High-Risk AI Systems (Chapter III of the AI Act)

With the entry into force of the Artificial Intelligence Act (AI Act) on 1 August 2024, the European Union sought to add a further element to the creation of a secure digital environment. This objective is, after all, one of the six priorities identified by the European Commission for the 2019–2024 period. The Union aims to benefit from the full potential of the digital revolution while ensuring high standards of respect for people’s health, safety, and fundamental rights.

The AI Act forms part of this framework and aims to guide the development and use of artificial intelligence systems so that they are safe and trustworthy (secure and trustworthy, Recital 8). To pursue this objective, the European legislator deliberately chose to use a binding legislative instrument rather than promote codes of conduct and soft laws, which are traditional methods used by AI-producing countries. As already highlighted by the academic community, this choice can only be fully understood when placed within the contemporary geopolitical landscape: the digital revolution is driven predominantly by American and Chinese companies, whose governments have the power to indirectly direct industrial strategies. The European Union, by contrast, is at a relative disadvantage and increasingly risks having decisions imposed on it by large technology multinationals.

In this scenario, resorting to binding legislation appears to be the only effective instrument for asserting its interests.

To understand more precisely what these interests are, it is useful to briefly examine the structure of the AI Act. Following the interpretation proposed by Palmirotto (F. Palmiotto, “The AI Act Roller Coaster: The Evolution of Fundamental Rights Protection in the Legislative Process and the Future of the Regulation”, European Journal of Risk Regulation. 2025;16(2):770-793), the regulation can be understood as a hybrid law, halfway between internal market legislation and legislation on fundamental rights. This approach is already clearly apparent in Article 1, which states: “The purpose of this Regulation is to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy artificial intelligence (AI), while ensuring a high level of protection of health, safety and fundamental rights enshrined in the Charter of Fundamental Rights of the European Union.”

Indeed, the AI Act follows a structure partly similar to that of legislation on dangerous products, requiring manufacturers to comply with standards and specific requirements. However, it differs significantly in terms of the nature of the harms considered: the risks associated with AI systems are not limited to traditional health and safety criteria, but may even extend to threatening people’s fundamental rights.

Artificial intelligence systems are technologies that promise a broad “range of benefits across the entire spectrum of economic, environmental and social activities” (Recital 4), but which, especially when used in decision-making processes, can fuel discriminatory practices or contribute to the creation and entrenchment of social inequalities.

It is precisely the recognition of this dual nature that led the European legislator to make risk the central concept of the regulation, defining it as “the combination of the probability of an occurrence of harm and the severity of that harm” (Article 3(2)), in relation to health, safety, and fundamental rights. On the basis of this concept, the law introduces a classification of AI systems into four categories: unacceptable-risk systems, high-risk systems, limited-risk systems, and minimal-risk systems.

This taxonomy is consistent with the regulation’s twofold purpose—promoting the internal market and protecting fundamental rights—through the adoption of a risk-based approach. As clarified by Recital 26: “In order to introduce a proportionate and effective set of binding rules for AI systems, a clearly defined risk-based approach should be followed. Such an approach should tailor the type and content of such rules to the intensity and scope of the risks that AI systems can generate.” The risk-based approach, already adopted by the Union in areas such as data protection, makes it possible to adjust the obligations imposed on AI providers according to the level of risk generated: the higher the risk, the stricter the obligations and responsibilities.

In light of this approach, the reason why the largest part of the regulation is devoted to high-risk AI systems becomes clear.

While the use of unacceptable-risk systems is prohibited because it is excessively invasive of fundamental rights, high-risk systems represent the category whose use the legislator has considered permissible, provided that such use is subject to strict requirements designed to prevent dangers to health, safety, and the full enjoyment of fundamental rights.

Before examining the criteria used by the regulation to classify an AI system as “high-risk,” it is worth clarifying a point that is often misunderstood: classifying a system in this category does not amount to legitimizing its use. As specified in Recital 63: “The fact that an AI system is classified as a high-risk AI system under this Regulation should not be interpreted as indicating that the use of the system is lawful […] [T]his Regulation should not be understood as providing a legal basis.” The AI Act provides the general framework of requirements and obligations applicable to these systems, but their actual use always requires a specific legal basis.

Having clarified this point, it remains to understand how the regulation determines which systems fall within the category of high-risk systems. In this regard, the AI Act adopts a distinctive approach: although this is a single category, the classification of a system as “high-risk” is based on a complex criterion, described in academic literature as a “dual criterion.”

