EU AI Act Annex III: High-Risk Deadline Moved to 2027

Key Takeaways

• Annex III lists eight categories of AI use cases that can be classified as high-risk under the EU AI Act. It is not a list of AI systems that are automatically high-risk.
• The application date for Annex III high-risk obligations is December 2, 2027, following the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on July 27, 2026.
• August 2, 2026 was a separate milestone and did not move. Article 50 transparency rules began to apply, and enforcement began for the Article 5 prohibitions, general-purpose AI rules, transparency rules and AI literacy obligations. The prohibitions and AI literacy have applied since February 2, 2025. None of this is the Annex III high-risk regime.
• High-risk AI embedded in regulated products under Annex I (medical devices, machinery, toys and similar) applies from August 2, 2028.
• Classification runs through Article 6, which connects the Annex I and Annex III routes and includes an Article 6(3) filter that can exclude certain narrow, procedural or preparatory systems from high-risk status.
• Profiling of natural persons removes the Article 6(3) exception. A system that profiles individuals inside an Annex III use case is always treated as high-risk.
• Compliance is broader than any single control. It spans risk management, data governance, technical documentation, human oversight and post-market monitoring.
• The later date buys planning time, not a reason to wait. The obligations did not change, only the date they apply.

Annex III matters to almost anyone building, buying or deploying AI in a European market, even if their product doesn't look like a “regulated” system. A recruitment tool, a credit-scoring model or an internal HR analytics dashboard can all touch an Annex III category without anyone on the team realizing the AI Act applies. Getting the classification question right early is usually far cheaper than retrofitting compliance later.

What Is Annex III of the EU AI Act?

Annex III is the annex to Regulation (EU) 2024/1689 (the EU AI Act) that lists eight areas of AI use that can result in an AI system being classified as high-risk. It works together with Article 6, the provision that determines whether a given system is high-risk in law.

There are two separate routes to high-risk status under the AI Act.

The Annex I route (Article 6(1)): an AI system is high-risk if it is a safety component of a product, or is itself a product, covered by the EU product-safety legislation listed in Annex I, and that product must undergo third-party conformity assessment. Think medical devices, machinery, lifts or toys. Following the Digital Omnibus on AI, Article 6(1a) clarifies that AI systems used solely for non-safety aspects such as user assistance, performance optimisation, service efficiency, automation, convenience or quality control are not safety components. Article 6(1b) keeps systems whose failure would endanger health and safety in scope.

The Annex III route (Article 6(2)): an AI system is high-risk if it falls within one of the eight use-case categories in Annex III, subject to the Article 6(3) filter described below.

The two routes carry different timelines and different regulatory logic. Annex III is not a synonym for “high-risk AI system”. It is one gateway into that classification, defined by use case rather than product type.

What Is the Current EU AI Act Annex III Deadline?

The Annex III deadline moved. The original text of the AI Act set August 2, 2026 as the application date for high-risk obligations tied to Annex III. In November 2025, the European Commission proposed delaying that date as part of a broader “Digital Omnibus” simplification package, citing the late arrival of the harmonized technical standards providers need to demonstrate conformity.

The European Parliament and Council reached political agreement in May 2026, the Council gave final approval on June 29, 2026, and Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026. It entered into force on July 27, 2026. Under Article 113, the Annex III rules (Article 6(2)) apply from December 2, 2027, and the Annex I rules (Article 6(1)) from August 2, 2028. The change is enacted law, not a proposal.

Two obligations sit on the August 2, 2026 date and are easy to confuse with Annex III compliance: the Article 50 transparency rules (disclosing that content is AI-generated, telling people they are interacting with an AI system) and the start of enforcement for rules that were already in force. Neither is the Annex III high-risk regime. If your compliance calendar treats August 2, 2026 as the date Annex III obligations become mandatory, it needs correcting.

What enterprises should do hasn't really changed, even though the date has moved. The extra time exists because the technical standards behind conformity assessment weren't ready, not because the obligations became less demanding. Risk management, data governance, documentation and human oversight are the same requirements organizations were already expected to build toward.

What AI Systems Are Listed in Annex III?

Annex III groups high-risk use cases into eight areas. Each area covers specific, defined use cases, not every AI application that touches the general subject matter.

