EU AI Act High-Risk AI Systems: The Full Annex III List
The EU AI Act creates special obligations for AI systems in specific high-stakes domains. Here is every category, with plain-English explanations and real examples — so you can tell whether your AI system is caught.
Key deadline: August 2, 2026
High-risk AI systems obligations under Annex III became enforceable on August 2, 2026. AI systems already deployed before this date have until December 2, 2030 to comply, provided they have not been substantially modified. New systems must comply immediately. Penalties for non-compliance reach €15 million or 3% of global annual turnover.
What Makes an AI System “High-Risk”?
Under the EU AI Act, an AI system is “high-risk” if it falls into one of two categories:
- Annex I: AI systems used as safety components in products already subject to EU safety legislation (machinery, medical devices, aviation, etc.).
- Annex III: Stand-alone AI systems in eight specific domains where the potential for harm to individuals is judged to be significant.
This guide covers Annex III — the category most relevant to businesses using AI in employment, education, financial services, and similar domains.
The Eight Annex III Categories
Biometric Identification and Categorisation
AI systems used for remote biometric identification (matching a person's identity from biometric data) or categorisation of natural persons based on sensitive attributes.
Examples:
- AI that identifies suspects from CCTV footage by matching to a database
- Facial recognition systems at border crossings
- Systems that categorise crowds by demographics using biometrics
Note: Real-time remote biometric identification in public spaces is also a prohibited practice (Article 5) with only narrow law-enforcement exceptions.
Critical Infrastructure
AI systems used as safety components in the management and operation of critical digital infrastructure, road traffic, water, gas, heating, or electricity supply.
Examples:
- AI managing electrical grid load balancing
- Traffic management systems with AI-driven signal control
- AI in water treatment or gas distribution safety monitoring
Note: Only AI used as a "safety component" in these systems is high-risk — general analytics for operational efficiency are not necessarily caught.
Education and Vocational Training
AI systems that determine access to, or assign or evaluate persons in, education and vocational training — including monitoring student behaviour.
Examples:
- AI-powered university admissions scoring systems
- Automated essay grading tools that produce final marks
- Proctoring software that monitors students for cheating
- AI that recommends whether to admit a student to a course
Note: Tools that assist teachers without making autonomous decisions — such as writing aids or study recommendations — are generally not high-risk.
Employment and Workers Management
AI systems used for recruitment, screening, selection, monitoring, evaluation, performance assessment, or termination of persons in employment relationships.
Examples:
- CV screening tools that rank or filter applicants
- AI systems that allocate gig workers to tasks
- Productivity monitoring software that feeds into performance reviews
- AI that recommends promotion or redundancy decisions
Note: This is one of the most commonly affected categories for businesses. Any AI touching the employment lifecycle needs compliance scrutiny.
Access to Essential Private and Public Services
AI systems used to evaluate eligibility, or to grant, withhold, or deny access to essential services including credit, insurance, social benefits, emergency services, and housing.
Examples:
- Credit scoring models used by banks or fintech lenders
- Insurance premium pricing algorithms
- AI systems that assess social housing applications
- Automated triage systems for emergency services
Note: Financial institutions using any AI in credit or insurance decisions are likely subject to high-risk obligations.
Law Enforcement
AI systems used by law enforcement authorities to assess the risk of individuals for criminal activity, for polygraph or similar tests, or to analyse evidence.
Examples:
- Predictive policing tools assessing reoffending risk
- AI analysis of crime scenes or digital evidence
- Facial recognition used in criminal investigations
Note: This category primarily affects public authorities, but private companies providing AI tools to law enforcement are also caught.
Migration, Asylum and Border Control
AI systems used to assess risks or security threats from individuals seeking entry, to assist in examination of asylum applications, or to support border checks.
Examples:
- AI risk assessment tools used at airport security
- Systems that evaluate asylum claim credibility
- Automated document verification at border crossings
Note: Affected primarily by public authorities, but technology vendors supplying these systems must comply as providers.
Administration of Justice and Democratic Processes
AI systems used to assist courts or administrative bodies in researching and interpreting facts and the law, and applying them to specific cases.
Examples:
- AI that suggests sentencing guidelines to judges
- Legal research tools that summarise relevant case law for court use
- AI used in electoral process management
Note: General legal research tools used by solicitors and barristers may not be high-risk if they do not directly advise on specific cases before a court.
What Obligations Apply to High-Risk Systems?
If your AI system is high-risk, the EU AI Act imposes a set of mandatory technical and organisational requirements. Obligations differ slightly depending on whether you are a provider (you built or supply the AI) or a deployer (you use the AI in your products or processes).
Provider obligations
- Implement a quality management system
- Prepare full technical documentation
- Conduct a conformity assessment
- Affix CE marking
- Register in the EU AI database
- Maintain post-market monitoring
- Report serious incidents to authorities
Deployer obligations
- Use the AI only as intended by the provider
- Implement human oversight measures
- Conduct a fundamental rights impact assessment
- Register in the EU AI database (where required)
- Monitor the system during operation
- Maintain logs for at least 6 months
- Inform affected individuals where required
Both providers and deployers must also comply with Article 4 AI literacy — ensuring that all staff working with the AI system have sufficient understanding of how it works, its limitations, and its risks.
Frequently Asked Questions
We use a third-party AI tool (e.g. from an HR software provider). Are we the deployer?
Yes. If you use an AI system that makes or assists with decisions about your employees — even if the AI is embedded in your HR platform — you are the deployer and the obligations apply to you. You should ask your software provider for their EU AI Act documentation.
Our AI only provides recommendations; a human makes the final decision. Is it still high-risk?
Quite possibly yes. The EU AI Act applies to AI that "assists" with decisions — not only to fully automated decisions. If the AI output materially influences a human decision about employment, education, or financial access, it is likely high-risk regardless of the final step being human.
We are a startup. Does the size of our company affect our obligations?
The core obligations apply regardless of company size. SMEs benefit from some simplified documentation pathways and access to free regulatory sandboxes, but cannot avoid the substantive requirements. The EU AI Service Desk offers free guidance to help SMEs classify their systems.
What if we are outside the EU but have EU customers?
The EU AI Act follows the same principle as GDPR: it applies wherever EU residents are affected, regardless of where the company is based. If your AI system produces outputs that affect EU-based individuals, you are likely subject to the Act and should designate an EU-established representative.
Is Your AI System High-Risk?
Use our free classifier to find out in 5 minutes — and see exactly what your business needs to do.
Start Free Assessment