Does your AI system fall under the EU AI Act's Annex III list?

An AI system is high-risk under the EU AI Act if it falls into one of Annex III's eight listed areas and does not meet one of Article 6(3)'s narrow exceptions. This page walks through all eight areas in the Act's own words, then the exceptions that can take a matching system back out — and the one case, profiling, where no exception applies. It is a reading aid built from the Act's own text, not a legal opinion on any specific system.

How does this list work?

Check a system against each of the eight areas below in turn. A match on any one of them makes the system a candidate for high-risk status. From there, check whether Article 6(3)'s exceptions apply — four narrow carve-outs that can remove high-risk status even for a system that matches an Annex III area — and then check whether the system performs profiling, which cancels every one of those exceptions. A system that clears all three checks is not high-risk under Annex III; nothing here changes how Annex I (AI embedded in already-regulated products such as machinery or medical devices) is assessed, which follows a separate route under Article 6(1).

Does my AI system fall under Annex III's biometrics category?

Yes, if its use is legally permitted and it is a remote biometric identification system, a system used for biometric categorisation by sensitive or protected attributes, or a system used for emotion recognition. The Act carves out one specific exclusion: a system whose sole purpose is biometric verification, confirming that a person is who they claim to be, does not count.

A fingerprint or face-match login that only checks "is this the account holder" sits outside the category under that exclusion; a system that identifies an unknown person from a crowd, sorts people into categories from inferred traits, or reads emotional states sits inside it.

Does my AI system fall under Annex III's critical infrastructure category?

Yes, if it is a safety component used in managing or operating critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. The category is narrow on purpose: it covers safety components, not every AI system a utility or network operator runs.

A load-balancing system that can shed traffic across a power grid's safety systems fits here; a billing or customer-service AI at the same utility does not, because it is not a safety component of the infrastructure itself.

Does my AI system fall under Annex III's education category?

Yes, if it is used to decide admission or assignment to an educational or vocational training institution, to evaluate learning outcomes (including ones used to steer a student's learning path), to assess what level of education someone can access, or to monitor and detect prohibited behaviour during tests.

An automated exam-proctoring tool that flags suspected cheating, or an admissions-scoring model, both fall inside this area; a scheduling tool that only assigns classrooms does not touch any of the four listed uses.

Does my AI system fall under Annex III's employment category?

Yes, if it is used to recruit or select people (including targeted job ads, filtering applications, or evaluating candidates), or to decide on promotion, termination, task allocation based on behaviour or traits, or performance monitoring within an existing work relationship.

A resume-screening tool that ranks applicants and an employee-monitoring system that scores performance for promotion decisions both match; an internal tool that only tracks login hours for payroll, with no role in evaluation or allocation decisions, does not.

Does my AI system fall under Annex III's essential-services category?

Yes, if it is used by or for a public authority to decide eligibility for essential public benefits or services including healthcare, to evaluate creditworthiness or set a credit score (except for financial-fraud detection, which is excluded), to price or assess risk for life and health insurance, or to classify and dispatch emergency calls, including patient triage.

A bank's automated credit-scoring model and a 911/112 call-triage system both sit inside this area; a model built only to flag fraudulent transactions is explicitly excluded by the Act's own wording.

Does my AI system fall under Annex III's law-enforcement category?

Yes, where its use is legally permitted, if it is used by or for law-enforcement authorities to assess someone's risk of becoming a crime victim, as a polygraph or similar tool, to evaluate the reliability of evidence, to assess the risk of offending or re-offending, or to profile people during an investigation.

Note that this is one of the areas where the profiling override below almost always applies, since several of its own listed uses are themselves profiling.

Does my AI system fall under Annex III's migration and border-control category?

Yes, where legally permitted, if a competent authority uses it as a polygraph, to assess a security, irregular-migration or health risk posed by someone entering a Member State, to help examine asylum, visa or residence applications (including assessing evidence reliability), or to detect, recognise or identify people in a migration, asylum or border-control context. Verifying travel documents is explicitly excluded.

Does my AI system fall under Annex III's justice and democracy category?

Yes, if a judicial authority uses it to research or interpret facts and law and apply them to a case (including in alternative dispute resolution), or if it is intended to influence the outcome of an election or referendum or how people vote. The Act excludes tools whose output voters never see, such as software that only organises or schedules a campaign's logistics.

Could my system still avoid high-risk status after matching one of these areas?

Possibly. Article 6(3) says a system that falls under Annex III is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing a decision's outcome, and it fits one of four narrow situations: it performs only a narrow procedural task; it improves the result of an already-completed human activity; it detects patterns or deviations from prior decisions without replacing or influencing a human's own assessment, subject to proper human review; or it performs a preparatory task for an Annex III assessment rather than the assessment itself.

A tool that pre-sorts documents for a human loan officer to review, without ranking or scoring applicants itself, is a plausible fit for the preparatory-task exception; a tool that produces the credit decision itself is not.

Does profiling change the answer?

Yes, and it overrides every exception above. The Act states that an Annex III system is always considered high-risk if it performs profiling of natural persons, regardless of whether it would otherwise qualify for one of the four Article 6(3) exceptions.

This is the single most important check to run last: a system that otherwise looks like a narrow procedural or preparatory tool still counts as high-risk the moment it profiles people.

What happens once a system is classified high-risk under Annex III?

High-risk status brings the Act's Chapter III obligations: a risk-management system, data-governance requirements, technical documentation, human oversight and the cybersecurity duties this site has covered separately for providers and deployers. Those Annex III obligations do not start immediately: the "Digital Omnibus on AI" moved their application date out to 2 December 2027, a change this site's compliance calendar covers in full, including which other Act obligations (prohibited practices, GPAI rules) are already in force today.

For what Article 15's cybersecurity duty and Article 73's incident-reporting deadlines require of a security team once a system is in scope, see this site's explainer on what the EU AI Act requires of a CISO.

Is this page legal advice?

No. This page reads the Act's own Annex III and Article 6 text to help a reader narrow down whether a described use case is worth a closer legal review; it is not a substitute for one, and it does not cover Annex I (products already regulated elsewhere, such as machinery or medical devices), which is assessed under a separate route. Only a system that both matches an Annex III area and clears Article 6 actually carries the Act's high-risk obligations, and those obligations only take effect once the relevant date above arrives.