and logging organisationally
In Compliverse
The compass turns exactly these steps into measures in your plan automatically — with deadlines, owners, and evidence.
Plain-language product content, not legal advice · Case studies are fictional · Fine amounts as stated in the legal act (“up to”)