The Achilles' heel of the regulation
The AI Act is based on a simple intuition: not all AI systems are equal, and obligations must depend on the danger they pose. A spam filter does not raise the same issues as a candidate sorting algorithm or a facial recognition system at borders. The regulation therefore distinguishes between prohibited practices, high-risk systems, those subject to transparency obligations, and those with minimal risk.
The problem is that the boundary between these categories is anything but obvious. Article 6 defines high-risk systems, but leaves considerable room for interpretation. Should a medical decision-support tool, a human resources management software, or a credit scoring system be subject to the heavy obligations of high risk? Significant compliance costs depend on the answer. It is this gray area that the draft guidelines published by the Commission on 19 May 2026 aims to clarify. According to the Commission, these guidelines are intended to help "providers, deployers, and other relevant actors determine whether an AI system falls into the high-risk category."
Two gateways to high risk
The draft, expected in February 2026 and published several months late, is organized around the two categories provided for in Article 6:
- Systems related to regulated products (Article 6, paragraph 1, and Annex I): an AI system is high-risk if it is itself a product, or a safety component of a product, covered by European harmonization legislation (machinery, toys, radio equipment, medical devices, automotive, aviation, etc.) and subject to third-party conformity assessment;
- Systems used in sensitive areas (Article 6, paragraph 2, and Annex III): eight areas, including biometrics, critical infrastructure, education, employment, access to essential services such as credit, law enforcement, migration, and justice.
For this second category, Article 6, paragraph 3, provides for derogations when the system does not present a significant risk of harm: for example, if it performs a narrow procedural task, improves the result of an already performed human activity, detects deviations in decision-making patterns without replacing human assessment, or performs a preparatory task. An exception to the exception remains: a system in Annex III that profiles natural persons is always considered high-risk. This is where the stakes are concentrated for human resources or credit decision software. In accordance with Article 6, paragraph 5, the draft includes a series of practical examples of systems that are or are not high-risk.
As journalist Emma Woollacott summarized for IT Pro, the guidance aims to help organizations and regulators decide whether their AI products and deployments must comply with stricter rules. In an area where legal qualification dictates all obligations, these guidelines function as a switch.
An extended consultation
The consultation opened on 19 May was supposed to close on 23 June 2026. At the request of several associations and stakeholders, the Commission extended it by four weeks, until 23 July 2026. It was aimed at a broad audience: providers and developers, user organizations, public authorities, researchers, civil society, and citizens. The final guidelines are to be adopted by the end of 2026.
This method has a downside. Large technology companies have considerable resources to influence consultations, while rights defense associations or small organizations struggle to keep up with the pace and technicality of the texts. The extension, obtained at the request of organized actors, both reflects and responds to this.
The OECD as a partner
On the same 19 May, the Commission made public its collaboration with the OECD for monitoring national AI strategies and investments in the sector. The two institutions co-authored reports intended to support the European "Apply AI" strategy: an analysis of AI adoption in strategic sectors (agriculture, health, industry, mobility) and a monitoring of Member State policies, which serves as a basis for updating national plans discussed within the European AI Committee.
By partnering with the OECD, the Commission embeds its AI governance in a multilateral framework and responds to the criticism that Europe is regulating alone in its corner. It is also a way to indirectly disseminate its analytical framework.
The building blocks piling up
These guidelines add to an edifice being built piece by piece. On 8 May 2026, the Commission published a draft of guidelines on Article 50 and transparency obligations, open for consultation until 3 June, accompanied by three studies on technical solutions for marking and detecting AI-generated content. The code of practice on transparency of AI-generated content, the second version of which was published on 5 March, has since been finalized: more than 180 organizations have signed it.
This piling up reveals the complexity of the undertaking. Voting on a regulation is one thing; making it operational requires dozens of implementing texts, guidelines, codes, and technical standards. It is this delay that justified the political agreement of 7 May 2026 on the digital omnibus, which entered into force on 27 July: the rules applicable to Annex III systems will apply from 2 December 2027, and those targeting AI integrated into products from 2 August 2028.
The bet on predictability
For businesses, these guidelines respond to a long-standing demand for predictability. Even though they are non-binding, since only the Court of Justice can set the interpretation of the regulation, they serve as a roadmap for compliance teams and market surveillance authorities. But this predictability comes at a price: the more precise the criteria, the more likely they are to age poorly in the face of rapidly evolving technologies. A system deemed harmless today may, through an update or a change in use, shift into a danger zone that current criteria have not anticipated.
A subtle battle of influence
Behind the technicality of classification lies a battle of influence. Each formulation can tip entire sectors of industry into the high-risk regime or exempt them from it. If definitions are too narrow, potentially dangerous systems will escape obligations; if they are too broad, harmless tools will face disproportionate constraints, fueling the narrative of European overregulation. In a context where the balance of power, since the omnibus, leans toward easing, the Commission is walking a tightrope.
The guidelines of 19 May 2026 embody the patient work that transforms a text of principle into applicable law. They show a Union concerned with clarifying without stifling, and with involving stakeholders without being captured. But they also reveal the fragility of an edifice that depends on a still-incomplete normative and administrative infrastructure. Europe has bet on regulating AI through the quality of its law; it remains to be seen whether that is enough when it controls neither the models, nor the infrastructure, nor the pace of a technology that does not wait for public consultations.
Sources : Commission, press release of 19 May 2026 ; Commission, draft guidelines ; Commission, consultation and extension to 23 July 2026 ; IAPP, 19 May 2026 ; IT Pro, 20 May 2026 ; Commission and OECD, 19 May 2026 ; Commission, guidelines on Article 50, 8 May 2026 ; Global Policy Watch, 14 May 2026 ; Commission, entry into application of transparency rules ; Commission, entry into force of the AI omnibus ; Gowling WLG, 28 May 2026.
