A high-risk system is an AI use case that can significantly affect rights, safety, or important decisions, so it must meet stricter legal and technical controls. In practice, this includes systems used for hiring, access decisions, worker management, credit, health, or other sensitive contexts where a wrong output can cause real harm. The label does not depend only on the model itself; it depends on the intended use and the impact of the decision chain.
For cyber security, high-risk systems matter because they usually need stronger governance: access controls, logging, traceability, human oversight, and data quality checks. Attackers may try to tamper with inputs, retrain a model on poisoned data, or abuse weak review workflows to push harmful decisions. Defenders treat these systems like controlled assets, not simple automation. That means restricting who can change prompts, thresholds, or datasets; keeping audit trails; and ensuring a qualified person can stop or override outputs when something looks wrong.