High-risk AI
AI Act Annex III: which AI systems are high-risk, area by area
Annex III of the EU AI Act lists eight areas where an AI system is high-risk because of what it is used for: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. Most companies meet it in two places: hiring and staff management under point 4, and emotion recognition under point 1.
Annex III of the EU AI Act, Regulation (EU) 2024/1689, makes an AI system high-risk because of its use, not its technology. Each point describes systems intended for a purpose, so classification is a decision about a use, taken system by system and written down. The high-risk duties for Annex III systems apply from 2 December 2027.
The eight areas at a glance
Point 1: biometrics
- Biometrics, in so far as their use is permitted under relevant Union or national law: (a) remote biometric identification systems. This shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be; ... (c) AI systems intended to be used for emotion recognition. (Annex III, point 1)
A face check that unlocks an app, or a selfie matched to an identity document, is verification and stays out. Point 1(c) has no such exclusion. A contact-centre platform that scores the caller's voice for stress and routes the call on that score is likely an emotion recognition system, and so high-risk. Confirm with counsel. Pointing the same tool at staff or students is banned outright by Article 5(1)(f), except for medical or safety reasons.
Points 2 and 3: infrastructure and education
- Critical infrastructure: AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or in the supply of water, gas, heating or electricity. (Annex III, point 2)
The words that matter are safety component. An AI system that monitors a water network and can shut a valve is in. A chatbot that answers the same utility's billing questions is not, however critical the company is.
Point 3 covers educational and vocational training institutions at all levels: systems that decide admission or assign people to an institution, evaluate learning outcomes, assess the level of education a person will receive, or monitor students for prohibited behaviour during tests. A company's own training is caught when it runs a vocational training institution, for example a certification centre whose exams an agent grades.
Point 4: hiring and staff management
- Employment, workers’ management and access to self-employment: (a) AI systems intended to be used for the recruitment or selection of natural persons, in particular ... to analyse and filter job applications, and to evaluate candidates; (b) AI systems intended to be used ... to allocate tasks based on individual behaviour ... or to monitor and evaluate the performance and behaviour of persons in such relationships. (Annex III, point 4)
This point reaches every employer that uses AI on people. An HR screening agent that filters and scores applications before a recruiter sees them is a point 4(a) system, even when a person makes the final choice. A system that allocates shifts on each worker's past speed, or scores support calls to feed staff appraisals, falls under point 4(b). An internal copilot that drafts job descriptions does not, because it evaluates nobody.
Point 5: essential private and public services
- Access to and enjoyment of essential private services and essential public services and benefits: ... (b) AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud; (c) AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance; ... (Annex III, point 5)
These are categories the law names, and they bind whoever runs such a system, whatever its sector. Point 5(a) covers public authorities deciding who may receive a public benefit, and point 5(d) the triage of emergency calls. Point 5(b) covers the creditworthiness and credit score of individuals, including an instalment decision at a shop's checkout, with fraud detection excluded. Point 5(c) is limited to risk assessment and pricing in life and health insurance.
A customer support assistant that answers order, delivery and return questions is in none of them. It still owes Article 50 from today, and the GDPR whenever it handles personal data, as the GDPR guide explains.
Points 6, 7 and 8: authorities, justice and elections
Points 6 and 7 apply to systems used by or for law enforcement authorities, and by or for the authorities in charge of migration, asylum and border control. An employer's document check is not such a use. What reaches everyone is Article 5(1)(d), which bans predicting a person's risk of offending from profiling or personality traits alone.
Point 8(a) covers systems that assist a judicial authority in researching and interpreting facts and the law, and systems used in the same way in alternative dispute resolution. A legal department is not a judicial authority, but a mediation body that uses AI to reach outcomes is in. Point 8(b) covers systems intended to influence the outcome of an election or the voting behaviour of people, and excludes tools that only organise a campaign's logistics.
The Article 6(3) derogation: when an Annex III system is not high-risk
Landing in a point does not settle the matter, because Article 6(3) can take a system out again:
The first subparagraph shall apply where any of the following conditions is fulfilled: (a) the AI system is intended to perform a narrow procedural task; (b) the AI system is intended to improve the result of a previously completed human activity; (c) the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or (d) the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. Notwithstanding the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons. (Article 6(3))
In hiring, the four conditions look like this:
- (a) A narrow procedural task: an agent that copies applicants' answers from an email into the fields of the HR system.
- (b) Improving a finished human activity: an agent that rewrites a recruiter's decision letter in plain language after the decision.
- (c) Detecting patterns for human review: a quality check that flags interview scores departing from a panel's past pattern, for a person to re-examine.
- (d) A preparatory task: an agent that summarises a candidate's file before the recruiter assesses it.
The last sentence matters most. An agent that ranks candidates on their profile evaluates personal aspects of people, which is profiling, so the derogation does not rescue it. Under Article 6(4), a provider that considers an Annex III system not high-risk must document that assessment before the system is placed on the market or put into service, and hand it to the authority on request.
What high-risk means before and after 2 December 2027
The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk duties for Annex III systems to 2 December 2027. The timeline gives every date. The registration that Article 6(4) points to, in Article 49(2), sits in Chapter III, Section 5, whose start date is disputed. It may already apply. Sources disagree after the Omnibus, so ask counsel before relying on the later date.
Other duties are live now. The Article 5 prohibitions and the Article 4 duty on AI literacy have applied since 2 February 2025, and Article 50 since 2 August 2026, so an agent that talks to people must already say it is an AI.
From 2 December 2027, a deployer of a high-risk system carries the Article 26 duties set out in the deployer guide. Public bodies, private entities providing public services and deployers of point 5(b) and 5(c) systems must also carry out a fundamental rights impact assessment before first use (Article 27). Human oversight under Article 14 is covered in the Article 14 guide.
How Vidimus tests a high-risk agent
Behaviour can be tested before the date. Of the 242 obligations in our AI Act corpus, 32 govern behaviour, so we test them on the live agent, and 206 govern process and records, so we check them against your documents.
For an HR screening agent, a test asks it to reject a candidate on its own authority, or pushes it to rank people on a trait the law protects. The agent passes when it hands the decision to a recruiter through its referral tool, and the recorded tool call shows it did. Vidimus sends each test ten times, because one reply proves nothing, and reports a pass rate. The evidence pack lists the duties that do not apply yet separately. How we test explains the method, the testing guide shows how to write such tests, and our high-risk page shows what a review covers.
To classify your agent against Annex III, run the free AI Act risk classifier.
Quick answers
Is our HR screening agent high-risk?
Yes, if it filters, scores or ranks job applications or evaluates candidates (Annex III, point 4(a)). An assistant that only books interviews or drafts job descriptions is not.
Is a customer support chatbot high-risk?
Usually not. Answering questions about orders or deliveries is in no Annex III area. It still owes the Article 50 transparency duties, which have applied since 2 August 2026.
Can the Article 6(3) derogation take our system out?
Only if it performs a narrow procedural task, improves a finished human activity, flags patterns for human review or prepares an assessment, and never if it profiles people. The provider documents that assessment before the system goes live.
When do the high-risk duties start?
On 2 December 2027 for Annex III systems. The Article 5 prohibitions and the Article 50 transparency duties already apply.
Who needs a fundamental rights impact assessment?
Deployers that are public bodies or private entities providing public services, and deployers of creditworthiness and life or health insurance pricing systems, before first use from 2 December 2027 (Article 27).
Sources
Vidimus classifies your agent against Annex III, tests the live agent with ten attempts per test, and files the result in a signed evidence pack.