EU AI Act Compliance by Industry
EU AI Act sector guides: which industries hit Annex III high-risk (2 Dec 2027) vs the Annex I product route (2 Aug 2028), plus Article 50 duties from 2 Aug 2026.
The EU AI Act does not regulate industries. It regulates uses. Regulation (EU) 2024/1689 attaches obligations to what an AI system is for — its intended purpose — not to the sector of the company operating it. A CV-screening model is high-risk in a hospital, a bank, and a shipyard alike, because Annex III point 4 covers employment, not healthcare, finance, or maritime.
Sector still matters, and this section exists because of it. Every industry deploys a recognisable, repeating set of AI use cases, and those use cases cluster around a predictable handful of Annex III points. Manufacturers keep landing on the Annex I product route. Insurers keep landing on Annex III point 5. Knowing your sector's typical pattern does not classify your system — only the intended-purpose analysis under Article 6 does that — but it tells you where to look first.
These guides are for compliance leads, product owners, and legal counsel who need to know which parts of the Regulation their sector touches before starting a system-by-system assessment.
The two routes into high-risk
Almost every high-risk classification arrives by one of two routes. Which route you are on determines your deadline, your conformity assessment, and your notified-body exposure.
The Annex III route (Article 6(2)) — stand-alone high-risk
Annex III lists eight use-case areas: biometrics, critical infrastructure, education and vocational training, employment and workers management, access to essential private and public services, law enforcement, migration and asylum, and administration of justice and democratic processes. If a system's intended purpose falls within one of them, it is provisionally high-risk.
Most software, financial services, HR, education, insurance, and public-sector AI arrives here. Conformity assessment is normally internal control under Annex VI. The deadline is 2 December 2027.
The Annex I route (Article 6(1)) — product-embedded high-risk
Where the AI is a safety component of a product already covered by Union harmonisation legislation listed in Annex I — the Medical Devices Regulation, the Machinery Regulation, motor vehicle type-approval, civil aviation, lifts, pressure equipment — the AI Act layers onto that existing CE-marking regime rather than running beside it.
Medical device makers, machinery and robotics manufacturers, vehicle suppliers, and aerospace suppliers are typically on this route. The conformity assessment is the one already required by the sectoral legislation, extended to cover the AI Act requirements, and it usually involves a notified body. The deadline is 2 August 2028.
Sectors do not have a route — systems do
The distinction is not academic. A robotics company selling an autonomous industrial machine is on the Annex I route through the Machinery Regulation. The same company using AI to screen maintenance-engineer applicants is simultaneously on the Annex III route through point 4, with a deadline twenty months earlier. Expect most companies to carry systems on both routes at once.
What applies to your sector regardless of risk tier
Three sets of duties reach almost every industry and do not depend on a high-risk classification at all.
Article 5 prohibitions, enforceable since 2 February 2025. Eight practices are banned outright, and several cut across ordinary commercial sectors: emotion recognition in the workplace, biometric categorisation inferring sensitive attributes, and exploitation of vulnerabilities. Social scoring under Article 5(1)(c) is not limited to public authorities — it binds private actors too, which catches retail, insurance, and platform businesses that score customers on general social behaviour.
Article 4 AI literacy, also from 2 February 2025. Any organisation putting AI systems into use must ensure the staff operating them have a sufficient level of AI literacy. There is no sector carve-out and no risk-tier threshold.
Article 50 transparency, from 2 August 2026. Chatbots must disclose that the person is interacting with a machine, emotion recognition must be notified to the people it processes, and synthetic media must be disclosed. A separate, later date applies to the machine-readable content-marking duty in Article 50(2): 2 December 2026. Marketing, media, gaming, telecom, and customer-service-heavy sectors reach these obligations long before any high-risk deadline, and often assume incorrectly that a minimal-risk classification means nothing is due.
Penalties are ceilings, not floors: up to €35,000,000 or 7% of total worldwide annual turnover, whichever is higher, for breach of the Article 5 prohibitions (Article 99).
How to read a sector guide
Each guide maps its sector's common AI use cases to the Annex III points or Annex I legislation they engage, identifies whether the typical company is a provider (Article 16) or a deployer (Article 26), and flags where Article 25 flips a deployer into a provider — usually by putting your own brand on a system, substantially modifying it, or changing its intended purpose. Where a sector routinely triggers a Fundamental Rights Impact Assessment under Article 27 — public bodies, credit scoring, insurance pricing, education — the guide says so.
Use a sector guide to build a shortlist of candidate systems and likely classifications. Then classify each system individually against Article 6 and, where an Annex III area matches, the Article 6(3) filter. Sector patterns orient you; they do not substitute for the assessment.
One timing note that colours every guide: the Digital Omnibus was adopted in June 2026 — Parliament on 16 June, Council on 29 June — and enters into force on publication in the Official Journal. It set the 2 December 2027 and 2 August 2028 high-risk dates. It did not move the Article 5, Article 4, or Article 50 dates.
How Confir helps
Confir's classification engine is deterministic and rule-based. You describe a system's intended purpose through guided intake, and Confir derives the risk tier, the route (Annex III or Annex I), your role, and the scoped obligations — showing the rule that fired in plain language. From there it drives the Article 27 FRIA where required, the Annex IV technical documentation, the EU Declaration of Conformity, Article 50 transparency, and Article 73 incident reporting, in one EU-hosted register.
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →