EU AI Act Risk Assessment Template (Article 6 & Annex III)

Document 14 of the RegShelf kit is a step-by-step classification assessment, completed once per AI system before it is placed on the market or put into service: describe the system and its intended purpose, confirm it passes the prohibited practices check, screen it against the eight Annex III areas, and — only if an area matches — run the Article 6(3) derogation test. The intended purpose you record in Section 1 anchors the whole assessment: you classify the system as it will actually be marketed or used, not as it might be used in theory. The completed record is your Article 6(4) documentation, which a market surveillance authority may request.

Providers, before placing any system on the market — and deployers, because your duties from 2 December 2027 depend on whether the tools you use are high-risk (the template's worked example is a deployer classifying a vendor CV-screening tool). The Annex III areas that most often catch SMEs are employment (recruiting and worker management), education, creditworthiness and essential services, and biometrics. If your system is instead a safety component of a regulated product, it follows the separate Annex I track under Article 6(1) — noting two Digital Omnibus changes: the safety-component definition (Article 3(14)) is narrowed to functions whose intended purpose is to prevent or mitigate health-and-safety risks (user-assistance and convenience functions are excluded), and machinery under Regulation (EU) 2023/1230 moved to Annex I Section B, out of the Section A conformity path.

The mechanics SMEs most often get wrong:

• The Article 6(3) derogation is available across Annex III — including area 1, biometrics — where the system does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing decision outcomes, and one of four conditions is met: narrow procedural task, improving a completed human activity, detecting patterns or deviations without replacing human assessment, or a purely preparatory task.
• Profiling is an absolute gate. A system in an Annex III area that performs profiling of natural persons (in the GDPR sense) is always high-risk — no derogation.
• "Not high-risk" is not "nothing to file". The Digital Omnibus retained Article 49(2): a provider concluding under Article 6(3) that its Annex III-area system is not high-risk must still register the system and a summary of the assessment in the EU database before market placement.
• "Minimal/limited risk" is explanatory vocabulary, not a statutory category — and Article 50 transparency duties apply to systems that interact with people or generate content regardless of risk class.

Seven sections with eight fill-in tables:

• System description — ten fields including intended purpose, outputs, affected persons and degree of automation, with a worked CV-screening example;
• Prohibited practices gate — confirmation that the doc 10 screen returned "not prohibited" before classification starts;
• Annex III screening table — all eight areas as plain "does the system…" questions, from biometrics to justice and democratic processes;
• The Article 6(3) test — the profiling gate first, then the four conditions in plain terms, then a reasoned-conclusion box (half a page is typical) that becomes your Article 6(4) documentation;
• Registration section — Article 49(1) for high-risk outcomes, Article 49(2) for self-assessed non-high-risk outcomes;
• Classification decision record with sign-off and the deadline that follows, and six re-assessment triggers (purpose change, substantial modification, profiling starts, Annex III amendments, incidents, annual review).

Run one assessment per system from your inventory, in order — the prohibited check comes first because a banned system needs no classification. Write the Section 4 reasoning as if an authority will read it, because it may (Article 6(4)). A high-risk outcome activates the preparation documents of the kit: Annex IV technical documentation, risk management, data governance, human oversight and test logs — start well before 2 December 2027, not at it. Re-run the assessment on any of the Section 7 triggers.