Defining High-Risk AI Is Europe’s Next Big Battle

The Commission has opened consultation on high-risk AI guidelines, and the outcome will shape compliance, enforcement, and competition.

Commission opens fight over what counts as high-risk AI, and yes, that sounds like the kind of Brussels sentence engineered to make founders suddenly remember they need the bathroom. But this is the real fight.

Not the TED-talk version of AI policy. Not the “Europe regulates innovation again” slop you see on X from guys with anime avatars and no payroll. The actual fight. The one that decides which companies get buried in compliance, which public authorities get checked before they automate something stupid, and which startups can keep pretending their product is “just assistive” while it quietly makes consequential decisions.

I’ve spent enough time around startup people in Milan, Paris, Berlin, New York, wherever there’s bad coffee pretending to be good coffee, to know exactly when eyes glaze over. The second someone says “Article 6,” the soul exits the body. Capito. But Article 6 is where the EU AI Act stops being a grand moral project and starts messing with product roadmaps.

That’s why this matters more than most of the AI discourse combined.

The high-risk AI definition is where the AI Act gets real

On 19 May 2026, the European Commission opened a consultation on draft guidelines for the classification of high-risk AI systems. Feedback is open until 23 June 2026 through the AI Act Single Information Platform and the EU Survey. Which sounds dry, but it’s the moment the law becomes operational instead of theoretical. Or, if you’re a founder, the moment your legal bill starts doing CrossFit.

The Commission is pretty clear about what these guidelines are for: helping providers and deployers figure out whether a system counts as high-risk AI, with examples of systems that should and should not fall into that bucket. That is not a side issue. That’s the issue. Because once your system lands on the wrong side of that line, your future changes fast: more documentation, more process, more procurement friction, more waiting around while someone in legal says “we’re assessing exposure.”

And yes, the guidelines are not legally binding. The Commission says that plainly. It also says they reflect the Commission’s interpretation and will guide enforcement. Which in Brussels-speak means: technically optional, spiritually mandatory. My nonna would have understood this immediately.

The important part is that the Commission didn’t just throw a PDF into the void and call it participation. It published the draft in a user-friendly format, with summaries, examples, and a draft guidelines explorer. That’s actually useful. It also means nobody gets to say later, “we had no chance to engage.” If you build, deploy, buy, or regulate AI in Europe, this is the window.

If you wait until 2027 to care, congratulations, you have chosen the worst possible moment.

There are two ways to become high-risk AI, and one of them will catch people sleeping

Here’s the core of it. Under the law and the draft guidelines, there are two routes into high-risk status.

The first is Article 6(1). If an AI system is used as a safety component of a product, or is itself a product covered by EU harmonised legislation in Annex I, and that product needs a third-party conformity assessment, it can be high-risk. This is the industrial route. The medtech route. The machinery route. The “surprise, your software startup is now in product-safety hell” route.

The second is Article 6(2). If the AI system falls into one of the sensitive use cases listed in Annex III, it can also be high-risk. The European Parliament’s 7 May 2026 press release on the AI Omnibus deal points to areas like biometrics, critical infrastructure, education, employment, law enforcement, and border management. This is the route people talk about most, because it sounds dramatic and immediately political. And fair enough. Hiring tools and border systems should be political. They shape actual lives.

But I think a lot of companies are still underestimating the first route.

If you’re building AI for medical devices, transport systems, machinery, robotics, industrial controls, or some weird B2B vertical with a name only three procurement people in Stuttgart recognize, you may not think of yourself as “in the AI Act debate.” Too bad. Article 6(1) does not care about your startup’s branding. If your AI is tied to safety and the product sits under Annex I legislation with third-party conformity assessment, you’re in it.

That matters because these two routes are not just legally different. They feel different. Annex I classification is product safety land: standards, notified bodies, engineering documentation, the whole buffet. Annex III classification is more about contexts that can significantly affect health, safety, or fundamental rights. Different politics. Different scrutiny. Different kinds of headlines. Same “high-risk” label.

The Commission’s own draft more or less admits this. It splits the discussion: Section III deals with the first category, Section IV with the second. That’s not just formatting. It’s Brussels quietly acknowledging that “high-risk AI” is not one thing. It’s two different theories of risk wearing the same badge.

Once you see that, the whole argument gets sharper.

The Commission is coming for the oldest startup trick in the book: “we’re just assistive”

I’ve founded companies. I know how this goes. The minute regulation gets specific, product language becomes poetry.

Nobody says, “our model materially shapes employment outcomes.” No, no. Suddenly it’s “decision support.” “Optimization layer.” “AI copilot.” “Workflow intelligence.” “Human-in-the-loop augmentation.” Same thing, just with a nicer font and a seed round.

