Is Traffic Management AI High-Risk Under the EU AI Act? Annex III Point 2

Yes, when the AI is a safety component in the management and operation of road traffic — the infrastructure side, like an adaptive signal-control system at a city junction — it is high-risk under Annex III point 2 of the EU AI Act, Regulation (EU) 2024/1689. But there is a second, easily confused case: AI that drives the car. That takes a different route entirely, with a different deadline. Getting the two apart is the whole job on this page.

Two roads, not one

"Traffic AI" splits into two legally distinct tracks:

• Urban traffic-control infrastructure — adaptive signal timing, ramp metering, incident-responsive junction control. This is AI managing road traffic as critical infrastructure → Annex III point 2 → the stand-alone high-risk route → deadline 2 December 2027.
• In-vehicle autonomous driving — the perception-and-control stack inside an autonomous or driver-assist vehicle. This is a safety component of a regulated product (the vehicle), so it takes the Article 6(1) / Annex I product route through vehicle type-approval law → deadline 2 August 2028.

Same word, "traffic," two different chapters of the Act. Confuse them and you apply the wrong requirements on the wrong timeline.

Track 1 — traffic-control infrastructure (Annex III point 2)

Annex III point 2 makes high-risk the AI intended to be used as a safety component in the management and operation of … road traffic (alongside critical digital infrastructure and water/gas/heating/electricity supply). The trigger is the same as for any infrastructure: AI whose failure or malfunctioning would endanger the life and health of persons or cause significant disruption.

A safety component here is the AI in the loop that physically governs how traffic moves — the controller deciding when a light turns, how an interchange meters flow, how an automated system responds to an incident. If that fails at the wrong moment, it can cause collisions or gridlock. That is the high-risk part.

What is not a safety component:

A model that forecasts congestion for next year's road plan is not controlling anything live — minimal-risk. A controller that decides the signal phase now is a safety component — high-risk. Classify each function on what it physically governs.

Track 2 — autonomous driving (the product route, not Annex III)

The AI that perceives the road and controls an autonomous or assisted vehicle is a safety component of the vehicle, and the vehicle is a product already regulated by EU type-approval legislation. Under Article 6(1), AI that is a safety component of an Annex I product, or is itself such a product, is high-risk and follows that product's sectoral conformity framework — here, vehicle type-approval — rather than the Annex III stand-alone route.

Two consequences flow from this:

1. The deadline is different. Annex I product-embedded high-risk AI under Article 6(1) applies from 2 August 2028 (originally 2 August 2027; moved by Regulation (EU) 2026/1744) — not the 2 December 2027 date for stand-alone Annex III.
2. The conformity route is different. It is integrated into the vehicle's existing type-approval process, not the Annex VI/VII AI-Act route used for stand-alone systems. Vehicles sit in Annex I Section B, so under Article 2(2) the AI Act's requirements reach them through the type-approval rules themselves rather than applying directly.

So "is my self-driving stack high-risk?" — yes, but as an Annex I product safety component on the 2 August 2028 track, not as an Annex III system. Do not file it under Annex III point 2.

What a high-risk traffic-control system owes

For a Track 1 (Annex III point 2) traffic-control safety component, the full high-risk regime applies to provider and deployer: risk management (Article 9), data governance (Article 10), technical documentation to Annex IV (Article 11), logging (Article 12), transparency (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity (Article 15). Conformity goes through the Annex VI internal-control route (Article 43), with the declaration of conformity (Article 47), CE marking (Article 48), national-level registration (Article 49(5) — point-2 systems are excepted from the public EU database) and deployer duties under Article 26. No Article 27 fundamental rights impact assessment is due, even for a public-authority deployer: Article 27(1) expressly excludes systems used in the area of Annex III point 2.

The Article 27 point is easy to get wrong: a municipal traffic authority is a public body, which would normally trigger a FRIA, but Article 27(1) carves critical-infrastructure systems under Annex III point 2 out of the duty. A GDPR Article 35 DPIA may still be needed where the system processes personal data, such as camera feeds.

Worked example: a city's traffic systems and a vendor's vehicle stack

Stadtverkehr Mainz, a municipal road authority, deploys an adaptive signal-control system across the city centre — it decides live signal phases in response to traffic. That is a safety component managing road traffic → Annex III point 2 → high-risk on the 2 December 2027 track. As deployer, Stadtverkehr scopes its Article 26 duties — but no Article 27 FRIA, because point 2 systems are excluded even for public bodies — with strong human oversight (Article 14) so engineers can take manual control.

Separately, AutoSense GmbH (~120 employees, ~€40M turnover) supplies the perception-and-control software inside an automated driving system. That AI is a safety component of the vehicle, an Annex I product — so it is high-risk via Article 6(1), conformity is integrated into vehicle type-approval, and the deadline is 2 August 2028. AutoSense does not file under Annex III. Two organisations, two "traffic" systems, two different routes and two different dates.

How Confir helps

Confir separates the two traffic tracks at intake: it routes urban traffic-control infrastructure through Annex III point 2 (the 2 December 2027 stand-alone high-risk path) and in-vehicle autonomous-driving AI through the Article 6(1) Annex I product route (the 2 August 2028 path), then assembles the right obligations — including the Article 26 deployer duties for a road authority, and no Article 27 FRIA, which point 2 systems are excluded from. The engine is deterministic and rule-based, so the same intake reaches the same route every time.

Related guides

• Critical infrastructure AI: Annex III point 2
• Autonomous vehicles and the AI Act
• How Article 6 classifies high-risk AI
• EU AI Act for automotive
• What a safety component is
• How AI risk classification works