An AI system is high-risk under the EU AI Act when its intended purpose falls into one of the eight areas listed in Annex III, such as hiring, credit scoring, education or biometrics. The Article 6(3) filter can take some of these systems back out, but never a system that profiles people. The obligations for Annex III systems apply from 2 December 2027, after the AI Omnibus (Regulation (EU) 2026/1744) pushed the date from the original 2 August 2026.
This guide covers how the classification test works, what the eight areas include in SaaS terms, who carries which obligations, what the Omnibus changed, and a 12-month plan to be ready before the deadline.
Annex III high-risk in brief: eight areas, one narrow exit, one deadline
An AI system is high-risk under Annex III if it is intended for one of eight listed uses, and it stays high-risk unless the provider documents that it meets an Article 6(3) exemption and does not profile people. Providers and deployers of these systems must comply from 2 December 2027, and breaching the high-risk requirements can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher.
Figure 1. The EU AI Act risk pyramid after the AI Omnibus. Source: EU AI Act in Practice quick reference card.
What makes an AI system high-risk under Annex III?
An AI system is high-risk under Article 6(2) of the EU AI Act when its intended purpose matches a use case listed in Annex III. Intended purpose is what the provider says the system is for, in its instructions for use, technical documentation and marketing material. The test looks at the use case, not the underlying technology: the same language model is minimal-risk inside a writing assistant and high-risk inside a CV-screening tool.
Annex III is one of two routes into the high-risk category. The other, Article 6(1) and Annex I, covers AI that is a safety component of a regulated product such as a medical device, a machine or a vehicle, and it follows a later timetable (2 August 2028). Most SaaS companies only ever deal with the Annex III route, because their AI is software sold for a purpose rather than a component of a physical product.
The European Commission published draft guidelines on high-risk classification on 19 May 2026, with a separate document on Annex III. According to the Commission’s draft, excluding high-risk uses in your terms of service does not avoid classification if the product is designed and sold for that use. The final guidelines are expected by the end of 2026 and had not been adopted when this article was written.
Important: Marketing copy counts. A sales page that says your tool “shortlists the best candidates” or “predicts who will repay” is evidence of an Annex III intended purpose, whatever your contract says.
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
The eight Annex III areas, with SaaS examples
Annex III lists eight areas, and each area names specific uses, not whole industries. A bank’s marketing chatbot is not high-risk because it belongs to a bank; a credit-scoring model is high-risk because of what it does. The table below summarizes each area in plain terms; the official Annex III text on the AI Act Service Desk has the full wording.
| Annex III area | What is listed | Typical SaaS example |
|---|---|---|
| 1. Biometrics | Remote biometric identification (not simple identity verification), biometric categorization by sensitive attributes, emotion recognition | Identity platform matching faces across a database; call-analytics tool that infers customer emotion |
| 2. Critical infrastructure | Safety components in critical digital infrastructure, road traffic, and water, gas, heating or electricity supply | AI that controls load balancing or failover in a utility’s grid software |
| 3. Education and vocational training | Admission decisions, evaluating learning outcomes, assessing the level of education someone can access, proctoring for cheating | Automated essay grading; exam-proctoring software that flags suspected cheating |
| 4. Employment and workers’ management | Recruitment and selection (targeted job ads, filtering applications, evaluating candidates), decisions on promotion, termination and task allocation, performance monitoring | ATS that ranks applicants; workforce tool that scores employee performance |
| 5. Essential private and public services | Public benefits eligibility, creditworthiness and credit scoring (fraud detection excluded), life and health insurance pricing, emergency call triage | Lending platform’s credit model; insurtech pricing engine for health cover |
| 6. Law enforcement | Victim-risk assessment, polygraph-type tools, evidence reliability, offending-risk assessment, profiling in investigations | Analytics sold to police forces for case prioritization |
| 7. Migration, asylum and border control | Polygraph-type tools, risk assessment of people entering a Member State, assisting with visa and asylum decisions, identifying people | Document-processing AI sold to immigration authorities |
| 8. Administration of justice and democratic processes | Assisting judicial authorities in researching and applying the law, influencing elections or voting behavior | Legal research AI sold to courts; voter-targeting optimization |
Areas 4 and 5 catch the most SaaS products. Axipro has a separate deep dive on the EU AI Act rules for recruitment tools for HR tech companies.