The big classification fight is going to be over systems that influence decisions versus systems that determine outcomes. Brussels knows this. The Commission says the draft includes examples of systems that should and should not be classified as high-risk, but the examples are not exhaustive and may be updated. Translation: nice try, ragazzi, we know exactly what game you’re about to play.

This got even more interesting with the AI Omnibus deal. On 7 May 2026, Parliament and Council agreed to narrow down what qualifies as a “safety component.” According to Parliament, products with AI functions that only assist users or optimize performance should not automatically trigger high-risk obligations if their failure or malfunction does not create health or safety risks.

Honestly, that’s sensible. Not every product with a model in it should be treated like a high-risk system. If my espresso machine starts recommending stronger coffee because I slept badly, that’s invasive and deeply rude, but it is not the same as an AI component whose failure can hurt someone on a factory floor.

Still, this narrowing creates the next battlefield. Every vendor on earth is now going to argue their system “merely assists.” Public authorities will say the human stays in control. HR software companies will claim they just “surface insights.” Edtech platforms will say they “support educator judgment.” I can already hear the pitch decks. Last year in Lisbon I heard a founder describe a screening model as “basically a confidence layer for recruiter prioritization.” Sure, amore. And tiramisù is basically a protein bar.

The Council added an important twist on 7 May 2026: in some cases, providers may still have to register systems they consider exempt from high-risk classification. That’s a very Brussels way of saying, “fine, call it exempt if you want, but do it where we can see you.”

Good.

Not because I enjoy paperwork. Dio mio, absolutely not. I once lost half a day in Barcelona trying to fix a cross-border VAT issue while eating a sandwich that had the texture of drywall. But this is exactly where bad incentives show up. If Europe lets everyone self-declare “assistive” in total darkness, then every consequential system will magically become a harmless tool right up until it ruins someone’s life.

“Copilot” is not a magic word. Neither is “workflow tool.” And thank God for that.

A group of policymakers discussing regulations on high-risk AI, with European flags in the background.

Image alt: Commission opens fight over what counts as high-risk AI — two routes under Article 6: product safety under Annex I and sensitive use cases under Annex III, with later obligations in 2027 and 2028.

Europe didn’t back down on AI regulation. It bought time to get the line right

I’m pro-European, which means I am also very much in favor of Europe not doing stupid self-inflicted admin theater. Those are not contradictory positions. They should be the same position.

The provisional AI Omnibus deal showed something useful: Europe can simplify the mechanics without abandoning the basic risk-based model. According to the European Parliament and Council on 7 May 2026, obligations for Annex III-style high-risk systems now apply from 2 December 2027, while product safety-component systems apply from 2 August 2028.

Those dates matter. Not because delay is inherently good, but because pretending the old timeline was workable would have been pure fantasy. Standards weren’t ready. Guidance wasn’t ready. A lot of companies and authorities weren’t ready. Sometimes “move fast and break things” becomes “move fast and create a legal clown show.”

Laura Caroli put it plainly in Tech Policy Press on 8 May 2026: the central goal was to postpone the application date for high-risk AI requirements because the previous timeline was widely seen as unworkable. Exactly. Too much AI policy commentary treats every delay like moral surrender. It isn’t. Sometimes it’s just governance admitting reality instead of cosplaying competence.

And this matters for competitiveness too. Europe cannot spend every second talking about strategic autonomy, digital sovereignty, and competitiveness, then build a system only SAP, Siemens, or the legal department of Airbus can decode without crying. Ambiguity is not neutral. Ambiguity helps incumbents with compliance teams and hurts startups still figuring out payroll and whether they can afford an actual office.

That’s why I don’t buy the fake binary of regulation vs innovation. The real tradeoff is clear rules vs expensive uncertainty. I can build under strict rules. What kills you is mush. Mush feeds consultants. Clear lines feed builders.

Parliament and Council were careful here. They talked about simplification and streamlining, not scrapping the AI Act’s structure. Good. They shouldn’t scrap it. Europe’s basic point remains correct: AI in a playlist generator is not the same as AI in hiring, education, policing, or border control. If your regulatory system can’t tell the difference, it’s not serious.

And no, I’m not saying Brussels suddenly became cool. Let’s not hallucinate. I’m saying this was an adult move.

This is not really about paperwork. It’s about who gets harmed by automation

The Commission’s consultation says the goal is to identify systems that significantly affect health, safety, or fundamental rights and therefore belong in the high-risk category. That phrase is the whole game.

