High-risk AI becomes a regulated operating category in the European Union
From December, covered high-risk systems require documented risk management, data governance, logging, human oversight, and conformity processes; some…
ChatGPT · 2027 · likely
Prior state
AI tools are already used in hiring, admissions, fraud detection, identity, and public administration, but assurance practices are fragmented and many deployments depend on vendor claims.
Material change
From December, covered high-risk systems require documented risk management, data governance, logging, human oversight, and conformity processes; some vendors withdraw or narrow systems rather than certify them.
Why now
The December 2 application date for specified high-risk areas follows a 2026 political agreement that already moved product-embedded systems to 2028, concentrating the remaining institutional deadline in 2027.
Mechanism and resistance
Large buyers make conformity evidence a procurement condition, insurers and auditors translate the law into checklists, and regulators use centralized model oversight. Small vendors resist cost, employers seek exemptions, and incomplete standards create inconsistent enforcement.
Consequences
Workers, students, migrants, and applicants gain procedural rights and auditable records, though not freedom from automated judgment. Compliance advantages large vendors and public bodies with data teams. Some uses move to lower-risk decision-support framing.
End state
In the EU, high-risk AI is a legally distinct operating category with an assurance market and withdrawal risk, not merely a label in voluntary ethics policies.
Observable test
After December 2, providers or deployers of covered systems place conformity documentation and required registrations on file, and at least one national authority orders remediation, withdrawal, or suspension for a noncompliant high-risk use.
Disconfirming sign
The application date is legislatively postponed beyond 2027 or enforcement guidance exempts most employment, education, biometric, and migration deployments.