Complete List of High-Risk AI (Annex III)
The eight Annex III categories, with software examples.
Annex III lists the use cases the EU considers high-risk. If your system falls into one of these areas — even as a small feature — high-risk obligations likely apply.
The eight categories
- Biometrics — remote biometric identification, biometric categorisation, emotion recognition (where not prohibited outright).
- Critical infrastructure — safety components in traffic, water, gas, heating, electricity, and critical digital infrastructure.
- Education and vocational training — admission decisions, evaluating learning outcomes, exam proctoring, assigning students.
- Employment and worker management — CV screening, ranking candidates, promotion and termination decisions, task allocation, monitoring performance. *This catches most HR-tech.*
- Essential services — credit scoring, life and health insurance pricing, emergency call triage, eligibility for public benefits. *This catches most fintech.*
- Law enforcement — risk assessments, evidence evaluation, profiling.
- Migration, asylum and border control — application examination, risk assessments, verification of documents.
- Administration of justice and democratic processes — assisting judicial decisions, influencing elections.
The nuance
A system in these areas can escape the high-risk label if it performs a narrow procedural task or purely assists human review without replacing it (Art. 6(3)) — but you must document that assessment. Guardia AI's classifier asks the Art. 6(3) questions and records your reasoning either way.