AI in the Administration of Justice Under the EU AI Act: Annex III Point 8
AI used by a judicial authority to research facts and apply law is high-risk under Annex III point 8. Most legal-tech is minimal; judicial use is the line.
Legal AI is mostly minimal-risk — but one slice is high-risk, and it is narrow and specific. Annex III point 8 of the EU AI Act, Regulation (EU) 2024/1689, makes high-risk the AI intended to be used by a judicial authority (or on its behalf) to research and interpret facts and the law and to apply the law to a concrete set of facts. The line is who uses it and for what — not whether the tool touches legal work.
What Annex III point 8 covers
Point 8 covers AI used by or on behalf of a judicial authority to assist in researching and interpreting facts and law and applying the law, and (in its second limb) AI used to influence the outcome of democratic processes and elections in certain ways. The first limb is the judicial-assistance one most legal-tech worries about.
The key qualifier is judicial authority. The high-risk classification attaches when the AI assists a court or judge in the adjudicative function. It does not cover purely administrative court tasks (scheduling, anonymisation, translation) that do not feed the legal reasoning.
Why most legal-tech is not high-risk
The everyday legal AI used by law firms and in-house teams — contract review, e-discovery, legal research, drafting assistance, clause libraries — is generally minimal-risk. It supports lawyers; it does not have a judicial authority applying the law to facts. So a contract-analysis tool or a research copilot at a law firm is not high-risk under point 8. The high-risk line is crossed when the AI assists the adjudicator, not the advocate.
What high-risk justice AI owes — plus the FRIA
Where a system is high-risk under point 8, the full provider/deployer regime applies, with particular weight on human oversight (Article 14) — a judge must remain in genuine control of the decision, with the AI strictly assistive. Because the deployer is a public/judicial authority, a Fundamental Rights Impact Assessment (Article 27) is mandatory before first use. The right to an effective remedy and a fair trial makes oversight and transparency especially load-bearing here.
Worked example: a court pilot vs a law firm tool
A national court pilots an AI that drafts reasoning and suggests how the law applies to case facts for judges — Annex III point 8 high-risk, with mandatory human oversight and an Article 27 FRIA; the judge must remain the decision-maker. Separately, a 60-lawyer firm uses an AI research-and-drafting assistant — minimal-risk, because no judicial authority is applying the law. Same legal domain, opposite tiers, decided by who uses the system and for what.
How Confir helps
Confir tests a legal AI use against the point 8 qualifier — is a judicial authority applying the law to facts? — so a court-assistance system is scoped as high-risk with its Article 27 FRIA, while a law-firm research or drafting tool is correctly recorded as minimal-risk. The engine is deterministic and rule-based, citing the provision that fired.
Frequently asked questions
Is legal AI high-risk under the EU AI Act?
Mostly no. Annex III point 8 makes high-risk only AI used by or on behalf of a judicial authority to research and interpret facts and law and apply the law to concrete facts. Everyday legal-tech used by lawyers — contract review, research, drafting — is generally minimal-risk because no judicial authority is adjudicating with it.
What is the test for high-risk justice AI?
Who uses it and for what. If the AI assists a court or judge in applying the law to facts (the adjudicative function), it is high-risk under point 8. Administrative court tasks like scheduling, anonymisation or translation that do not feed the legal reasoning are not caught.
Do law firms have to treat their AI as high-risk?
Generally not under point 8. Research, drafting and review tools support advocates, not adjudicators, so they are usually minimal-risk. Firms still owe Article 4 AI literacy and must handle client data under confidentiality and GDPR rules.
Is a FRIA required for court AI?
Yes. Because the deployer is a public/judicial authority, a Fundamental Rights Impact Assessment under Article 27 is mandatory before first use, alongside the Article 26 deployer duties and especially strong human oversight under Article 14.
When does the obligation apply?
Stand-alone high-risk Annex III obligations originally read 2 August 2026 in the statute; the Digital Omnibus, now adopted by Parliament and Council, defers them to 2 December 2027, with entry into force pending Official Journal publication, expected before 2 August 2026.
Related guides
- Annex III high-risk use cases
- The FRIA under Article 27
- EU AI Act for legal
- Human oversight protocol template
- How AI risk classification works
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →