Annex III

Annex III: List of High-Risk Use Cases

Annex III lists the use-case categories that make a standalone AI system high-risk under Article 6(2): biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential services, law enforcement, migration and border control, and administration of justice and democratic processes. Falling into a category does not automatically mean the system is high-risk in every case, because of the Article 6(3) carve-out for systems posing no significant risk — except where the system profiles natural persons.

providerdeployer high-risk
When it applies
What it requires
What you keep on file
Commonly misread

Annex III is often treated as a fixed, exhaustive list that automatically means high-risk status; it is subject to Commission amendment, and the Article 6(3) self-assessment carve-out means category membership alone doesn't always equal high-risk status in practice.

Unsettled: Whether the Digital Omnibus altered the substance of any individual Annex III category, beyond timing and the Annex I/III boundary mechanism, was not fully verified against the EUR-Lex primary text in the underlying research.

Recent activity

What regulators published on Annex III

  1. Loading from the public feed…

Informational content only. Not legal advice and not a substitute for qualified counsel. Dates reflect Regulation (EU) 2026/1744 as of 04 Aug 2026.