EU AI Act in Public Administration: Annex III, 5 + 6 + 7 + 8

Main article: High-risk AI under Annex III — classification — it sets out all eight Annex III areas and the full classification path.

1. Annex III, 5: social benefits

Short answer: Annex III no. 5 is the area of "access to and enjoyment of essential private services and essential public services and benefits"; among other things, the Regulation names creditworthiness, health and life insurance, and emergency calls there. For all systems listed in Annex III, the high-risk classification follows from Art. 6(2) AI Act — subject to the narrow exemption in Art. 6(3) (section 6).

Housing benefit, citizen's benefit, automated child-benefit calculation (examples from Germany; unemployment benefit II was replaced by the citizen's benefit (Bürgergeld) on 1 January 2023). Use is high-risk where the system assesses benefit entitlement in an automated manner. As an EU regulation, the AI Act applies directly and with identical content in Germany and Austria: classification does not depend on the name of the benefit but on the automated assessment of entitlement — it applies to Austrian benefits administration in the same way.

Three work steps follow from this for the body granting the benefit: clarify its own role (deployer under Art. 3 no. 4 or provider under Art. 3 no. 3 — section 9), set up the deployer obligations under Art. 26 (section 8) and document the fundamental rights impact assessment under Art. 27 (section 7). For private bodies, the same area applies via creditworthiness assessment (Annex III no. 5(b)) and life/health insurance scoring (no. 5(c)).

2. Annex III, 6: law enforcement

Short answer: Annex III no. 6 covers AI in law enforcement — typical examples are risk assessment of offenders and predictive policing; these systems are high-risk, not prohibited.

Under Annex III no. 6(c) and (d), predictive policing and AI-assisted evaluation of evidence are high-risk applications — not prohibited: permitted subject to the strict requirements of the AI Act (Art. 8–15, Art. 26) and only "in so far as their use is permitted under relevant Union or national law" (introductory wording of Annex III no. 6). As an EU regulation, this applies equally in Germany and Austria; Switzerland is not subject to the AI Act. What Art. 5(1)(d) prohibits is solely the prediction of criminal offences based solely on profiling or on assessing personality traits and characteristics.

Two particularities shape implementation in this area. First, registration: registration takes place only in the non-public section of the EU database (Art. 49(4), section 9) — this does not remove the obligation, only the public visibility of the entry. Second, the exemption test: the exemption under Art. 6(3) is ruled out where profiling takes place (section 6).

3. Annex III, 7: migration/asylum

Short answer: Annex III no. 7 covers migration, asylum and border control; typical systems are visa assessment algorithms and asylum routing.

Risk assessment and security scoring are typical applications in this area. Those addressed are immigration, asylum and border authorities as well as the IT service providers working for them; in our practical assessment, SMEs are rarely affected.

Classification, deployer obligations and the FRIA follow the pattern of the other areas — sections 6 to 8; as with no. 6, registration takes place only in the non-public section of the EU database (Art. 49(4), section 9). Practical recommendation (not a statutory requirement): public authorities procuring such systems through service providers should settle the allocation of roles contractually before operation begins — the deployer obligations under Art. 26 apply to the body using the system, regardless of who built the software.

4. Annex III, 8: justice + democracy

Short answer: Annex III no. 8 is the area of administration of justice and democratic processes; the examples named are case-law research algorithms and election influencing.

It therefore covers AI systems that prepare judicial decisions as well as AI in the electoral system; high compliance standards apply to both.

The high-risk requirements of Art. 9 to 15 apply to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026); Art. 43, 49, 72 and 73 are not covered by this postponement. Which of them apply to the authority itself depends on its role (distinction between deployer and provider in section 9). One point distinguishes no. 8 from areas no. 6 and no. 7: the special rule in Art. 49(4) — entry only in the secure, non-public section of the EU database — names only areas nos. 1, 6 and 7; for systems under no. 8, the regular entry therefore remains (Art. 49(1) for providers, Art. 49(3) for public authorities as deployers). The fundamental rights impact assessment under Art. 27 applies directly to judicial and electoral authorities like all public bodies; it applies to Annex III systems from 2 December 2027 (section 7).

5. Prohibitions (Art. 5)

Short answer: since 2 February 2025, Art. 5 has prohibited eight practices (Art. 5(1)(a)–(h)); two further prohibitions inserted by Regulation (EU) 2026/1744 (points (ba) and (bb): non-consensual intimate depictions of identifiable persons and material within the meaning of Directive 2011/93/EU) apply from 2 December 2026. The most relevant for public authorities are social scoring and real-time remote biometric identification in publicly accessible spaces, which remains permissible for law enforcement purposes only under narrowly defined exceptions.

