Are industry AI use cases high-risk under Annex III?

An industry AI use case is high-risk under Annex III only when the AI system is intended to be used for one of the listed Annex III areas or when it separately meets the product safety-component rule in Article 6(1). The Commission FAQ explains that high-risk classification is based on intended purpose: the function performed by the system and the specific purpose and modalities for which it is used.

For industrial teams, that means a predictive-maintenance dashboard, production-quality analytics tool, or internal knowledge assistant is not high-risk merely because it is used in a factory, utility, insurer, bank, or public-sector supplier. The question is whether the intended purpose matches a listed high-risk use case, such as safety components in specified critical infrastructure, recruitment, worker management, creditworthiness, life or health insurance risk assessment and pricing, emergency triage or dispatch, biometric use, education, law enforcement, migration, justice, or democratic processes.

Commission examples and draft classification guidelines can help apply the rule, but they do not add an Annex III category. Record the exact Annex III point, the system's intended purpose, and the deployment facts instead of classifying from an industry label or an example alone.

The practical boundary is not the customer's industry label; it is the legal use case. Annex III covers eight areas: biometrics; critical infrastructure; education and vocational training; employment, workers' management and access to self-employment; access to essential private and public services and benefits; law enforcement; migration, asylum and border control management; and administration of justice and democratic processes.

Industrial uses most often need closer review where the AI affects natural persons or safety-critical infrastructure. Examples include recruitment screening for plant workers, task allocation or performance monitoring based on worker behaviour, credit scoring of natural persons, life or health insurance pricing, emergency-call triage, biometric identification, emotion recognition, or an AI safety component in road traffic, critical digital infrastructure, or water, gas, heating or electricity supply. By contrast, equipment-failure forecasting, inventory planning, energy-use optimisation, document search, or translation may fall outside Annex III if they do not serve a listed intended purpose.

Article 6(3) is an exception to the Annex III rule, not a shortcut around it. It can apply only where an Annex III-referred system does not pose a significant risk of harm to health, safety, or fundamental rights, including because it does not materially influence the outcome of decision-making, and at least one of the four listed conditions is fulfilled.

The supported conditions are narrow: a narrow procedural task; improving the result of a previously completed human activity; detecting decision-making patterns or deviations without replacing or influencing the prior human assessment without proper human review; or performing a preparatory task for an Annex III assessment. The exception is not available where the Annex III system performs profiling of natural persons, because Article 6(3) says such systems are always high-risk.

For an Annex III high-risk conclusion, provider evidence should connect the intended purpose to the relevant Annex III point, then show the high-risk system records needed for conformity, traceability, and registration. The Commission FAQ identifies provider obligations before EU market placement or putting into service, including conformity assessment, quality management, and EU database registration.

For an Article 6(3) non-high-risk conclusion, the evidence should be different: it should explain the condition relied on, the grounds for the non-high-risk conclusion, and why the system does not materially influence a decision or otherwise pose significant risk. Annex VIII Section B specifically includes the Article 6(3) condition or conditions and a short summary of the grounds for treating the system as not high-risk.

Track application dates by classification route. Regulation (EU) 2026/1744, published on 24 July 2026 and entering into force on 27 July 2026, moves the Chapter III Sections 1 to 3 duties to 2 December 2027 for Article 6(2) Annex III systems and 2 August 2028 for Article 6(1) Annex I systems. Article 72 post-market monitoring and Article 73 serious-incident reporting remain on the general 2 August 2026 application date. Record the provision and system route used for each deadline instead of assigning one date to every high-risk duty.