EU AI Act high-risk AI systems (Annex III)

Annex III lists areas where AI is high-risk, such as hiring, credit, education and access to essential services. High-risk systems need risk management, data governance, logging, human oversight and documentation.

Screening questions

Biometrics: remote biometric identification, biometric categorisation, or emotion recognition (where not prohibited)?
Critical infrastructure: a safety component in managing digital infrastructure, road traffic, or water, gas, heating or electricity supply?
Education: deciding admission, evaluating learning outcomes, assessing the level of education, or monitoring students during tests?
Employment: recruiting or selecting people, deciding promotions or terminations, allocating tasks by behaviour or traits, or monitoring and evaluating workers?
Essential services: assessing eligibility for public benefits, creditworthiness or credit scores (other than fraud detection), life or health insurance pricing, or triaging emergency calls?
Law enforcement uses (e.g. assessing the risk of someone becoming a victim or offender, evaluating evidence reliability)?
Migration, asylum or border control (e.g. assessing risks posed by a person, examining applications)?
Administration of justice or democratic processes (assisting judicial decisions, or influencing the outcome of an election or referendum)?

If this applies

A use listed in Annex III. Obligations for these apply from 2 December 2027 (moved from 2 August 2026), unless an Article 6(3) exception applies and you document why.

Screen your AI system free (24 questions)

The AI Governance Toolkit Professional ($599) has the EU AI Act risk assessment workbook for each system, plus the AI policy and risk register, ISO/IEC 42001 gap assessment and NIST AI RMF mapping.

Other parts of the EU AI Act

EU AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI (in force 27 July 2026). Screening questions are our own summary, not legal text. This is a screening aid, not legal advice.