As emerges from Article 6, which concerns the “classification rules for high-risk AI systems,” this category includes, on the one hand, AI systems used as products or safety components of products governed by Union acts listed in Annex I and subject to third-party conformity assessment (Article 6(1)); and, on the other hand, AI systems listed in Annex III (Article 6(2)). Based on this distinction, the following sections will examine in detail the examples of high-risk systems contained in Annexes I and III, in order to clarify the scope and extent of the provision.

AI Systems in Dangerous Products (Article 6(1))

The first category of high-risk AI systems is identified by Article 6(1) of the AI Act. It includes AI systems that constitute products subject to the European Union harmonisation legislation listed in Annex I, as well as those that operate as safety components of such products. It follows that an AI system is classified as high-risk when it falls directly within the scope of one of the listed legislative acts, or when it performs the function of a safety component within a regulated product.

European harmonisation legislation refers to a set of legislative acts and technical standards adopted by the European Union to harmonise the rules applicable in the different Member States. These rules establish common requirements that enable the free movement of goods within the internal market: compliance with them entails meeting the required levels of health and safety protection.

In this context, it is useful to consider the concept of a safety component. The AI Act provides a definition in Article 3(14), according to which a safety component means “a component of a product or of an AI system which fulfils a safety function for that product or AI system, or the failure or malfunctioning of which endangers the health and safety of persons or property.” The legislator has therefore adopted a broad, functional definition that includes components whose malfunction may create risks for people or objects, as well as those specifically designed for safety purposes.

Article 6 also clarifies that, for the purposes of classifying an AI system as high-risk, it is irrelevant whether the system is placed on the market together with the product of which it is a safety component or separately.

To define the scope of this category more precisely, it is therefore necessary to examine the legislation referred to in Annex I. The latter lists twenty Union regulations establishing harmonised requirements, that is, common and uniform technical rules applicable in all Member States, intended to ensure a minimum and consistent level of health and safety protection and to prevent regulatory fragmentation at national level that could hinder the free movement of goods. This legislation concerns: machinery, toy safety, recreational craft, lifts, equipment intended for use in potentially explosive atmospheres, radio equipment, pressure equipment, cableway installations, personal protective equipment, appliances burning gaseous fuels, medical devices, civil aviation safety, two- or three-wheel vehicles, agricultural and forestry vehicles, marine equipment, the railway system, motor vehicles and their trailers, and, finally, aircraft.

However, belonging to one of the product categories listed in Annex I, or constituting a safety component of such a product, is not in itself sufficient to classify an AI system as high-risk. Article 6(1) requires two criteria to be met simultaneously. In addition to the requirement just described, the AI system must be subject to a third-party conformity assessment, as provided for by the applicable harmonisation legislation, in order to verify compliance with the established standards. In certain cases, in fact, placing specific products on the European market is conditional on passing a conformity assessment. The legislation referred to in Annex I provides for different levels of obligations depending on the risks associated with the products: conformity assessment by third-party bodies represents the strictest level of control and is reserved for products that pose significant risks to people’s health and safety.

It is important, however, to clarify the relationship between the concept of high risk set out in the AI Act and the concept provided for in the individual harmonisation acts. In some cases, third-party conformity assessment is also required for products that are classified as medium-risk under the relevant sector-specific legislation. The most significant example, cited by the regulation itself, concerns medical devices, for which third-party conformity assessment is necessary even when the level of risk is medium.

In such cases, although the product is not classified as “high-risk” under the applicable sector-specific legislation, the AI system integrated into it, or constituting one of its safety components, will nevertheless be classified as a high-risk system for the purposes of the AI Act. As explicitly stated in Recital 51, classifying an AI system as high-risk under the regulation does not necessarily imply that the product as a whole, or the AI system as a product, is also classified as “high-risk” according to the criteria of the Union harmonisation legislation applicable to that product.

AI Systems Included in Annex III (Article 6(2))

Article 6(2) of the AI Act introduces the second type of AI systems classified as high-risk. The wording is brief, stating only that “in addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall also be considered high-risk.” This annex, specifically devoted to the systems covered by paragraph 2, identifies eight areas of application: biometrics; critical infrastructure; education and vocational training; employment, worker management, and access to self-employment; access to and enjoyment of essential private services and essential public services and benefits; law enforcement; migration, asylum, and border control management; and the administration of justice and democratic processes.

