EU AI Act High-Risk AI Use Cases by Industry

Do not classify by industry label alone. A hospital, bank, manufacturer, school, recruiter, utility, or public authority can have low-risk, limited-risk, prohibited, and high-risk AI in the same portfolio.

First test Article 6(1): is the AI system a safety component of a covered product, or the product itself, under Annex I product legislation, and is third-party conformity assessment required under that sector law? Then test Article 6(2): is the intended purpose one of the Annex III use cases?

Annex III is best read as a use-case list, not a complete industry list. The same industry can appear under multiple Annex III headings depending on what the AI system is intended to do.

Use the examples below as classification prompts. They do not make every AI system in that industry high-risk; the intended purpose and actual deployment context still control the answer.

Annex I matters where the AI system is tied to product safety. The classification question is not simply whether a manufacturer uses AI; it is whether the AI is the product, or a safety component of a covered product, and whether that sector route requires third-party conformity assessment.

This route is especially relevant for AI in regulated physical products or safety-critical software embedded in them. Regulation (EU) 2026/1744 makes the exact Annex I section decisive. Section A systems generally combine the AI Act with the sector conformity route, subject to future delegated acts that may limit overlapping requirements where sector law provides equivalent protection. For Section B systems, only the amended Article 2(2) AI Act provisions apply directly unless the relevant requirements have been integrated into sector law. Machinery moves into Section B and receives AI-related health and safety requirements through amendments to the Machinery Regulation.

A useful high-risk register should show why a system is high-risk and why nearby systems are not. This avoids over-scoping low-risk tools and under-scoping systems that make or influence decisions about people.

The AI Act also contains scope exclusions that should be separated from Article 6(3). An Article 2 exclusion means the Regulation does not apply to that activity or actor in the described circumstances; an Article 6(3) carveout is a classification result for an Annex III system that would otherwise be high-risk.

Use one record per deployed decision or safety function. The same vendor model can produce different legal results when a hospital, employer, bank, school, emergency service, or manufacturer gives it a different intended purpose.

The examples below are routing examples, not automatic classifications. Confirm the legal use case, the actor controlling the intended purpose, any product-law route, the people affected, and whether an Article 6(3) carveout or another exception can apply.

High-risk classification is only the start. The work changes depending on whether the organisation is the provider placing the system on the market or putting it into service, a deployer using it under its authority, or another operator in the value chain.

Industry teams should avoid pushing all work to either legal or the vendor. For Annex III and applicable Section A routes, the provider usually owns conformity, technical documentation, quality management, logs under its control, registration, CE marking where required, and corrective actions. The deployer owns use according to instructions, human oversight, monitoring, input data under its control, workplace and affected-person notices where applicable, and some registration or impact-assessment duties. For Section B and machinery routes, map the record to the amended sector law instead of assuming the full standalone AI Act package applies directly.