Annex II (AI Regulation)
The list of criminal offences (Art. 5(1)(h)(iii)) — frequently confused with Annex I (Union harmonisation legislation)
TL;DR
Annex II to the EU AI Act (Regulation (EU) 2024/1689) is the list of criminal offences relating to Art. 5(1)(h)(iii) — it limits the purposes for which real-time remote biometric identification may exceptionally be used for law enforcement. Not to be confused with Annex I: that annex contains the Union harmonisation legislation (Machinery Regulation, MDR, IVDR, toys and so on) referred to by Art. 6(1) for classifying AI in products as high-risk.
What is Annex II (AI Regulation)?
Annex II to the AI Act carries the official heading 'List of criminal offences referred to in Article 5(1), first subparagraph, point (h)(iii)'. It lists the criminal offences (including terrorism, trafficking in human beings, sexual exploitation of children, murder, grievous bodily injury, organised or armed robbery) for which real-time remote biometric identification in publicly accessible spaces may exceptionally be permitted for law enforcement purposes.
A common confusion: the list of EU sector legislation (machinery, medical devices and so on) is not in Annex II but in Annex I ('List of Union harmonisation legislation', Sections A and B). Art. 6(1) expressly refers to 'the Union harmonisation legislation listed in Annex I' — only there does an AI system become high-risk AI as a safety component of a regulated product.
Territorial scope: the AI Act applies equally in Germany and Austria (Regulation (EU) 2024/1689); there is no national deviation in the numbering of the annexes.
Annex I (AI Act): Union harmonisation legislation for high-risk AI in products
These legal acts are listed in Annex I (Sections A and B); if the AI system is a safety component of such a product, this triggers classification as high-risk under Art. 6(1) (extract):
- Machinery Regulation 2023/1230
- Medical Devices Regulation 2017/745
- In Vitro Diagnostic Medical Devices Regulation 2017/746
- Toy Safety Directive 2009/48
- Radio Equipment Directive 2014/53
- Pressure Equipment Directive 2014/68
- Lifts Directive 2014/33
- Marine Equipment Directive 2014/90
- Rail Interoperability Directive 2016/797
- Motor Vehicle Type-Approval Regulation 2018/858
- Aviation Safety Regulation 2018/1139
- EU Personal Protective Equipment Regulation 2016/425
Practical example
The manufacturer of an AI-controlled industrial machine falls under Machinery Regulation 2023/1230 + the EU AI Act. A double conformity assessment is required (machinery law + Art. 43 AI Act).