To understand why these areas fall within high-risk contexts, it is useful to refer to Recital 52 of the preamble. It clarifies that “as regards standalone AI systems […] it is appropriate to classify them as high-risk if, in light of their intended purpose, they pose a high risk of harm to the health and safety or the fundamental rights of persons, taking into account both the severity of the possible harm and the probability of its occurrence, and are used in a number of specifically predefined areas set out in this Regulation.”

Thus, risk—defined in Article 3(2) as “the combination of the probability of an occurrence of harm and the severity of that harm”—and intended purpose—understood in Article 3(12) as “the use for which an AI system is intended by the provider, including the specific context and conditions of use”—are the determining elements guiding the selection of the areas listed in Annex III.

In this regard, it is interesting to highlight the difference in approach between the original proposal and the final text of the regulation. In the 2021 draft, the Commission adopted an “automatic” approach: mere inclusion in Annex III meant that the system was classified as high-risk; this was also intended to simplify the identification of those subject to the obligations. The final text, as amended by the Council and Parliament, however, introduced further clarifications, including Article 6(3), which limits this automatic approach.

This provision states that “by way of derogation from paragraph 2, an AI system referred to in Annex III shall not be considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision-making.” In other words, if the system “does not have an impact on the substance, and therefore on the outcome, of the decision-making process,” it does not fall within the category of high-risk systems (Recital 53).

The regulation also specifies the cases in which a system, although covered by Annex III, is not considered risky: when it is intended to perform a narrowly procedural task; when it merely improves the outcome of a decision already made by a human; when it detects decision-making patterns or deviations from previous patterns; or when it performs merely preparatory tasks. Here too, the preamble is useful in clarifying the practical scope of these exceptions.

As regards the first exception, this refers to narrowly procedural tasks such as transforming unstructured data into structured data or automatically classifying incoming documents into categories. The second exception concerns systems that provide support for an existing human activity, for example, tools intended to improve the linguistic style of documents that have already been drafted. The third applies to systems that identify inconsistencies or deviations from previous decisions without replacing human judgment, such as those used to check for possible disparities in a teacher’s assessment methods. Finally, the last case concerns systems that perform only preparatory functions, such as models used to index case files.

Despite the introduction of these exceptions, Article 6(3) retains an element that recalls the “automatic approach” of the Commission’s initial proposal. The provision states that “without prejudice to the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where it performs profiling of natural persons.” The regulation does not provide its own definition of “profiling,” but refers, in the preamble, to Article 4(4) of the General Data Protection Regulation (GDPR), according to which profiling is “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.”

Profiling ordinarily involves analyzing extensive sets of data relating to an individual in order to identify correlations and place them within a particular group, thereby inferring or predicting behaviour in a specific area of interest—for example, estimating the likelihood that an individual will purchase a product based on their previous purchases.

Therefore, when a system falling within the scope of Annex III performs profiling activities concerning the individuals concerned, it is automatically classified as high-risk, owing to the high likelihood of discriminatory effects associated with such operations.

Annex III

Having examined the general criteria and rules, exceptions, and special cases through which the AI Act defines the concept of high risk, it is necessary to turn to Annex III, which identifies specific use cases and serves as the central reference point for identifying the second category of high-risk systems.

Biometrics

The first area classified as high-risk is biometrics. This term refers to technologies that use personal data, such as physical characteristics—like facial features or fingerprints—or behavioural characteristics, to obtain information about a person: from their identity to their personal characteristics, such as sex and age, and even their emotional states, in the case of emotion recognition.

Before examining the specific situations covered by Annex III, it should be remembered that systems are classified as high-risk only if they do not fall among the practices prohibited by the regulation. Article 5 of the AI Act prohibits certain uses, including “real-time” identification in publicly accessible spaces (Article 5(1)(h)) and systems capable of inferring a person’s emotions in the workplace (Article 5(1)(f)).

Having clarified this point, we can move on to the cases set out in Annex III, which lists three types of biometric AI systems: remote biometric identification systems, systems intended for biometric categorisation, and systems used for emotion recognition.