• Biometrics: remote biometric identification (excluding verification whose sole purpose is confirming a person is who they claim to be), biometric categorization based on sensitive attributes, and emotion recognition, where use is permitted under EU or national law.
• Critical infrastructure: AI used as a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.
• Education and vocational training: AI used to determine access or admission, to evaluate learning outcomes, to assess the appropriate level of education for an individual, or to monitor and detect prohibited behavior during tests.
• Employment, workers' management and access to self-employment: AI used for recruitment or selection, for decisions affecting terms of work, promotion or termination, for task allocation based on individual behavior or traits, or for monitoring and evaluating performance and behavior.
• Access to essential private and public services and benefits: AI used to evaluate eligibility for public assistance benefits, for creditworthiness assessment and credit scoring (except fraud detection), for AI risk assessment and pricing in life and health insurance, and for evaluating and dispatching emergency calls.
• Law enforcement: AI used by or on behalf of law enforcement authorities to assess the risk of a person becoming a crime victim, as a polygraph or similar tool, to evaluate the reliability of evidence, to assess the risk of offending or re-offending (not solely on the basis of profiling) or personality traits and past criminal behavior, or to profile people during detection, investigation or prosecution.
• Migration, asylum and border control management: AI used as a polygraph, to assess security, irregular-migration or health risk, to examine asylum, visa and residence-permit applications, or to detect, recognize or identify people at borders.
• Administration of justice and democratic processes: AI used to assist judicial authorities in researching and interpreting facts and law, and AI used to influence the outcome of elections or referenda or voting behavior.

Each category carries carve-outs and conditions in the Act itself. Falling within the general subject area of a category is a starting point for analysis, not a conclusion.

Annex III Use Cases at a Glance

These typical scenarios show how the categories play out. They are not an exhaustive legal determination, and the actual classification of any system depends on its intended purpose and the conditions in Article 6.

• Biometrics: remote facial recognition at a retail entrance identifies people without their active participation. Distinguish this from simple on-device authentication, such as unlocking a personal phone, which is typically out of scope.
• Critical infrastructure: AI monitoring pressure and flow in a water utility network. Assess whether the AI is a genuine safety component, not just a monitoring dashboard.
• Education: AI scoring university admissions essays affects access to education. Test-proctoring and grading tools carry different risk profiles depending on how much weight the AI output has in the final decision.
• Employment: AI ranking CVs for a shortlist directly shapes access to work. Internal tools that only aggregate anonymized workforce trends may fall outside scope; individual-level screening usually does not.
• Essential services: automated creditworthiness scoring for a loan application determines access to financial services. Both traditional statistical models and newer AI-driven ones can fall under this category depending on function.
• Law enforcement: AI assessing an individual's risk of re-offending can affect liberty and due process. Purely administrative or case-management tools without individual risk-scoring may not trigger this category.
• Migration and border control: AI assessing asylum application credibility affects the fundamental rights of vulnerable people. Document-verification tools used purely for authenticity checks may be treated differently from risk-assessment tools.
• Justice and democratic processes: AI assisting judges in legal research can influence judicial reasoning. General-purpose legal research assistants used only for reference, without influencing case outcomes, sit closer to the boundary.

How Article 6 Determines Whether an AI System Is High-Risk

Article 6 is the provision that does the classifying. Annex I and Annex III supply the subject-matter lists; Article 6 supplies the legal test.

• Article 6(1) covers the Annex I route: a product, or safety component of a product, covered by the EU harmonization legislation listed in Annex I that must undergo third-party conformity assessment.
• Article 6(2) covers the Annex III route: AI systems referred to in Annex III are high-risk, subject to Article 6(3).
• Article 6(3) is a filter that narrows the Annex III route. A system within an Annex III use case is not high-risk if it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision-making. The Act sets out specific conditions for when this applies.
• Article 6(4) requires a provider who considers an Annex III system not high-risk to document that assessment before the system is placed on the market or put into service.

Whether a specific system is high-risk depends on a chain of questions. What does the system actually do? What is its stated intended purpose? Does that purpose fall under Annex I or Annex III? If Annex III, does the Article 6(3) filter apply? The presence of AI, machine learning or automation alone answers none of these.

