Annex III High-Risk AI: The Eight Areas Under Article 6(2)

Annex III to Regulation (EU) 2024/1689 lists the use-case areas that make an AI system stand-alone high-risk under Article 6(2). "Stand-alone" is the operative word: these systems are high-risk because of what they are used for, not because they sit inside a regulated product. If your system's intended purpose falls inside one of the eight areas, the full high-risk obligation stack applies — Articles 9 to 15, conformity assessment (Article 43), registration (Article 49), and post-market monitoring (Article 72).

This section is for the people who have to make the call: product owners deciding whether a feature crosses the line, compliance officers writing the classification record, and founders scoping the work the Regulation creates. Each guide below takes a single use case, names the Annex III point that catches it, and walks the classification reasoning end to end.

Article 6(2) is not Article 6(1)

The Regulation contains two separate routes into high-risk, and conflating them produces the wrong deadline and the wrong conformity route.

Article 6(1) — the Annex I product route. An AI system that is a safety component of a product covered by the Union harmonisation legislation listed in Annex I — the Machinery Regulation, the Medical Devices Regulation, and the rest — is high-risk by virtue of the product it sits in. These systems generally require third-party notified-body assessment. Obligations apply from 2 August 2028.

Article 6(2) — the Annex III use-case route. An AI system whose intended purpose falls within an Annex III area is high-risk on its own terms, with no host product involved. Most take the internal-control conformity route under Annex VI; remote biometric identification is the notable exception requiring a notified body. Obligations apply from 2 December 2027.

Everything in this section concerns the second route. If your AI is embedded in a CE-marked product, you are on the Annex I track and 2028 governs.

The eight areas

Point 1 — Biometrics. Remote biometric identification (point 1(a)), biometric categorisation inferring sensitive attributes (point 1(b)), and emotion recognition (point 1(c)). Read this alongside Article 5: real-time remote identification in publicly accessible spaces and emotion recognition in workplaces and educational institutions are prohibited outright, not high-risk.

Point 2 — Critical infrastructure. AI used as a safety component in the management and operation of road traffic and the supply of water, gas, heating, electricity, and critical digital infrastructure. The safety-component qualifier does real work here: a billing model for a water utility is not caught; a model that controls pressure in the network is.

Point 3 — Education and vocational training. Admissions and access decisions, evaluation of learning outcomes, assignment to levels of education, and monitoring for prohibited behaviour during tests.

Point 4 — Employment and worker management. Recruitment and selection — CV screening, shortlisting, candidate evaluation — sits at point 4(a). Decisions on promotion, termination, task allocation, and the monitoring and evaluation of performance and behaviour sit at point 4(b). Point 4(b) is broader than most teams expect, and it does not care that a human signs off at the end.

Point 5 — Access to essential private and public services. Eligibility for public assistance benefits and services, including healthcare (point 5(a)); creditworthiness assessment and credit scoring, expressly excluding financial-fraud detection (point 5(b)); risk assessment and pricing for life and health insurance (point 5(c)); and emergency-call evaluation, dispatch prioritisation, and triage (point 5(d)).

Point 6 — Law enforcement. Risk assessment of offending, reoffending, or becoming a victim; polygraph-like tools (point 6(b)); evaluating the reliability of evidence (point 6(c)); and profiling in the course of detecting, investigating, or prosecuting offences (point 6(d)).

Point 7 — Migration, asylum, and border control. Risk assessment of persons entering the Union, examination of asylum, visa, and residence applications, and verification of travel documents.

Point 8 — Administration of justice and democratic processes. AI assisting judicial authorities in researching and interpreting facts and law (point 8(a)), and AI intended to influence the outcome of an election or referendum, or voting behaviour (point 8(b)).

How a system lands in an area, and how it gets out

Classification follows the intended purpose, not the deployment you happen to have today — what your product documentation, marketing, API terms, and instructions for use say the system is for. If any of those reference an Annex III function, you are inside the area; describing the system more modestly in a spreadsheet does not move it out. An internal tool later offered to customers can therefore change classification overnight, and under Article 25 a deployer that puts its own name on a system or substantially modifies it becomes the provider.

Landing in an area makes a system provisionally high-risk. Article 6(3) lets it out where it does not pose a significant risk of harm to health, safety, or fundamental rights, because it does one of four things and nothing more: performs a narrow procedural task; improves the result of a human activity already completed; detects decision-making patterns or deviations without replacing or influencing the human assessment; or performs a preparatory task.

The filter has a hard limit. A system that profiles natural persons is always high-risk, regardless of anything else. And the exemption is not silent — the provider must document the assessment and register it under Article 49. An unsupported claim is itself a compliance failure. A worked contrast: reformatting submitted CVs into a standard template for human review is preparatory; ranking those CVs by predicted suitability is profiling, and the filter is unavailable.

Deadlines

Annex III stand-alone high-risk obligations apply from 2 December 2027. The Digital Omnibus, adopted in June 2026 (European Parliament 16 June, Council 29 June), moved this date; it enters into force on publication in the Official Journal. Annex I product-embedded high-risk follows on 2 August 2028. Article 5 prohibitions have applied since 2 February 2025, so the ban check comes first regardless of any Annex III analysis. Non-compliance carries a ceiling of €15,000,000 or 3% of worldwide annual turnover, whichever is higher (Article 99) — a maximum, not a floor.

How Confir helps

Confir classifies AI systems against Article 6 and Annex III with a deterministic, rule-based engine: the same inputs always produce the same output, and the rule that fired is shown in plain language, so a compliance officer can audit the reasoning rather than trust it. Guided intake establishes intended purpose and context, the classification record feeds the Annex IV technical documentation pack, and where a system is confirmed high-risk, Confir scopes the controls, the Article 27 FRIA where it applies, and the Article 49 registration.