firmsfinder.eu · RRVI

PROC-005-FIRMA-DEMONSTRATIVA-2adfcf8b · verifică

High-Risk AI System Assessment Procedure

Document ID: PROC-005-001

Module: 05 – High-Risk Assessment

Version: 1.0

Status: Approved

Classification: Compliance Core Procedure

Owner: Compliance Officer

Effective Date: [YYYY-MM-DD]

Next Review Date: [YYYY-MM-DD]

1. PURPOSE

This procedure defines the standardized process for determining whether an Artificial Intelligence system qualifies as a High-Risk AI System under Regulation (EU) 2024/1689 (EU AI Act).

The objective is to ensure consistent, repeatable, and auditable classification decisions.

2. SCOPE

This procedure applies to:

• All AI systems developed or used by the organization
• All third-party AI systems integrated into internal workflows
• All procurement, deployment, or modification of AI systems
• All business units and operational environments

3. INPUT REQUIREMENTS

The following inputs are required before classification:

• AI System Inventory Record
• Intended Purpose Description
• Technical Documentation (if available)
• Vendor/Supplier Information
• Use Case Description
• Deployment Context
• Relevant regulatory references (Annex I / Annex III)

4. PROCEDURE OVERVIEW

The classification process follows a deterministic step-by-step assessment:

STEP 1 — AI SYSTEM IDENTIFICATION

Assign a unique identifier from the AI Inventory.

Output:

• AI_System_ID
• System Name
• Owner

STEP 2 — INTENDED PURPOSE ANALYSIS

Document the intended use of the AI system.

Include:

• functional purpose
• operational environment
• affected stakeholders
• decision-making role (if any)

Output:

• Intended Purpose Statement

STEP 3 — DEPLOYER / PROVIDER ROLE IDENTIFICATION

Determine organizational role:

• Provider
• Deployer
• Importer
• Distributor
• Product Manufacturer (if applicable)

Output:

• Role Classification

STEP 4 — ANNEX I SCREENING

Check whether the AI system is subject to Annex I regulated product integration.

Output:

• Annex I relevance: YES / NO
• Justification

STEP 5 — ANNEX III SCREENING

Evaluate whether the AI system falls under Annex III high-risk categories, including but not limited to:

• biometric identification
• employment-related decision systems
• education and training systems
• access to essential services
• law enforcement-related systems
• migration, asylum, border control systems
• justice and democratic processes

Output:

• Annex III relevance: YES / NO
• Category mapping (if applicable)

STEP 6 — EXCLUSION CHECK

Verify whether the system qualifies for exclusion or exception under applicable regulation.

Output:

• Exclusion status
• Legal justification

STEP 7 — RISK CLASSIFICATION DECISION

Based on previous steps, classify the system:

• HIGH RISK
• NOT HIGH RISK
• REQUIRES LEGAL REVIEW

Decision must be justified.

STEP 8 — DOCUMENTATION OF EVIDENCE

All supporting evidence must be recorded in the compliance system:

• assessment forms
• system documentation
• vendor declarations
• screenshots / logs (if applicable)
• internal review notes

STEP 9 — COMPLIANCE REVIEW

The Compliance Officer shall:

• validate assessment completeness
• confirm classification decision
• ensure evidence adequacy
• approve or reject classification

STEP 10 — REGISTRATION & ARCHIVING

Final results must be stored in:

• High-Risk Assessment Register
• AI System Inventory
• Compliance Evidence Repository

5. OUTPUT ARTIFACTS

This procedure produces:

• High-Risk Classification Record
• Assessment Checklist
• Compliance Declaration
• Evidence Package
• Audit-Ready Register Entry

6. REVIEW & UPDATE

This procedure must be:

• reviewed annually
• updated upon EU AI Act amendments
• revised when new Annex III interpretations are issued
• audited during compliance cycles

7. NON-COMPLIANCE

Failure to follow this procedure may result in:

• invalid risk classification
• regulatory exposure
• audit failure
• suspension of AI system deployment

END OF DOCUMENT