Art. 5 has applied since 2 February 2025 and has therefore been applicable for more than a year. Art. 5(1) prohibits, among other things: (a) subliminal influence or purposefully manipulative or deceptive techniques to materially distort behaviour causing significant harm, (b) exploiting vulnerabilities due to age, disability or social or economic situation, (c) social scoring, (d) predictive risk assessment of a criminal offence based solely on profiling, (e) untargeted scraping of facial images from the internet or from CCTV footage, (f) emotion recognition in the workplace and in education institutions, (g) biometric categorisation to infer sensitive attributes and (h) real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, for which only narrowly defined exceptions exist.

Infringements of Art. 5 carry the highest range of fines in the Regulation (Art. 99(3), section 10).

6. Art. 6(3): the exemption and its limit

Short answer: by way of derogation, a system listed in Annex III is exceptionally not considered high-risk where it does not pose a significant risk to health, safety or fundamental rights — the exemption is, however, ruled out as soon as the system performs profiling of natural persons (Art. 6(3)).

The exemption holds only where the system exclusively performs a narrow procedural task (such as sorting), performs a limited task within the use case, or carries out a specific activity that supports rather than replaces human action. Where the system produces recommendations or assessments capable of materially influencing human decisions, it remains high-risk AI — despite Art. 6(3).

First check, therefore, whether the system performs profiling of natural persons; if it does, the exemption does not apply. Practical recommendation (not a statutory requirement, but interpretative practice): interpret narrowly and, in case of doubt, classify as high-risk — classifying too low creates a risk of fines up to EUR 15 million or 3% of turnover (Art. 99(4); on public authorities in Germany see section 10), while classifying too high only costs additional effort. Relying on the exemption does not remove documentation duties either: providers who conclude under Art. 6(3) that their system is not high-risk register under Art. 49(2).

7. FRIA under Art. 27: addressees, content, start of application

Short answer: the fundamental rights impact assessment (FRIA) under Art. 27(1) applies to deployers of high-risk AI systems under Annex III (except no. 2, critical infrastructure) that are bodies governed by public law or private entities providing public services — so directly to public bodies; independently of that, it applies to deployers of systems for creditworthiness assessment (Annex III no. 5(b)) and life/health insurance scoring (no. 5(c)).

In substance, the FRIA covers, among other things, a description of the AI use, the persons affected, the risks to fundamental rights and the safeguards. Its purpose therefore differs from the deployer documentation under Art. 26: there the focus is on proper operation, here on the fundamental rights consequences for those affected.

In terms of timing, Art. 27 applies to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744 — Digital Omnibus AI, in force since 27 July 2026); the general start of application on 2 August 2026 remains unchanged for the other provisions, such as Art. 50. Practical recommendation (no statutory cycle): carry out the FRIA per system rather than per authority and review it again where the purpose of use, the data basis or the group of persons affected changes.

8. Deployer obligations of the authority (Art. 26) and transparency (Art. 50)

Short answer: as the deployer of a high-risk AI system, the authority checks input data for relevance (Art. 26(4)), keeps the automatically generated logs for at least six months (Art. 26(6)) and informs its workers (Art. 26(7)); the transparency obligations under Art. 50 apply in addition. These deployer obligations form part of Chapter III Section 3 and apply to Annex III systems from 2 December 2027 under Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744; the transparency obligations in Art. 50 have applied since 2 August 2026.

Art. 50 addresses deployers in two situations: anyone operating an emotion recognition system or a biometric categorisation system must inform the persons affected (paragraph 3); anyone generating or manipulating deep fakes must disclose that the content has been artificially generated or manipulated (paragraph 4). By contrast, the marking obligations for synthetic audio, image, video and text content and the AI notice on direct interaction apply to providers (paragraphs 1 and 2). Alongside Art. 50, the national administrative procedure acts remain decisive (DE: VwVfG; AT: AVG).

The following overview lists the statutory obligations under the AI Act dealt with in this article — no practical recommendations and no exhaustive list of deployer obligations; the trigger is stated for each row.

9. Registration (Art. 49) — and when the authority becomes a provider

Short answer: on the deployer side, the registration obligation under Art. 49(3) applies only to deployers that are public authorities or Union institutions, bodies, offices and agencies — and for all Annex III systems except no. 2 (critical infrastructure). Other deployers are not subject to the registration obligation under Art. 49(3).