Worth Knowing: The Credit-scoring Entry
The credit-scoring entry in area 5 explicitly excludes AI used to detect financial fraud. A fintech whose model only flags suspicious transactions sits outside point 5(b); the same company's underwriting model sits inside it.
Can the Article 6(3) filter take your tool out of high-risk?
The Article 6(3) filter removes an Annex III system from the high-risk category only if it does not pose a significant risk of harm to health, safety or fundamental rights and it meets at least one of four conditions. According to the text of Article 6 on the AI Act Service Desk, the system must be intended to:
- (a) perform a narrow procedural task;
- (b) improve the result of a previously completed human activity;
- (c) detect decision-making patterns or deviations from prior patterns, without replacing or influencing the human assessment without proper review; or
- (d) perform a preparatory task to an assessment relevant to an Annex III use case.
Profiling overrides all four conditions. An Annex III system that profiles natural persons is always high-risk, regardless of how narrow or preparatory its task looks.
In Axipro’s EU AI Act gap assessments, the most common misclassification is a SaaS team relying on the Article 6(3) “preparatory task” exemption for a tool that ranks or scores people. Ranking people is profiling, and Annex III systems that profile are always high-risk.
“Most teams we assess open by asking whether Article 6(3) gets them out of high-risk. If the tool ranks or scores people, the answer is no. The better question is whether your classification file would survive a regulator reading it.” Abeera Zainab, GRC Lead at Axipro
Using the filter also creates paperwork. Under Article 6(4), a provider must document its assessment before placing the system on the market and hand that documentation to national authorities on request. The Commission’s original Omnibus proposal would have deleted the duty to register these exempted systems in the EU database, but the final text kept it, with simplified registration content. Treat the filter as a decision you have to defend, not an exit you can take without a paper trail.
How many AI systems are actually high-risk?
Between roughly 1 in 5 and 3 in 5 enterprise AI systems may be high-risk, depending on how the unclear cases fall. A 2023 study by appliedAI, a German AI initiative, classified 106 enterprise AI systems and found 18% were clearly high-risk, 42% were clearly low-risk and 40% could not be classified with confidence. Depending on how the unclear cases resolve, the high-risk share in that sample runs from 18% to 58%, and human resources had the highest share of high-risk systems.
Those numbers sit well above the European Commission’s own expectation when it proposed the Act. The Centre for European Policy Studies (CEPS), which carried out the cost study behind the Commission’s impact assessment, noted that the Commission expected 5% to 15% of AI systems to be high-risk.
The 40% gray zone is where the compliance work sits. Teams that settle classification early, with a dated decision and a named owner for each system, avoid the most expensive outcome: discovering in 2027 that a product they treated as minimal-risk needs a full conformity assessment.
Provider or deployer: who carries the Annex III obligations?
The provider, the company that develops the AI system and sells it under its own name, carries most of the Annex III obligations. The deployer, the company using the system in its own business, carries a shorter but real list under Article 26. A SaaS company that builds an AI hiring tool is the provider; its customers who use the tool to hire are deployers.
Figure 2. The six operator roles under the EU AI Act and their key articles. Source: EU AI Act in Practice quick reference card.
| Obligation | Provider (Arts. 8-21, 43-49, 72-73) | Deployer (Arts. 26-27) |
|---|---|---|
| Risk management system across the lifecycle | Yes (Art. 9) | No |
| Data governance for training, validation and testing data | Yes (Art. 10) | Input data must be relevant and representative, where the deployer controls it |
| Technical documentation (Annex IV) | Yes (Art. 11) | No |
| Automatic logging | Build it in (Art. 12) | Keep logs for at least six months, where the deployer controls them |
| Transparency and instructions for use | Yes (Art. 13) | Use the system as instructed; inform people affected by decisions |
| Human oversight | Design for it (Art. 14) | Assign competent, trained people with authority |
| Accuracy, robustness and cybersecurity | Yes (Art. 15) | No |
| Quality management system | Yes (Art. 17) | No |
| Conformity assessment, EU declaration, CE marking, EU database registration | Yes (Arts. 43-49) | Public bodies must check registration |
| Post-market monitoring and serious incident reporting | Yes (Arts. 72-73) | Monitor operation and report risks and incidents to the provider |
| Inform workers’ representatives before workplace use | No | Yes, for employers |
| Fundamental rights impact assessment | No | Public bodies, private providers of public services, and deployers of credit-scoring and life or health insurance pricing systems (Art. 27) |
Conformity assessment for most Annex III areas (points 2 to 8) runs through internal control: the provider checks itself against the requirements and signs an EU declaration of conformity, with no notified body involved. Biometric systems in point 1 can require a notified body where harmonized standards are not applied in full. Internal control is not a lighter standard; it puts the whole burden of proof on your own technical file.
