How should a UK business assess an AI tool described as high-risk under EU rules?

Start with the actual system and what your organisation will do with it. The EU AI Act classifies some AI uses as high-risk because they can pose serious risks to people’s health, safety or fundamental rights. The European Commission’s overview gives examples including recruitment tools, some credit decisions, education assessment and certain systems used in critical infrastructure. Whether a particular system falls within the rules depends on its purpose and circumstances, not just the supplier’s label.

Check scope before assessing obligations

The source for this overview is European Commission information about the EU AI Act, last updated 19 October 2026. It describes an EU framework, not a general UK rule. Do not assume the Act applies to your business because you are buying AI, or that being UK-based rules it out. Ask qualified counsel to assess the territorial and other scope questions against the specific provider, system, deployment and parties involved.

Ask the supplier to explain what it means by “high-risk”. Request the intended purpose, the tasks the system performs, who it is designed for, and the EU AI Act provision or use category they believe is relevant. Compare that explanation with your own planned use. A tool used for a different purpose, or incorporated into a wider product or service, may need a different assessment.

Establish each party’s role

Do not treat “provider” and “deployer” as interchangeable labels. The Commission overview distinguishes providers, who have a post-market monitoring system, from deployers, who ensure human oversight and monitoring. It also says providers and deployers report serious incidents and malfunctioning. The exact role and resulting responsibilities need to be checked for the real arrangement, rather than inferred from who pays the invoice or hosts the software.

Map who develops or supplies the system, who puts it into use, who sets its purpose, and who operates it in practice. Ask the supplier to identify its own role and the information it expects your organisation to provide. Record any role assumptions and ask counsel to verify them if they affect legal duties, contractual terms or the decision to proceed.

Make procurement checks concrete

Before committing, ask for evidence that lets your team judge whether the system is suitable for the proposed use and can be managed once live. Depending on the system and the supplier’s role, useful evidence may include:

• A clear description of the system’s intended purpose, limits and supported uses.
• Documentation about its risk assessment, risk controls and relevant data quality checks.
• Information on what activity is logged, how long records are available and how results can be traced.
• Instructions for human oversight, including what users should do when outputs are uncertain or appear wrong.
• Evidence about accuracy, robustness and cybersecurity that is relevant to your use, plus known limitations.
• Arrangements for monitoring after deployment and notifying the relevant parties about serious incidents or malfunctioning.

These are procurement questions, not a complete legal checklist. The Commission overview describes risk assessment and mitigation, dataset quality, logging, technical documentation, information for deployers, human oversight, robustness, cybersecurity and accuracy among the high-risk requirements. Which requirements apply, to whom and when should be verified against the current legislation and the system’s actual classification.

Plan for use, monitoring and change

Agree who in your organisation will monitor the system, review its outputs and act on concerns. Set out how staff can raise an issue, pause or limit use where appropriate, and escalate a suspected serious incident. Keep the supplier’s instructions, your role and scope assessment, decision records, training or operating instructions, monitoring records, and relevant incident correspondence together.

Revisit the assessment if the supplier changes the system, your organisation uses it for a new purpose, or the people affected or decisions made change. A missing document or unexplained output is a reason to investigate and assess the risk; it does not, by itself, establish harm, breach or liability.

Discuss the supplier or implementation decision

For a practical discussion of a supplier or implementation decision, book a Pattrn Data AI Automation Discovery Call with Rohit. The 30-minute call is to assess whether a useful, safe automation opportunity exists, what next step makes sense, and what may not be worth doing yet.