Compliance

High-risk system

AI use posing substantial effects on rights, health or essential services.

How the laws define this

Global regulatory approaches agree that high-risk AI systems are defined by their potential to cause material or significant harm to fundamental rights, safety, health, or essential services, triggering scaled duties such as impact assessments, human oversight, and pre-deployment testing. The primary divergence lies in how specifically instruments identify affected domains and operationalize requirements. Frameworks like the National Artificial Intelligence Policy and Accelerating Digital Sovereignty 2030 explicitly designate sensitive sectors—such as healthcare, finance, credit scoring, and criminal justice—as high-risk. Conversely, instruments like the AgID draft guidelines and Law No. 31814 apply flexible impact criteria without binding the definition to named industries. Additionally, while instruments like Proyecto 200/23 and Royal Decree 729/2023 establish immediate duties like mandatory public registration and audits, the Proyecto de decreto que regula tecnologías emergentes, disruptivas e inteligencia artificial frames high-risk systems as a concept for future legislation to define and regulate.

Synthesised from the 11 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first. Showing 8 of the 11 instruments that define this term; all are listed under Definitions below.

JurisdictionInstrumentStatusWhat is distinctive
SpainRoyal Decree 729/2023 approving the Statute of the Spanish Agency for AI Supervision (Agencia Española de Supervisión de la Inteligencia Artificial - AESIA)In ForceExplicitly aligns with EU AI regulatory approach and emphasizes enhanced supervision by AESIA alongside conformity assessment and registration.
MexicoBill to regulate emerging/disruptive technologies and AIProposedLeaves definition to forthcoming General Law while specifying material effects on fundamental rights, safety, or critical-sector operations.
ChileBill to regulate AI systems, robotics and related technologiesUnder ReviewFocuses on specific use-cases under the bill's risk-classification framework and includes economic interests alongside rights and safety.
LuxembourgNational Artificial Intelligence Strategy (part of 'Accelerating Digital Sovereignty 2030')AdoptedProvides examples of affected critical services like healthcare, finance, public administration, and critical infrastructure.
ItalyDraft Guidelines for the Adoption of Artificial Intelligence in Public AdministrationDraftTargets AI use in public administration with heightened assessments, DPIAs, pre-deployment testing, and enhanced contractual protections.
ColombiaBill to define and regulate AIStalledEmphasizes critical legal/administrative interests and includes periodic audits in addition to impact assessments and registration.
NigeriaNational Artificial Intelligence Policy (NAIP)DraftGives examples like healthcare diagnostics, credit scoring, or criminal justice applications as high-risk scenarios.
PakistanRegulation of Artificial Intelligence Bill, 2024WithdrawnIncludes public interest alongside safety and rights, with certification as a key obligation.

What it triggers

  • Under Royal Decree 729/2023, high-risk systems are subject to enhanced supervision, conformity assessment and registration requirements by AESIA.source
  • Under the Mexican bill, high-risk systems would be subject to enhanced obligations such as transparency, conformity assessment, human oversight and incident reporting.source
  • Under the Chilean bill, high-risk systems would be subject to pre-market conformity assessments or mandatory registration and enhanced obligations for providers and operators.source

Definitions (11)

An AI system or use-case identified as posing significant potential impacts on individuals' rights, safety, health or access to essential public services; such systems require heightened assessments, DPIAs, pre-deployment testing, human oversight, enhanced contractual protections and ongoing monitoring in line with EU risk-based rules.

A risk-category concept the decree directs the forthcoming General Law to define and regulate; it denotes systems whose deployment can materially affect fundamental rights, safety, or critical-sector operations and that therefore will be subject to enhanced obligations such as transparency, conformity assessment, human oversight and incident reporting.

AI systems classified as having material impact on individuals’ rights, safety, health, or fundamental interests (for example, healthcare diagnostics, credit scoring, or criminal justice applications), which are subject to scaled obligations such as AI impact assessments, enhanced testing, and registration.

An AI system or specific use-case identified under the bill's risk-classification framework as presenting substantial risks to fundamental rights, safety, health, or economic interests; high-risk systems are subject to pre-market conformity assessments or mandatory registration and enhanced obligations for providers and operators.

An AI system classified by the law as posing a substantial risk to fundamental rights or critical legal/administrative interests; such systems are subject to stricter obligations including impact assessments, registration on a public registry, periodic audits, and conformity assessment procedures.

An AI system classified by the bill as posing significant risk to safety, rights, or public interest; such systems trigger enhanced obligations including algorithmic impact assessments, conformity assessment, certification, and human-oversight requirements.

AI systems identified by the law as having the potential to cause significant harm to individuals, public interests, or sectoral functions; such systems are subject to mandatory risk classification, ethical/social/economic impact assessments, enhanced documentation, monitoring, and proportionate mitigation measures enforced by SGTD and sectoral supervisors.

Systems whose malfunction, biased outputs, or erroneous decisions have the potential to cause significant harm to individuals' rights, safety, or economic standing; such systems trigger mandatory risk assessments, DPIAs, independent testing and stronger oversight measures under the guidance.

AI uses that pose substantial risk to fundamental rights, safety, or critical infrastructure, defined consistent with the EU risk‑based approach; such classification triggers stricter governance, conformity and oversight requirements under the strategy.

Systems or uses of AI that materially affect fundamental rights, safety, or the functioning of critical services (for example healthcare, finance, public administration, and critical infrastructure). The strategy treats these as subject to heightened oversight, risk assessments, and sandboxing in line with the EU AI Act.

High‑risk systems are AI systems that may produce significant risks to health, safety, equality of treatment, non‑discrimination or other fundamental rights, aligned with the EU AI regulatory approach and subject to enhanced supervision, conformity assessment and registration requirements.

Questions and answers

What obligations apply to high-risk AI systems in Spain?

High-risk systems must undergo enhanced supervision, conformity assessment and registration by AESIA, aligned with EU AI rules.

How does the Chilean AI bill classify high-risk systems?

It identifies AI systems or specific use-cases presenting substantial risks to fundamental rights, safety, health, or economic interests under its risk-classification framework.

What are examples of high-risk AI uses in Nigeria's policy?

Examples include healthcare diagnostics, credit scoring, or criminal justice applications.