High-Risk AI (Annex III)
AI systems under Annex III of the EU AI Act — obligations from 2 December 2027 (Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026)
TL;DR
High-risk AI under Annex III AI Act refers to AI systems in 8 domains: biometric identification, critical infrastructure, education, employment/HR, essential private and public services, law enforcement, migration, administration of justice. The obligations of Chapter III, Sections 1–3 apply to Annex III systems from 2 December 2027 — the postponement is applicable law through Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026; the general date of application of 2 August 2026 (including Art. 50) remains unchanged.
What is high-risk AI (Annex III)?
The 8 high-risk domains under Annex III:
- Biometric identification and categorisation
- Critical infrastructure (transport, water, gas, electricity)
- Education and vocational training
- Employment, workforce management (recruitment, performance, promotion)
- Essential private and public services (credit scoring, insurance scoring, emergency triage)
- Law enforcement
- Migration, asylum, border control
- Administration of justice and democratic processes
Providers and deployers have different obligations. Providers: the full set (Art. 9-15, QMS, conformity assessment). Deployers: use in accordance with the intended purpose, checking the relevance of input data, logs, FRIA where applicable (Art. 27).
Practical example
Examples of high risk under Annex III no. 4(a) (recruitment):
- HR screening tool that analyses applicants' CVs
- Algorithm for predicting employee performance
- AI system for promotion recommendations
The reversal of the burden of proof under § 22 of the German General Equal Treatment Act (AGG) applies where there are indications of algorithmic discrimination, irrespective of the AI Act deadline; AGG damages are typically 1–3 gross monthly salaries per claimant (§ 15 AGG).