Article 6(3) allows an Annex III system to be treated as not high-risk only where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making, and where it performs a specified narrow task, such as a narrow procedural task, improving a previously completed human activity, detecting patterns without replacing human assessment, or performing a preparatory task. The route is unavailable where the system performs profiling of natural persons: such a system is always high-risk. A provider relying on the route must document the assessment before market placement, register the system under Article 49(2), and produce the documentation on request. In sector uses, profiling is often the decisive question, and it must be addressed directly in the classification record.
What are the narrow tasks in Article 6(3)?
Article 6(3) describes four kinds of narrow task that can support a conclusion that an Annex III system is not high-risk, where the significant-risk test is also met. The first is a narrow procedural task, such as converting data from one format to another or carrying out a routine administrative step without influencing a decision. The second is improving the result of a previously completed human activity, such as checking or refining work a person has already done, without replacing the person's assessment. The third is detecting decision-making patterns or deviations from prior patterns, without replacing or influencing human assessment and without proper human review. The fourth is performing a preparatory task, such as organising material for a later human decision. Each task must be tested on the system's actual function: a system described as preparatory that in fact scores candidates, or a system described as improving human work that in fact determines the outcome, does not fall within the task it claims. The record should quote the task relied on and show, from the system's operation, why it fits.
What is profiling, and why does it bar the route?
Profiling is defined in data protection law, which the AI Act draws on, as automated processing of personal data to evaluate personal aspects of a natural person, in particular to analyse or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In the AI Act, profiling is the hard limit on Article 6(3): an Annex III system that performs profiling is always considered high-risk, whatever narrow task it also performs. A sector system that scores, ranks, categorises or evaluates a person on the basis of personal data will often involve profiling, and the classification record should address the question head-on, citing the system's data, inferences and outputs. A provider that avoids the word profiling while describing a system that evaluates personal aspects has not avoided the bar: the function, not the label, decides. Where profiling is present, the high-risk framework applies, and the provider should plan conformity, documentation and oversight work on that basis.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
How does the route differ across sectors?
The Article 6(3) test is the same in every sector, but its application differs because the functions differ. In healthcare, a system that only formats clinical data for a clinician's later assessment may raise a narrow-task question, while a system that evaluates a patient's condition or recommends a treatment will not. In employment, a system that only schedules interviews may raise a narrow-task question, while a system that filters applications or evaluates candidates will involve profiling and decision influence. In education, a system that only organises learning material may raise a narrow-task question, while a system that evaluates outcomes or determines a level will not. In biometrics, a system that only verifies identity on a one-to-one basis is outside the Annex III identification listing altogether, while a system that categorises or identifies on a one-to-many basis is within it. Each sector example shows the same discipline: describe the function, test the task, test the risk and test profiling, in that order, and record each step.
What must be documented and registered?
A provider relying on Article 6(3) must document the assessment before placing the system on the market or putting it into service, and must provide the documentation to the national competent authority on request. The documentation should record the Annex III category, the narrow task, why the system does not pose a significant risk of harm, why it does not materially influence decision-making, why the profiling bar does not apply, and the evidence examined, including the system's function and the human review arrangements. The provider or authorised representative must also register the system under Article 49(2), using the amended Annex VIII information for this category following Regulation (EU) 2026/1744. The deployer should obtain the provider's reasoning, or at least a clear statement of the conclusion and its basis, before relying on a non-high-risk classification for its own deployment. A classification that cannot be explained from the documentation should not be relied on by either party.
What happens when the function changes?
A function change can remove a system from the Article 6(3) route. A system that began as a narrow procedural tool and later gains a scoring, ranking or evaluation function, a system whose output begins to influence decisions it previously only prepared, or a system that begins to profile where it previously did not, must be reassessed before the change is released. The reassessment should test the new function against the narrow tasks, the significant-risk test and the profiling bar, and should update the classification, the documentation, the registration and the deployer information together. The provider should communicate the change to deployers in advance, with the new classification position and the action deployers should take, and the deployer should record whether it accepts the change and what retraining or process change follows. A change log that records only the software version, without the classification consequence, does not show that the route was reconsidered.
Continue with registration after an Article 6(3) conclusion.
What does this guide not decide?
This guide does not decide whether any sector system qualifies under Article 6(3), whether it performs profiling, or whether it poses a significant risk of harm. Those questions require the system's actual function, the Annex III wording, the Article 6(3) conditions and the profiling definition to be applied together, with qualified advice where the function is close to a listed use or to profiling. The guide also does not reproduce the full Article 6(3) text, which should be checked in the consolidated Regulation. Where a provider intends to rely on Article 6(3) for a sector system, confirm the classification and registration position with a competent authority or legal adviser before market placement, and keep the assessment documentation with the system's compliance record.
Frequently asked questions
Can a system that profiles people use Article 6(3)?
No. An Annex III system that performs profiling of natural persons is always considered high-risk, and the Article 6(3) route is not available for it, whatever narrow task it also performs.
Is a narrow procedural task enough on its own?
No. The system must also not pose a significant risk of harm, including by not materially influencing the outcome of decision-making, and the task must actually be the function performed. Both tests must be met and documented.
Must an Article 6(3) system still be registered?
Yes. The provider or authorised representative must register the system under Article 49(2), and must document the assessment before market placement and produce it to the national competent authority on request.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