The first category includes systems capable of assigning an identity to an individual based on an image. These systems are always considered high-risk because, unlike “real-time” identification, no geographical limitation applies here, such as the restriction concerning the use of publicly accessible spaces. The legislator has, however, specified that “AI systems intended to be used for biometric verification, including authentication, the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be” are not included. This is not an exception, but rather a distinction between two concepts: identification, as defined in Article 3(35), is generally carried out without the consent of the person concerned, whereas biometric verification, defined in Article 3(36), takes place with the user’s consent and is limited to confirming a claimed identity. One example, also mentioned in Recital 54, is biometric recognition used to unlock smartphones and personal devices.

In this context, the classification as high-risk stems from the potential for error inherent in these systems. An inaccurate identification during an investigation, for example, may result in a person being held responsible for a crime they did not commit. There is also a broader risk: violation of privacy and the possible chilling effect on the exercise of fundamental rights, such as freedom of expression and freedom of association. When individuals know that they may be identified while exercising these rights, as in the case of a demonstration, they may be discouraged from doing so.

The second type concerns AI systems that classify people into specific categories on the basis of biometric data (Article 3(39)). As Huergo Lora observes (A. Huergo Lora, “Classification of AI Systems as high-risk (Chapter III, Section 1), The EU regulation on Artificial Intelligence: A commentary, 2025: 79-130, edited by A. J. Huergo Lora and G. M. Díaz González), these categories correspond to the “special categories of personal data” defined in Article 9 of the GDPR. Here too, the obvious risk is that of classification errors. But an even more fundamental question arises first: is it legitimate to divide individuals on the basis of categories of sensitive data, such as sex or ethnic origin, when the only effect of this classification is to assign them different treatment?

The final category concerns systems intended for emotion recognition. The main risk lies in the invasion of privacy, since these technologies make it possible to access intimate information that individuals would normally decide whether and how to disclose.

Critical Infrastructure

The second context covered by Annex III concerns critical infrastructure. The legislator’s definition shows a certain continuity with the provisions of paragraph 1, owing to its reference to “safety components.” The annex includes, in fact: “AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or in the supply of water, gas, heating or electricity.” To fully understand what is meant by a safety component, it is necessary to refer to the definition already provided in the section on high-risk systems under paragraph 1. Examples falling within this area include systems used to monitor water pressure or to control fires in cloud computing centres. As regards the concept of critical infrastructure, the regulation refers to Article 2(4) of Directive 2022/2557, while critical digital infrastructure must be considered in light of point 8 of the annex to the same directive.

The reason for including these systems among those classified as high-risk is explained in Recital 55: “their failure or malfunctioning may put at risk the life and health of a large number of people and lead to considerable disruptions in the normal conduct of social and economic activities.” The same passage also provides an important clarification, stating that “components intended to be used solely for cybersecurity purposes should not be considered to be safety components.”

Education and Vocational Training

The third point of Annex III is devoted to the use of AI systems in education. The legislator recognises that these technologies can offer significant benefits, both for students and teachers, helping to “promote high-quality digital education and training” and facilitate the acquisition of the skills needed in the digital age (Recital 56). However, the use of AI in certain specific areas is classified as high-risk because of the possibility that such systems may violate “the right to education and training, as well as the right not to be discriminated against, and perpetuate historical patterns of discrimination.”

The annex identifies four use cases falling within this category: systems intended to determine access to or admission to educational institutions; systems used to evaluate learning outcomes; AI systems used to determine the appropriate level of education that a person will receive; and AI systems intended to monitor and detect prohibited behaviour during tests, understood as school or university examinations and assessments, whether conducted in person or remotely.

The educational path represents a decisive moment in people’s lives, not only for intellectual development, but also because it affects access to more highly paid and specialized employment opportunities. It is therefore necessary to ensure that the opportunities offered by education are not precluded by algorithmic biases. As the legislator itself points out, these systems should be considered high-risk because they “may determine the educational and professional course of a person’s life and therefore affect their ability to secure their livelihood.” The risk of discrimination arises both at the individual level, in the event of an error in evaluating an admission application, and at the collective level, if the system exhibits systematic biases against certain categories.

The first case concerns the use of AI systems to determine students’ admission to courses or study programmes. The main risk here is a violation of the right to education and, more generally, discrimination resulting from the use of characteristics unrelated to the candidate’s merit. It should be noted, however, that, as academic criticism has observed, the current use of AI systems during admissions is primarily ancillary: algorithms carry out an initial screening of applications that clearly do not meet the requirements, while the final decision remains in the hands of a human operator.

A similar consideration can be extended to the third category, systems intended to assess the appropriate level of education for an individual, since in practice this decision is often included precisely within the admissions process.