What Is the Article 6(3) Exception?

Article 6(3) exists because Annex III describes broad subject areas, and not every tool operating inside them meaningfully affects a person's rights or safety. An AI system can sit inside an Annex III category, such as employment, and still avoid high-risk classification if its actual function is narrow enough.

The Act gives four situations where this can apply:

• The AI system is intended to perform a narrow procedural task, for example converting unstructured data into a structured format.
• The AI system is intended to improve the result of a previously completed human activity, for example refining the formatting of a document a person already drafted.
• The AI system is intended to detect decision-making patterns or deviations from prior patterns and is not meant to replace or influence the previously completed human assessment without proper human review.
• The AI system is intended to perform a preparatory task to an assessment relevant to an Annex III use case.

Treat this exception carefully, not liberally. Providers that place an AI system in an Annex III area and want to rely on Article 6(3) must document their assessment before the system is placed on the market or put into service. They remain subject to the registration obligation in Article 49(2), and must give national competent authorities that documentation on request (Article 6(4)). Assuming an exception applies because a system feels “supportive” rather than “decisive” is not the same as demonstrating it meets the legal conditions. The stated intended purpose, and how the system functions in practice, controls the outcome, not the marketing description.

When Does Profiling Make an AI System High-Risk?

Article 6(3) includes a hard boundary: an Annex III system is always considered high-risk where it performs profiling of natural persons. Profiling means automated processing of personal data to evaluate aspects of a person, such as work performance, economic situation, health, preferences, reliability, behavior, location or movements.

This matters because profiling is common in exactly the systems businesses are tempted to describe as “just supporting a human”. An HR analytics tool that scores individual employees on performance indicators is profiling, even if a manager makes the final call. A credit tool that builds an individual risk profile from transaction history is profiling, even if it only produces a recommendation.

For compliance and legal teams, a useful early triage question is: does the AI build or use an individual-level profile of a specific person to inform a decision about them? For product leaders and engineers, the difference between an aggregate analytics dashboard (lower exposure) and an individual scoring or ranking tool (higher exposure) is not cosmetic. For CISOs and DPOs, profiling inside an Annex III context is a strong signal that data governance and data protection impact assessment work should happen early, not as an afterthought.

The 8 Annex III High-Risk AI Categories Explained

Biometrics. This category covers remote biometric identification systems (matching biometric data against a reference database, typically without the person's active involvement), biometric categorization that infers sensitive attributes, and emotion recognition. Financial services firms using biometric authentication for account access are generally closer to verification than identification, though the implementation still needs review.

Critical infrastructure. This covers AI functioning as a safety component in managing critical digital infrastructure, road traffic or utility supply. A utility using AI purely for demand forecasting is in a different position from one using AI to directly control safety-relevant valve or grid operations.

Education and vocational training. Admissions decisions, assessment of learning outcomes and proctoring for exam integrity fall here. Education-technology vendors building adaptive learning tools need to separate tools that personalize content delivery from tools that determine access or pass/fail outcomes.

Employment, workers' management and access to self-employment. This is one of the most commonly triggered categories in practice. Recruitment screening, CV ranking, interview analysis and performance monitoring all sit here. HR technology vendors and internal People Analytics teams are a natural focus for scrutiny, particularly where the tool influences hiring, promotion or termination for named individuals.

Access to essential private and public services and benefits. Creditworthiness assessment, insurance pricing and risk assessment for life and health insurance, emergency-call dispatch and eligibility evaluation for public benefits fall here. Banks, insurers and public-sector benefits agencies are the most exposed.

Law enforcement. Risk-assessment tools used by or for police, polygraph-type systems, evidence-reliability tools and profiling during investigations are covered. This category carries some of the strictest conditions in the Act given the fundamental-rights stakes.

Migration, asylum and border control management. Risk and security assessment tools, polygraph-type systems and tools assisting the examination of asylum, visa or residence-permit applications fall here, as do systems that detect, recognize or identify people (other than travel-document verification).

Administration of justice and democratic processes. AI assisting judicial authorities in researching and interpreting facts and applying the law is covered, as is AI intended to influence election outcomes or voting behavior. Tools whose output people are not directly exposed to, such as campaign logistics tools, are carved out.

