Are industry AI use cases high-risk under Annex III?

An industry AI use case is high-risk under Annex III only when the AI system is intended to be used for one of the listed Annex III areas or when it separately meets the product safety-component rule in Article 6(1). The Commission FAQ explains that high-risk classification is based on intended purpose: the function performed by the system and the specific purpose and modalities for which it is used.

For industrial teams, that means a predictive-maintenance dashboard, production-quality analytics tool, or internal knowledge assistant is not high-risk merely because it is used in a factory, utility, insurer, bank, or public-sector supplier. The question is whether the intended purpose matches a listed high-risk use case, such as safety components in specified critical infrastructure, recruitment, worker management, creditworthiness, life or health insurance risk assessment and pricing, emergency triage or dispatch, biometric use, education, law enforcement, migration, justice, or democratic processes.

The practical boundary is not the customer's industry label; it is the legal use case. Annex III covers eight areas: biometrics; critical infrastructure; education and vocational training; employment, workers' management and access to self-employment; access to essential private and public services and benefits; law enforcement; migration, asylum and border control management; and administration of justice and democratic processes.

Industrial uses most often need closer review where the AI affects natural persons or safety-critical infrastructure. Examples include recruitment screening for plant workers, task allocation or performance monitoring based on worker behaviour, credit scoring of natural persons, life or health insurance pricing, emergency-call triage, biometric identification, emotion recognition, or an AI safety component in road traffic, critical digital infrastructure, or water, gas, heating or electricity supply. By contrast, equipment-failure forecasting, inventory planning, energy-use optimisation, document search, or translation may fall outside Annex III if they do not serve a listed intended purpose.

Article 6(3) is an exception to the Annex III rule, not a shortcut around it. It can apply where an Annex III-referred system does not pose a significant risk of harm to health, safety, or fundamental rights, including because it does not materially influence the outcome of decision-making.

The supported conditions are narrow: a narrow procedural task; improving the result of a previously completed human activity; detecting decision-making patterns or deviations without replacing or influencing the prior human assessment without proper human review; or performing a preparatory task for an Annex III assessment. The exception is not available where the Annex III system performs profiling of natural persons, because Article 6(3) says such systems are always high-risk.

For an Annex III high-risk conclusion, provider evidence should connect the intended purpose to the relevant Annex III point, then show the high-risk system records needed for conformity, traceability, and registration. The Commission FAQ identifies provider obligations before EU market placement or putting into service, including conformity assessment, quality management, and EU database registration.

For an Article 6(3) non-high-risk conclusion, the evidence should be different: it should explain the condition relied on, the grounds for the non-high-risk conclusion, and why the system does not materially influence a decision or otherwise pose significant risk. Annex VIII Section B specifically includes the Article 6(3) condition or conditions and a short summary of the grounds for treating the system as not high-risk.