Art. 49(1) applies in parallel to providers: registration for all high-risk AI systems under Annex III, with the single exception of systems under no. 2. The obligation is therefore limited neither to public bodies nor to Annex III no. 1. Under paragraph 2, providers who conclude under Art. 6(3) that their system is not high-risk register in addition. For systems under Annex III nos. 1, 6 and 7, registration under paragraph 4 takes place only in a secure, non-public section of the database.

The role is not fixed: under Art. 25, a deployer moves into the provider role where it substantially modifies the purpose or the functionality or places the system on the market under its own name. For an authority that has a specialist procedure developed or substantially adapted for it, this is the most demanding point of the assessment: where one of the Art. 25 conditions is met — substantial modification of purpose or functionality, or placing on the market under its own name — the full provider obligations apply, in particular conformity assessment (Art. 43) and entry in the EU database (Art. 49(1)).

10. Deadlines and fines

Short answer: of the dates relevant to public administration, the prohibitions (since 2 February 2025) and the transparency obligations in Art. 50 (since 2 August 2026) have taken effect; the Annex III obligations including the FRIA apply only from 2 December 2027, and for Annex I application begins only on 2 August 2028 (Regulation (EU) 2026/1744, in force since 27 July 2026 — see table).

All the dates in the following overview are statutory starts of application under Art. 113 AI Act — no practical recommendations and no internal target dates.

The range of fines has three tiers: infringements of the prohibited practices under Art. 5 up to EUR 35 million or — for undertakings — 7% of worldwide annual turnover (Art. 99(3)); infringements of other obligations, expressly including the deployer obligations under Art. 26 and the transparency obligations under Art. 50, up to EUR 15 million or 3% (paragraph 4); incorrect, incomplete or misleading information supplied to authorities up to EUR 7.5 million or 1% (paragraph 5). In each case the higher amount applies; for SMEs, including start-ups, the lower amount applies (Art. 99(6)). The penalty regime is otherwise governed by national law within the framework of Art. 99(1). In Germany, no fines are imposed on public authorities and other public bodies within the meaning of § 2(1) or (2) BDSG in the cases of Art. 99(3) to (5) (§ 17(2) KI-MIG). For EU institutions, EDPS supervision applies with fines up to EUR 1.5 million (Art. 100).

11. What applies in addition in Germany and Austria

Short answer: the AI Act itself applies directly and in identical wording in both countries; what differs nationally are the accompanying rules — here: the national AI implementing law, data protection supervision, data protection officers and the NIS2 classification of public administration (on AI market surveillance see the FAQ, on the penalty regime see section 10). In Germany, the German AI Market Surveillance and Innovation Promotion Act (KI-MIG) has applied since 29 July 2026: the market surveillance authority is the Federal Network Agency (Bundesnetzagentur) (§ 2(1)), in so far as sectoral authorities are not competent; for Annex III nos. 6, 7 and 8 and for no. 1, in so far as law enforcement, border management, administration of justice and democratic processes are concerned, the independent AI market surveillance chamber at the Federal Network Agency decides (§ 2(5) in conjunction with § 4), and for public bodies of the Länder the Länder are competent (§ 2(6)); as at the date of this article (17 August 2026), Austria has not designated an authority under Art. 70 AI Act.

In data protection law, the same applies EU-wide and affects public authorities in particular: legitimate interests under Art. 6(1)(f) GDPR are not available to public authorities in the performance of their tasks — the processing must be based on another legal ground. A data protection officer must be designated under Art. 37(1)(a) GDPR where the processing is carried out by a public authority or body. In addition, a data protection impact assessment under Art. 35 GDPR may be required (see FAQ).

In Germany, the Federal Commissioner for Data Protection (BfDI) supervises the federal public bodies (§ 9 of the German Federal Data Protection Act (BDSG)); § 38(1) BDSG supplements Art. 37(1)(b) and (c) GDPR with its own threshold of, as a rule, at least 20 persons constantly engaged in automated processing; for public authorities, the designation obligation already follows unconditionally from Art. 37(1)(a) GDPR. In cybersecurity law, public administration entities (federal administration) are not covered via Annex 1 to the German BSI Act (BSIG) 2025 but separately under § 29 BSIG. In Austria, the Austrian Data Protection Authority (Datenschutzbehörde) is the national supervisory authority (§ 18(1) of the Austrian Data Protection Act (DSG)); there is no additional numerical threshold for designating data protection officers, and in the public sector the data protection officer is not bound by instructions as regards the exercise of his or her tasks (§ 5 DSG). Under § 24 of the Austrian Network and Information Systems Security Act 2026 (NISG 2026), public administration at federal level will qualify as an essential entity irrespective of size, and public administration at Land level as an important entity; the NISG 2026 does not apply until 1 October 2026.