Not “advanced AI.” Not “frontier systems.” Not “very powerful models.” Harm. Safety. Rights. Real consequences in the real world.

That’s why Annex III matters so much. The Parliament press release points to education, employment, law enforcement, and border management among the relevant areas. If an AI system shapes whether you get hired, how you’re evaluated in school, whether police systems flag you, or how you’re treated at a border, then yes, there should be democratic friction. Full stop. Those are life-chance systems.

This is one of the few places where Europe is actually saying something grown-up that much of the tech world hates hearing: context matters. The same model can be harmless in one setting and corrosive in another. That is not anti-tech. It is what an adult society sounds like.

Henna Virkkunen said in the Commission’s 9 April 2025 AI Continent Action Plan press release that AI is at the heart of making Europe more competitive, secure, and technologically sovereign. True. Ursula von der Leyen said at the AI Action Summit in Paris on 11 February 2025 that AI will improve healthcare, research, innovation, and competitiveness. Also true. But “improve” is doing a lot of work in those sentences.

AI can help healthcare and still be dangerous in triage. It can boost competitiveness and still discriminate in hiring. It can make public services more efficient and still become a black box nobody can challenge. The point of high-risk classification is not to insult the technology. It’s to force honesty about where harm lands.

I especially want the Commission to be aggressive about public-sector deployment, because public authorities everywhere have the same terrible habit: they call something a “pilot” and act like that magically suspends politics. A pilot here, a sandbox there, one procurement note saying “decision support only,” and suddenly a temporary system becomes normal infrastructure. Then everyone shrugs and says, well, it’s already in use.

That’s why I’m glad the consultation invites feedback not just from vendors, but from public authorities, civil society organizations, supervisory bodies, researchers, businesses, and citizens. The people most affected by these systems are usually not in the product meeting. They’re on the receiving end.

My hot take is that Europe’s real AI advantage is not building the loudest products. It’s building the most governable digital society. Less sexy, sure. Ages better.

The winners won’t just be the companies that comply. They’ll be the ones that shape the definition now

If you’re building serious AI in Europe and you’re ignoring this consultation, I honestly don’t know what to tell you. Maybe you enjoy pain. Maybe your lawyer owns a boat and you’re helping with the payments.

The Commission says feedback submitted by 23 June 2026 will be considered for the final version of the guidelines. The draft is already live on the AI Act Single Information Platform, with examples, summaries, and the draft guidelines explorer. The Commission also says the draft was informed by stakeholder feedback and input from member states through the AI Board, with more guidance still to come.

In plain English: the plumbing is being built now.

And yes, boring institutional plumbing is how a stronger Europe gets made. I mean that sincerely. I want common rules that work across all 27 member states, because the alternative is the usual European nightmare: fragmentation, forum shopping, one lawyer in Brussels, one in Paris, one in Berlin, and one therapist.

A real single market for AI needs common definitions, common examples, and common enforcement logic. Otherwise “European AI strategy” is just a PowerPoint with twelve flags on it.

That’s why I think the winners here won’t just be the companies that get good at compliance. They’ll be the companies, labs, researchers, hospitals, and public-interest groups that help shape the category before it hardens. If this process gets captured by giant vendors, trade associations, and consultants billing €700 an hour to explain obvious things in unreadable PDFs, the map will favor whoever already knows how to survive bureaucracy.

Europe deserves better than that.

And honestly, pro-European politicians should say this more clearly. If we want a real European market for AI, then a startup in Turin, a lab in Leuven, and a public hospital in Valencia need rules they can actually understand and use. Not admire from a distance like a cathedral.

This is also where the euroskeptic critique usually gets lazy. Every messy implementation phase becomes proof that Europe can’t build. I don’t buy it. A union of 450 million people trying to create common digital rules was always going to be hard. Of course it’s hard. The answer is not to retreat into twenty-seven little silos and pretend that will somehow produce a serious answer to OpenAI, Google DeepMind, or ByteDance.

The answer is to get better at common institutions.

That includes this fight over what counts as high-risk AI.

Because Commission opens fight over what counts as high-risk AI is not a niche policy update. It’s Europe deciding whether the AI Act becomes a loophole factory, a moat for incumbents, or something much rarer: industrial policy with a conscience.

If Brussels draws the line well — strict where harm is real, lighter where the risk is mostly hype — Europe might actually pull off something difficult and useful at the same time. If it draws the line badly, we’ll get the worst of all worlds: startups drowning in uncertainty, public-sector edge cases slipping through, and giant firms enjoying a compliance advantage they absolutely do not need.

That’s not a technicality.

That’s power.