On 19 May 2026 the European Commission released draft guidelines with the aim of supporting providers and deployers of AI systems in assessing whether an AI system should be classified as "high-risk" under Article 6 of the EU AI Act.

How this impacts NZ businesses

The EU AI Act has extraterritorial reach, which means a NZ business will be in scope if it places an AI system on the EU market, puts one into service in the EU, or the systems' AI's outputs are used in the EU.

Whether your system would be classified as high risk is determined by its intended purpose, assessed under Article 6 against two pathways:

Two routes to "high-risk"

Annex I (AI that is, or is a safety component of, a regulated product requiring third-party conformity assessment): think machinery, medical devices, lifts, toys, vehicles, pressure equipment.

Examples offered in the draft guidelines include an AI system that intends to monitor gas concentrations and command shutdown and an AI system in a train intended to monitor speed limits and to prevent collisions and derailments.

OR

Annex III (use case based, covering eight prescribed areas) namely:

1. biometrics
2. critical infrastructure
3. education and vocational training
4. employment, worker's management and access to self-employment
5. access to, and enjoyment of, essential private services and public services
6. law enforcement
7. migration, asylum and border control management
8. administration of justice and democratic processes.

In line with the risk-based approach of the AI Act, only a limited set of AI system use cases falling within those broad areas are classified as high-risk. Those use cases are listed for each area in Annex III.

A potential filter to exempt AI systems from being high risk according to Article 6(3)

Even where your system falls within one of the use cases listed in Annex III, it may not be regarded as high-risk if it does not pose a significant risk to health, safety or fundamental rights. For example, if the AI system only performs a narrow procedural task, a preparatory task, or stylistic clean-up of human-drafted output. (Note however that this filter never applies where the system performs profiling of natural persons).

Next steps

- Map every AI tool you provide or deploy in the EU.

- Determine your role, as defined under the EU AI Act. Are you a provider, deployer, importer or distributor?

- Self-assess against Annex I and Annex III. The draft guidelines offer practical examples of AI systems falling within these categories to guide you.

- The guidelines are in draft at the date of writing this, and stakeholder feedback is open. There's still time to bring your system in line.

If you need help knowing where to begin, feel free to contact me at larissa@havnlaw.co.nz.