Insider Note: Deployers can become providers without noticing. Under Article 25(1), a company that puts its own brand on a high-risk system, substantially modifies one, or changes a general-purpose tool’s purpose so that it becomes high-risk (fine-tuning a general model to score job applicants, for example) takes on the full provider obligations.
What did the AI Omnibus change for Annex III systems?
The AI Omnibus moved the Annex III application date from 2 August 2026 to 2 December 2027, and it left the obligations themselves largely intact. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the original deadline.
Figure 3. EU AI Act timeline after the AI Omnibus (Regulation (EU) 2026/1744). Source: EU AI Act in Practice quick reference card.
Four Omnibus changes matter for Annex III planning:
- New dates. Annex III obligations apply from 2 December 2027, and Annex I obligations apply from 2 August 2028. High-risk systems intended for use by public authorities must comply by 2 August 2030 regardless of when they were deployed.
- Registration of exempted systems stays. Providers that rely on Article 6(3) must still register those systems in the EU database, though the information required is reduced.
- Legacy systems get a clearer grace period. Under Article 111(2), high-risk systems placed on the market before 2 December 2027 are caught only if their design changes significantly after that date. The Omnibus clarified that this works at the level of a system’s type and model: if one unit was lawfully on the market before the deadline, identical units can follow without new obligations while the design stays the same.
- Smaller fines for smaller companies. For SMEs, start-ups and small mid-caps, each fine is capped at the lower of the fixed amount and the percentage of turnover, not the higher.
Pro Tip: Do not build your plan around the legacy grace period.
Do not build your plan around the legacy grace period. A SaaS product that retrains its model or reworks its scoring logic every quarter may well count as significantly changed, and "significant change in design" has not yet been defined in guidance. Plan to be compliant by 2 December 2027 and treat grandfathering as a fallback.
What does Annex III compliance cost?
Building a quality management system and passing conformity assessment for one high-risk AI product was estimated at €193,000 to €330,000 to set up, plus about €71,400 a year to maintain. CEPS produced those figures in the cost study behind the Commission’s 2021 impact assessment. They assume a provider building a quality management system from scratch, so treat them as an upper bound.
Companies that already run an ISO/IEC 27001 information security management system or an ISO/IEC 42001 AI management system start well ahead, because risk management, document control, internal audit and management review already exist. What they usually lack are the AI-specific pieces: Annex IV technical documentation, logging designed for traceability, bias testing on training data and a human oversight design that someone has actually tested. Axipro, a compliance readiness and cybersecurity consultancy and Drata Elite Partner that helps SaaS and technology companies get audit-ready for SOC 2, ISO 27001, ISO 42001 and other frameworks, builds those pieces on top of an existing management system so that one set of controls serves both the Act and the certification.
The cost of skipping the work is higher. Breaching the high-risk requirements or the role obligations in Articles 16 to 27 carries fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, and supplying misleading information to authorities carries up to €7.5 million or 1%.
Figure 4. EU AI Act penalty scale, Articles 99 to 101. Source: EU AI Act in Practice quick reference card.
A 12-month plan to be ready by 2 December 2027
A provider starting in late 2026 has about 12 months of working time before the Annex III deadline, which is enough if classification is settled in the first quarter. The sequence below runs in dependency order, so each step builds on the one before it.
- Inventory every AI system (by January 2027). Include AI features inside vendor tools your teams use, not just what you build. Shadow AI in HR and finance tools is where unlisted Annex III uses usually hide.
