← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Annex III: the high-risk use case list, explained

Article 6(2) says an AI system is high-risk if it falls within one of the use cases listed in Annex III — unless the Article 6(3) filter takes it back out, because it only performs a narrow procedural task, improves the result of a completed human activity, detects decision-making patterns without replacing human assessment, or is a purely preparatory task.

The eight areas

  1. Biometrics — remote biometric identification, biometric categorisation by sensitive attributes, and emotion recognition, subject to the narrower prohibitions in Article 5.
  2. Critical infrastructure — safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.
  3. Education and vocational training — admission decisions, evaluating learning outcomes, assessing the appropriate level of education, monitoring or detecting prohibited behaviour during tests.
  4. Employment and worker management — recruitment, targeted job ad delivery, decisions on promotion or termination, task allocation, and performance monitoring.
  5. Access to essential services — eligibility for public benefits, creditworthiness and credit scoring, risk assessment and pricing for life and health insurance, emergency call dispatch prioritisation.
  6. Law enforcement — risk assessment of individuals, polygraph-type tools, evaluating evidence reliability, profiling.
  7. Migration, asylum and border control — risk and security assessments, examination of applications, detection and identification tasks.
  8. Administration of justice and democratic processes — assisting judicial research and interpretation of facts and law, influencing the outcome of an election or referendum.

What evidence this implies

Falling into Annex III triggers the full high-risk stack: risk management (Article 9), data governance, technical documentation, logging (Article 12), and registration in the EU database, ahead of the general 2 August 2026 application date (2 August 2027 for the Annex I product-related systems).

Gaps to state honestly

The Article 6(3) exemptions are narrow by design, and the Commission has issued guidance to keep them from becoming a loophole; treat borderline cases as high-risk until you can document why they qualify for the carve-out. See our high-risk classification guide for the classification logic itself.

How Vetro helps

Once a system is classified as high-risk under Annex III, the logging and documentation duties become concrete and ongoing. Vetro's ledger captures the run-level evidence — model calls, tool calls, policy decisions — and the free high-risk classifier can help you check where your system sits before you build the evidence trail. Vetro Attest then verifies your ledger or OTLP trace for free, or produces a 29 USD counter-signed report. Not legal advice.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.

Pricing