Annex III: the high-risk areas, explained
When people say a use is high-risk, they usually mean it falls in Annex III. Here are the areas it covers, in plain English, with the ones a typical business is most likely to meet.
What Annex III is
Annex III is the Act's list of uses treated as high-risk, because of where they can affect people's rights, safety, or access to important things. If your use of a system fits one of these areas, the heavy deployer duties come into play.
It is a list of contexts, not products. A tool becomes a high-risk system when it is put to one of these uses, which is why the same software can be high-risk for one job and minimal for another.
The areas it covers
Biometrics: identifying or categorising people, or reading emotions, from biometric data. Some biometric uses are banned outright under Article 5; Annex III covers the high-risk ones that remain.
Critical infrastructure: AI used as a safety component in things like energy, water, or traffic. Education: admissions, marking, and assessing students. Employment and workers: recruitment, screening, promotion, task allocation, and monitoring staff.
Access to essential services: creditworthiness and credit scoring, pricing life and health insurance, eligibility for benefits, and emergency triage. And the state-facing areas: law enforcement, migration and borders, and the administration of justice.
Which ones most businesses meet
For ordinary companies, the live areas are employment, creditworthiness and insurance, and education. If you screen or manage staff with AI, score customers for credit, or assess students, you are in Annex III territory.
The law enforcement, migration, justice, and critical-infrastructure areas are for public bodies and specific regulated operators, not the average business.
It is about the use, not the tool
A tool is not high-risk in the abstract; a use of it is. The same assistant that drafts your job adverts is minimal-risk, while using it to rank applicants is a high-risk employment use.
The interactive Annex III explorer in the library maps these areas to concrete use cases, and Article 6 sets the test for when an Annex III use actually counts as high-risk rather than benefiting from a narrow exception.
If your use is in scope
Landing in Annex III is not a dead end; it is a signal to do the high-risk deployer work: confirm the classification, line up human oversight, keep records, and generate the documents the Act asks for.
The sooner you know a use is here, the more runway you have before the core obligations apply on 2 December 2027 (postponed from 2 August 2026 by the 2026 Digital Omnibus).
This guide is general educational information, not legal advice. For how the Act applies to your organisation, classify your systems and consult qualified counsel.
Put it into practice
Classify your AI systems against the Act and generate the documents this guide describes.