Across all eight categories, the category defines the subject-matter area, but classification still runs through Article 6. Different implementations within the same industry can land on different sides of the high-risk line.

Annex III Compliance Requirements

Once a system is confirmed high-risk under Annex III, a defined set of obligations applies, primarily to providers, with corresponding duties for deployers.

• Risk management system: an ongoing, documented process to identify and mitigate risks throughout the system's lifecycle, not a one-time assessment.
• Data governance and data quality: training, validation and testing data must meet quality criteria and be examined for possible biases, particularly ones affecting protected groups.
• Technical documentation: a detailed record of the system's design, capabilities and limitations, kept up to date and available to authorities on request.
• Record-keeping and logging: automatic logging of events during operation to support traceability and post-incident investigation.
• Transparency and instructions for use: deployers need enough information to use the system correctly, including its capabilities, limitations and required level of human oversight.
• Human oversight: the system must be designed so a human can effectively understand, monitor and, where necessary, override or stop it.
• Accuracy, robustness and cybersecurity: the system must perform reliably and resist manipulation, adversarial attack or unauthorized access.
• Quality management system: providers need organizational processes to ensure ongoing compliance, not a single certification event.
• Conformity assessment and registration: before market placement, providers must complete the applicable conformity assessment and register the system in the EU database.
• Post-market monitoring and incident reporting: providers must track performance after deployment and report serious incidents to authorities.

None of these are one-step tasks. They are ongoing operational disciplines that need real data infrastructure and governance behind them, not just a policy document.

Annex III Provider vs Deployer Responsibilities

The AI Act splits obligations between the organization that builds and places the system on the market (the provider) and the organization that uses it under its own authority (the deployer). Both Annex I and Annex III systems have providers and deployers. Many enterprises are deployers of third-party tools rather than providers, and the two roles carry different responsibilities.

Providers create and maintain technical documentation, carry out conformity assessment and register the system, design the system to enable effective human oversight, build in automatic logging, and report serious incidents to market surveillance authorities.

Deployers retain the instructions for use and rely on them for correct deployment, verify that the system has undergone conformity assessment before use, assign competent and trained people to exercise human oversight, retain generated logs for the legally required period, and inform the provider (and in some cases authorities) of risks or incidents observed in use. Certain deployers, particularly public bodies and some private entities in credit and insurance contexts, must also carry out a fundamental rights impact assessment.

An organization can be both. If it substantially modifies a third-party system or puts its own brand on it, a deployer can be treated as a provider for that system.

Annex III Compliance Checklist

A working checklist compliance teams can use as a starting inventory:

• Identify every AI system in use or under development across the organization.
• Determine the intended purpose of each system as it will actually be marketed or used.
• Check whether the system falls under the Annex I product-safety route.
• Check whether the system falls within one of the eight Annex III use-case categories.
• Assess the Article 6 conditions relevant to the applicable route.
• Evaluate whether the Article 6(3) exception could apply, and document the reasoning.
• Assess whether the system profiles natural persons. If so, the Article 6(3) exception does not apply.
• Document the classification decision, including the reasoning and evidence relied on.
• Review data governance practices for training, validation and input data.
• Assess the human oversight design and whether personnel are equipped to exercise it.
• Evaluate cybersecurity, robustness and accuracy testing already in place.
• Review existing technical documentation against what Annex IV requires.
• Establish or confirm post-market monitoring and incident-reporting processes.
• Review privacy and data protection implications, including any required data protection impact assessment.
• Identify sensitive or personal data flowing into the system and where it originates.
• Reassess third-party AI vendors used as part of the organization's own systems.

This list is a practical starting point, not legal advice. Organizations with material exposure to Annex III categories should involve qualified legal counsel in the classification decision.

How to Determine Whether Your AI System Falls Under Annex III

A simplified way to work through the classification question:

1. Is the technology actually an “AI system” as defined under the Act?
2. What is its stated intended purpose, and how is it used in practice?
3. Does it fall under the Annex I product-safety route via Article 6(1)?
4. Does it fall within one of the eight Annex III categories via Article 6(2)?
5. If so, does the Article 6(3) exception apply?
6. Does the system profile natural persons? If yes, the exception is unavailable.
7. What obligations follow from the resulting classification?
8. What documentation, governance and oversight structures need to be built or strengthened?

