In July, ENNHRI made a submission to a public European Union (EU) consultation on the implementation of its Artificial Intelligence Act (the AI Act). This concerned the rules for high-risk AI systems. Drawing on the experience and knowledge of National Human Rights Institutions (NHRIs), ENNHRI made recommendations on the classification of high-risk AI systems and future guidelines on high-risk requirements and obligations. The consultation’s results will inform upcoming European Commission guidelines on high-risk systems.

High-risk AI systems under the AI Act and ENNHRI’s recommendations

The AI Act classifies AI systems according to their risk of causing harm. There are four levels of risk: unacceptable (prohibited), high, limited, and minimal, as well as an additional category for general-purpose AI. High-risk AI systems must comply with security, transparency and quality obligations. They must also undergo conformity assessments. Applications classed as limited risk only have transparency obligations while minimal risk is not regulated.

In its submission, ENNHRI stresses the importance of classifying all AI systems as high-risk if they affect groups in vulnerable situations and pose a serious risk to fundamental rights. ENNHRI also highlights that AI systems used for profiling and fraud detection in the area of essential services often result in discrimination, increased surveillance and further marginalisation of the users of those services. Such systems could therefore be considered under the social scoring ban.

In line with its recent statement on Fundamental Rights Impact Assessments (FRIAs) for AI, ENNHRI calls for the purpose of the FRIA template questionnaire to be clarified. Moreover, deployers of AI systems need clear guidance and access to fundamental rights expertise to carry out meaningful FRIAs.

ENNHRI also affirms that since AI systems used in migration, asylum and border control often raise serious fundamental rights concerns, they should be classified as high risk and subject to strict monitoring and transparency requirements.

Beyond this, ENNHRI calls for further clarification on how the AI Act’s risk management duties interact with broader human rights and environmental responsibilities under the Corporate Sustainability Due Diligence Directive (CSDDD).

Building on its submission, ENNHRI wrote to the European Commission to raise concerns about the opt-out mechanism under Article 6(3) of the AI Act, which allows providers to self-assess and declare that their AI systems do not pose a “significant risk.” ENNHRI warns that the mechanism in its current form encourages providers to downplay system risks to avoid highrisk obligations. Weak transparency and oversight make it likely that unregulated systems will still be deployed despite affecting fundamental rights.

More on the EU AI Act and ENNHRI’s relevant work

Read and download ENNHRI’s submission.

The EU Artificial Intelligence Act (AI Act) came into force on 1 August 2024 and establishes a common regulatory and legal framework for AI within the EU. The AI Act’s provisions are gradually coming into operation over the next few years, with the majority of its provisions becoming fully binding on 2 August 2026.

During the negotiations of the AI Act, ENNHRI advocated for a human rights-based approach and published a common position and several statements with recommendations on how the EU AI Act could bolster fundamental rights protection in the age of AI.

Learn more about ENNHRI’s work on artificial intelligence.