- Classify each system against Annex III (by February 2027). Record a dated decision, a named owner and the evidence. Where you rely on Article 6(3), write the assessment now and check it for profiling.
- Confirm your role for each system (by February 2027). Decide where you are provider, deployer or both, and update customer and vendor contracts to cover the information-sharing duties in Article 25.
- Run a gap assessment (by April 2027). Providers measure against Articles 9 to 15 and 17; deployers measure against Articles 26 and 27.
- Build the quality management system and technical file (April to September 2027). Reuse your ISO 27001 or ISO 42001 management system, and track EN 18286, the European quality management standard for AI Act purposes.
- Engineer the controls (April to October 2027). Logging, human oversight interfaces, accuracy and bias testing, and cybersecurity hardening take engineering sprints, so book them early.
- Assess, declare and register (October to November 2027). Run the internal-control conformity assessment, sign the EU declaration of conformity, affix the CE marking and register in the EU database. Deployers that need a fundamental rights impact assessment complete it before first use.
- Switch on post-market monitoring (before 2 December 2027). The monitoring plan and serious-incident process must be live on day one; the Commission is due to publish a post-market monitoring template by 2 September 2027.
Steps 1 to 3 cost little and remove most of the uncertainty. Steps 5 and 6 are where budgets and timelines slip, because they compete with product work for the same engineers.
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
The bottom line on Annex III classification
Annex III classification turns on intended purpose: if your AI system is designed and sold for one of the eight listed uses, it is high-risk unless you can document a narrow Article 6(3) exemption, and no exemption applies once the system profiles people. The AI Omnibus gave Annex III providers and deployers until 2 December 2027, but it did not shrink the obligations, and the 12 months left are roughly what a provider needs to classify, build a quality management system, engineer the controls and complete conformity assessment. Settling classification and roles in the first quarter of 2027 is the cheapest decision on the whole timeline. For help with classification, gap assessment and the technical file, see Axipro’s EU AI Act compliance and certification services.
Frequently Asked Questions
When do the EU AI Act high-risk rules for Annex III systems apply?
The EU AI Act high-risk obligations for Annex III systems apply from 2 December 2027, after the AI Omnibus moved them from 2 August 2026. High-risk AI embedded in regulated products under Annex I follows on 2 August 2028. High-risk systems intended for use by public authorities must comply by 2 August 2030, even if they were deployed earlier.
Does the EU AI Act apply to US and other non-EU companies with high-risk AI?
The EU AI Act applies to non-EU providers that place AI systems on the EU market and to providers and deployers outside the EU whose AI output is used in the EU. A US SaaS company selling an AI hiring tool to European employers is a provider under the Act. Non-EU providers of high-risk systems must also appoint an authorized representative established in the EU under Article 22.
Is a customer service chatbot high-risk under the EU AI Act?
A customer service chatbot is usually not high-risk, because answering customer questions is not an Annex III use case. Chatbots fall under the Article 50 transparency rules instead, which have applied since 2 August 2026 and require telling users they are talking to an AI. A chatbot becomes high-risk if it decides something Annex III lists, such as loan eligibility or which job applicants move forward. Axipro’s guide to EU AI Act Article 50 covers the transparency rules.
Is ISO 42001 certification enough for EU AI Act Annex III compliance?
ISO/IEC 42001 certification is not enough on its own for EU AI Act Annex III compliance, because it certifies an AI management system, not a specific high-risk product’s conformity. ISO 42001 covers much of the risk management, documentation and governance that the Act’s quality management system requires, which makes it a strong foundation. Providers still need Annex IV technical documentation, product-level testing, a conformity assessment and EU database registration for each high-risk system.
What happens if a provider wrongly relies on the Article 6(3) exemption?
A provider that wrongly relies on the Article 6(3) exemption can be required by the market surveillance authority to bring the system into full compliance as a high-risk system. If the authority finds the provider misclassified the system to avoid the requirements, the provider also faces fines of up to €15 million or 3% of worldwide annual turnover. The documented Article 6(4) assessment is the provider’s main defense, so it needs to address profiling and significant risk of harm directly.