Annex III Classification Decision Tree

As a planning aid, the sequence runs: identify the AI system and its intended purpose → check the Annex I product-safety route → if not covered, check the Annex III use-case categories → assess the Article 6 conditions → assess the Article 6(3) exception → check for profiling of natural persons → determine classification (high-risk or not high-risk) → map the applicable compliance obligations.

This decision tree is a simplified planning aid, not a substitute for a documented legal classification exercise.

Annex I vs Annex III

Assess both routes, because some AI products can touch either depending on how they are embedded. A diagnostic AI tool built into a certified medical device is analyzed under the Annex I route, while a hospital's separate AI tool for triaging patient access to a service could be analyzed under Annex III.

Annex III vs Prohibited AI Under Article 5

Annex III and Article 5 are frequently confused, but they describe entirely different regulatory categories.

• Article 5 lists AI practices that are prohibited outright, regardless of use case. Examples include social scoring by public authorities and manipulative AI that exploits vulnerabilities. From December 2, 2026, it also covers AI systems that generate non-consensual intimate imagery or child sexual abuse material. Most Article 5 prohibitions have applied since February 2, 2025, with enforcement starting on August 2, 2026. Prohibited practices cannot be brought into compliance through documentation or oversight; they are simply not permitted.
• Annex III lists use cases that may result in high-risk classification, which is a compliance regime, not a ban. High-risk systems can be lawfully placed on the market once they meet the applicable obligations.
• Other AI systems, such as most general-purpose AI models, chatbots and content-generation tools outside the prohibited categories, fall under separate transparency obligations (Article 50) or, in many cases, no specific AI Act risk tier beyond general provisions.

A prohibited system cannot be “fixed” through compliance work, while a high-risk Annex III system can be lawfully deployed with the right controls in place.

Real-World Annex III Examples

• AI recruitment screening that ranks or shortlists individual candidates is generally treated as high-risk within the employment category, since it directly affects access to a job.
• Employee performance evaluation tools that individually score or rank workers typically fall under the same category, particularly where they involve profiling.
• Creditworthiness assessment models used to evaluate natural persons or establish their credit score are within Annex III point 5(b), with one exception: AI systems used to detect financial fraud.
• Biometric identification systems used for remote identification are generally high-risk. Biometric verification whose sole purpose is confirming a person is who they claim to be, such as unlocking a personal device, is excluded.
• Educational admissions tools that materially influence acceptance decisions are typically high-risk; tools that only suggest supplementary reading materials generally are not.
• AI systems supporting access to essential public services, such as automated eligibility screening for benefits, generally fall within scope.
• Law enforcement risk-assessment tools used to assess the risk of offending, re-offending or victimization are treated as high-risk given the fundamental-rights implications.
• Migration and asylum assessment tools used to evaluate applications or assess risk are similarly high-risk.
• Certain justice-related AI applications that assist judicial reasoning in ways that could influence outcomes are high-risk. Purely reference-based legal search tools sit closer to the boundary and require individual assessment.

Each example is “potentially high-risk”, meaning the general pattern of use typically triggers Annex III scrutiny. None is automatically high-risk in every implementation. The specific intended purpose, the presence of profiling and the Article 6(3) conditions still need to be assessed for each system.

What Enterprises Should Do Now

The December 2027 date is not a reason to slow down. It is extra time to do the classification and governance work properly rather than under deadline pressure. A practical sequence:

• Inventory every AI system in use, in procurement or in development, including tools embedded in third-party software the organization didn't build.
• Classify each use case against the Annex I and Annex III routes, documenting the reasoning.
• Map data flows into and out of each AI system, particularly where personal or sensitive data is involved.
• Identify sensitive and personal data moving through AI workflows, including data sent to third-party or general-purpose AI models as part of normal use.
• Document intended purpose clearly and consistently across product documentation, marketing and technical specifications. Inconsistent descriptions of the same system are a common source of classification disputes.
• Establish governance structures, a cross-functional group spanning legal, compliance, security and product that owns AI classification and monitoring.
• Assess third-party AI vendors, since deploying someone else's high-risk system still carries deployer obligations.
• Evaluate privacy and security controls around how data reaches AI systems in the first place, not just how the system is documented.
• Establish human oversight mechanisms with named, trained personnel, not a theoretical policy nobody exercises.
• Prepare technical documentation ahead of time so it isn't assembled retroactively under audit pressure.
• Monitor regulatory developments, since guidelines, delegated acts and harmonized standards will continue to be published as December 2027 approaches.

