When is AI high-risk? Annex III explained for ordinary businesses
Short answer
AI is high-risk when it is used for purposes listed in Annex III of the AI Act: biometrics, critical infrastructure, education (admission, assessment, exam proctoring), employment (recruitment, promotion, dismissal, task allocation, evaluation), access to public services, credit scoring, pricing of life and health insurance, emergency calls, law enforcement, migration and the administration of justice. Since the Digital Omnibus, the rules apply from 2 December 2027. AI that only performs a narrow, preparatory task is exempt – but AI that profiles people is always high-risk.
Annex III in plain English
| Area | High-risk when AI is used for … |
|---|---|
| 1. Biometrics | Remote identification of people, categorisation by sensitive traits, emotion recognition (where not banned) |
| 2. Critical infrastructure | Safety in traffic, water, gas, heating and electricity |
| 3. Education | Admission, assessment, placing students at a level, detecting cheating |
| 4. Employment | Recruitment and selection; promotion, dismissal, task allocation, monitoring and evaluation |
| 5. Essential services | Public benefits, credit scoring of individuals, pricing of life and health insurance, emergency calls |
| 6.–8. Public authorities | Law enforcement, migration, justice and elections |
What must you do as a user?
As a deployer you must, among other things, use the system according to the provider's instructions, give oversight to competent people, make sure input data is relevant, monitor the use, keep logs, inform employees and those affected, and stop using it after a serious incident. See your obligations as a deployer.
Human decisions in practice
This is how it looks when a person decides every case in GoalCube:
Case facts
Louise Brennan
- Current title
- Senior controller
- Experience
- 12 years
- CV
- Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
The AI’s recommendation
Invite to interview
Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.
The AI is unsure about:
Audit log
- Decisions are saved here with the time and a timestamp.
Fictional data. Decide the cases and see the log.
What to do
- Find your use in Annex III.Typically recruitment, HR decisions, credit, insurance or education.
- Assess the exceptions honestly.Does the AI only prepare, or does it really affect the outcome? Profiling is always high-risk.
- Assign people to oversight.People with the competence and authority to step in and decide.
- Tell employees and those affected.Workers' representatives before use in the workplace, and people subject to decisions.
- Keep logs and documentation.At least 6 months, and use the provider's information in your DPIA.
What the law says
- Article 6 AI Act – classification rules for high-risk AI systems
- Article 6(2): AI in Annex III is high-risk. Article 6(3): exceptions for narrow, preparatory tasks; profiling is always high-risk.
- Annex III AI Act
- The list of high-risk areas.
- Article 26 AI Act – obligations of deployers of high-risk AI systems
- What you must do as a user. Applies from 2 December 2027 for Annex III.
Questions and answers
Is it high-risk to use ChatGPT to read CVs?
Yes, when the AI is used to screen or assess applicants. That is recruitment under Annex III, point 4.
What if a human always decides?
That is a requirement, not an exception. The exception in Article 6(3) only applies if the AI does not materially affect the outcome, for example if it only corrects spelling in an application.
Do we need to register in the EU database?
Providers of high-risk AI register the system. Public authorities that use high-risk AI must also register their use. Private businesses that use AI normally don't.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.