Annex III

Annex III of the EU AI Act defines eight categories of AI systems that are automatically classified as high-risk due to their potential impact on health, safety, and fundamental rights. If an AI system falls within one of these categories and makes or influences significant decisions about individuals, it triggers the full set of compliance obligations under Articles 8 through 15, including technical documentation, risk management, human oversight, and conformity assessment requirements.

The eight Annex III categories are: (1) Biometrics: Remote biometric identification systems and biometric categorization of natural persons; (2) Critical infrastructure: AI systems used as safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating, and electricity; (3) Education and vocational training: AI systems that determine access to education, evaluate learning outcomes, or assess appropriate levels of education; (4) Employment and worker management: AI systems used for recruitment, promotion decisions, task allocation, and monitoring or evaluation of workers; (5) Access to essential services: AI systems that evaluate creditworthiness, determine pricing for life and health insurance, assess eligibility for public benefits, or evaluate emergency service dispatch priority; (6) Law enforcement: AI systems used for individual risk assessments, polygraphs, evidence reliability assessment, or crime prediction; (7) Migration, asylum, and border control: AI systems for risk assessments, document authenticity verification, or visa and residence permit application processing; (8) Administration of justice: AI systems that assist judicial authorities in researching, interpreting facts and law, or applying law to facts.

Understanding whether your AI system falls under Annex III is the critical first step in EU AI Act compliance planning. The classification determines your entire compliance pathway. High-risk systems under Annex III face extensive documentation requirements (Annex IV), mandatory risk management systems, human oversight obligations, and conformity assessment procedures before they can be placed on the EU market or put into service. The "significant decision" threshold is important: an AI system only becomes high-risk under Annex III if it makes or materially influences decisions that have meaningful effects on individuals, not if it merely provides general information or performs auxiliary functions.

Organizations should conduct a systematic inventory of all AI systems in use or under development, mapping each against the Annex III categories. For borderline cases, consider whether the AI system's output directly influences decisions about individuals' access to services, employment, education, or legal matters. Document your classification rationale thoroughly, as regulators may challenge classifications that appear to minimize compliance obligations. For systems that are clearly high-risk, begin compliance planning immediately: the August 2026 deadline for Annex III systems requires operational compliance, not just documentation in progress.