Systems considered high risk, such as facial recognition, will be subject to extra scrutiny, says the European Commission.