The Annex III high-risk areas, explained
The eight Annex III use-case areas that make a system high-risk, with real-world examples and how your area shapes your obligations.
An AI system is high-risk under Art. 6(2) when it is used in one of the eight areas listed in Annex III (unless the narrow Art. 6(3) exception applies — see the separate article).
The eight areas
- Biometrics — remote biometric identification, categorisation by sensitive attributes, emotion recognition. Example: face-matching people against a watchlist.
- Critical infrastructure — safety components in digital infrastructure, road traffic, or water, gas, heating and electricity supply. Example: AI managing grid load balancing.
- Education — access and admission, learning evaluation, education-level assessment, exam monitoring. Example: automated proctoring that flags exam cheating.
- Employment — recruitment, filtering and evaluating candidates, HR decisions, task allocation, performance monitoring, termination. Example: a CV-ranking tool that shortlists applicants.
- Essential services — credit scoring, insurance pricing, emergency-call dispatch, public-benefits eligibility. Example: a model that sets your loan decision or life-insurance premium.
- Law enforcement — risk assessment, polygraphs, evidence-reliability evaluation, profiling, crime analytics. Example: predicting reoffending risk for bail decisions.
- Migration, asylum and border control — risk assessment for entering the EU, visa and residence processing, border detection. Example: AI triaging visa applications.
- Justice and democratic processes — judicial research and decisions, dispute resolution, election influence. Example: a tool that drafts judicial rulings.
Why the area matters
The area is not just a label. Veritome stores it on your system's classification, and the obligation engine uses it — together with your role and risk tier — to decide which obligations apply. Some obligations attach only to specific domains (biometric systems, for instance, pull in extra transparency and registration duties), and the area also determines which competent authority is relevant for incidents and registration.
In the registration wizard you pick one Annex III area — the most relevant match. Choosing "None of the Annex III domains" routes you to the transparency (Art. 50) and minimal-risk checks instead.