The inventory step is where many organizations discover their real exposure. It is rarely the purpose-built high-risk system that creates the biggest surprise. It is the everyday tools: a support team pasting customer records into a general-purpose chatbot, an HR team uploading resumes into a screening tool, a finance team feeding contract data into a document-analysis assistant. None of that shows up on a compliance spreadsheet until someone looks at the data flow.

What Does Annex III Mean for Enterprise AI Data?

Annex III compliance is fundamentally a use-case and governance question, but almost every use case on the list depends on sensitive data: employee records for HR tools, financial history for credit scoring, health information for insurance risk assessment, biometric data for identification, case files for legal and law enforcement tools.

That creates a second problem alongside classification: reducing how much sensitive data reaches AI systems, and controlling what happens to it once it does. This is where data governance meets day-to-day AI usage, not just in purpose-built high-risk systems but in the broader pattern of employees pasting confidential documents, customer records or proprietary information into AI tools.

This is the problem Questa AI is built around: reducing sensitive-data exposure in AI workflows before that data reaches a model. Questa AI's approach, including its Blackbox Anonymization, focuses on identifying and protecting sensitive business information, personal data and confidential documents as they move into AI systems, rather than retroactively auditing what a model already processed.

It is worth being precise about what this does and doesn't solve. EU AI Act compliance for an Annex III system is broader than anonymization alone. It includes risk management, technical documentation, human oversight and conformity assessment, none of which a data-protection layer replaces. Questa AI can help reduce sensitive-data exposure as part of a broader AI governance and compliance strategy, not as a substitute for the full set of Annex III obligations. For organizations working on enterprise AI privacy and security, data protection technology is one component alongside governance, documentation and oversight.

Organizations that want to assess their AI data exposure typically start with a narrower question than “are we AI Act compliant?”: where is sensitive data currently flowing into AI tools, and what controls exist around that flow today? That question can be answered well before December 2027, and answering it early gives compliance, security and product teams a much clearer picture of where the real Annex III exposure sits.

Frequently Asked Questions

Where This Leaves Enterprise AI Teams

Annex III sets out which categories of AI use can trigger high-risk obligations under the EU AI Act, but the classification of any given system runs through Article 6 and, for many enterprise tools, through the Article 6(3) exception and the question of profiling. The December 2, 2027 application date, confirmed by the Digital Omnibus on AI, gives organizations real additional time to get that work right. August 2, 2026 was a separate milestone for transparency and enforcement obligations that shouldn't be confused with the Annex III regime.

The organizations in the best position by December 2027 will be the ones that used the extended timeline for actual preparation: a documented AI system inventory, clear classification records, functioning human oversight and a real picture of where sensitive data moves through their AI workflows. That last piece sits underneath nearly every Annex III category, from employment to credit scoring to biometric identification, which is why it deserves attention alongside the legal classification work rather than after it. Questa AI supports that piece of the picture, helping organizations reduce sensitive-data exposure as AI systems handle employee records, financial information, health data and other confidential material. It is one part of a broader compliance strategy that still needs governance, documentation and oversight built around it.

Conclusion

The Annex III deadline has moved, but the work behind it has not. High-risk obligations for Annex III systems now apply from December 2, 2027, and for Annex I products from August 2, 2028. August 2, 2026 was a different milestone, covering transparency and enforcement rules, and should not be confused with the Annex III regime.

The practical takeaway is to use the extra time well. Build a complete AI inventory, classify each system through Article 6, document any reliance on the Article 6(3) exception, watch for profiling, and map where sensitive data flows into your AI tools. Teams that start now will reach December 2027 with evidence and working controls, not a last-minute scramble.