Annex III categories — the 8 high-risk areas
Annex III is where the EU AI Act's high-risk regime bites for everyday AI. Here are the eight categories, what triggers each one, and the systems that typically fall inside them.
§1 Biometrics
Biometric identification, categorisation, and emotion recognition. Includes facial recognition for access control, biometric identity verification, and emotion inference — but not the banned Art. 5 uses, which are worse.
§2 Critical infrastructure
AI that is a safety component of critical infrastructure: traffic management, water and gas supply, and electricity grids. If failure could threaten life or critical services, expect the full obligations.
§3 Education and vocational training
AI used to determine access to education, evaluate learning outcomes, or monitor students during tests — admissions screening, automated grading, and exam proctoring are the classic examples.
§4 Employment and worker management
AI for recruitment, candidate evaluation, promotion, and monitoring of workers. Hiring assistants, CV screeners, and productivity trackers all land here. The most common high-risk trigger for private companies.
§5 Essential private and public services
AI that decides access to essential services: creditworthiness scoring, insurance risk pricing, and emergency-call dispatch. Denying someone credit or coverage through AI is exactly what the Act is watching.
§6 Law enforcement
AI used for crime prediction, risk assessment, profiling, and evidence evaluation. Heavy safeguards and, for some uses, separate rules on biometric identification apply.
§7 Migration and border control
AI for travel documents, visa processing, and border surveillance. High stakes for fundamental rights — asylum and migration decisions are specifically protected.
§8 Administration of justice
AI that assists judicial authorities in researching and applying the law, or that supports alternative dispute resolution. Human decision-making by judges is the non-negotiable centrepiece.
The significant-risk test
An Annex III system is high-risk only if it also poses a significant risk to health, safety, or fundamental rights (Art. 6(3)). Providers can document a carve-out — but 'we don't think it matters' is not documentation.
Go deeper
Related guides & tools
See where your AI actually lands
Describe your system in the free Risk Scanner for a preliminary classification and the obligations that likely apply.
Open the Risk ScannerPreliminary EU AI Act clarity summary. Not legal advice.