The other two cases fall into a different category, as they concern the assessment of students’ academic performance. In these situations, the presence of a human being as the final arbiter remains crucial. The experience of the United Kingdom in 2020 is emblematic: an AI system used to assign predictive grades to students was strongly criticised because it had been trained on data relating to the performance of previous students, with the result that it did not assess students on the basis of their individual abilities. The episode raised well-founded questions about legitimacy, particularly with regard to the treatment of minorities.

The final example identified in the annex concerns systems “used to monitor and detect prohibited behaviour of students during tests.” The use of such technologies increased significantly during the 2020 pandemic, when educational institutions replaced in-person examinations with remote assessments. In these cases, the risk lies not only in surveillance itself, but also in the possible use of the algorithmic outcome as evidence against the student, resulting in a weakening of the presumption of innocence. The parallel with the use of AI in predictive policing is clear: while in the judicial context the algorithm’s result serves to guide investigations, in education it risks becoming directly decisive in assigning responsibility. Added to this is the high likelihood of biases associated with biometric technologies, which have been documented repeatedly and have, in some cases, even resulted in the system being unable to detect the presence of the student in front of the camera.

Employment, Worker Management, and Access to Self-Employment

The sector that follows education is employment. This is an area characterised by an imbalance of power between the parties, which is why the AI systems used in it are classified as high-risk. The annex identifies two types of use that fall within this classification: systems used to recruit candidates and systems used to make decisions concerning the terms of employment relationships.

As regards the first use, it is now well known that many companies use AI tools to carry out preliminary screening of the CVs they receive: these systems analyse the information provided by candidates and rank them according to predefined criteria. Less well known is the use of technologies that allow recruiters to supplement these assessments with additional data, obtained from candidates’ online activity or acquired through data brokers, in order to create a more comprehensive profile and guide the decision as to the best candidate.

While the first type of system is used before an employment relationship is established, the second applies during an employment relationship that is already underway. As explained in Recital 57, it includes AI systems “for making decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, for allocating tasks based on individual behaviour, personal traits or characteristics, and for monitoring or evaluating persons in work-related contractual relationships.”

The legislator’s decision to extend protection also to people “performing services through platforms” deserves attention. This wording prevents workers on on-demand work platforms, such as Deliveroo, from being left without protection, especially in Member States where their legal status is still uncertain. The text therefore makes clear that the systems used by such platforms are also included among high-risk systems.

Here too, the preamble provides the rationale for this classification. Recital 57 identifies three types of concerns, which differ both according to the outcome of the system’s performance (correct or incorrect) and in relation to the party exposed to the risk (an individual, a group, or the workforce as a whole).

The first element concerns the impact that the use of AI can have on people’s lives. Errors during recruitment and evaluation can have a decisive effect on individuals’ professional prospects and their ability to secure a livelihood. In this scenario, an algorithmic error harms an individual worker or candidate.

A second aspect concerns the systemic risk posed to historically disadvantaged groups. The recital notes that “such systems may perpetuate historical patterns of discrimination, for example against women, certain age groups, persons with disabilities, or persons of certain racial or ethnic origins or with certain sexual orientations.” Here, the issue is not limited to an individual error, but may result in the possible exclusion or penalisation of entire groups.

Finally, the legislator refers to the risks associated with the protection of fundamental rights in the workplace, particularly in relation to systems used after recruitment. In this case, the problem is not so much the technical accuracy of the system’s performance as the intrusive nature of the processing, which may therefore “adversely impact their fundamental rights to data protection and privacy.” These are therefore risks that may affect all workers involved, regardless of whether the algorithm makes errors.

Essential Services

The fifth point of the annex addresses a heterogeneous set of use cases in which AI systems are used to decide who can access essential services or benefits necessary to lead a dignified life. The common thread linking these applications is clarified by Recital 58, according to which certain public and private services and benefits are indispensable for people to participate fully in social life or improve their standard of living.

In defining these essential services, the legislator identifies four categories of technologies: those used by public authorities, or on their behalf, to assess the eligibility of natural persons for essential public assistance benefits and services; those used to evaluate the creditworthiness of individuals; those used in risk assessment and the determination of premiums in the insurance sector, with regard to health and life insurance; and, finally, those intended to assess and classify emergency calls or dispatch first-response services.

To understand the scope of the first provision, the preamble specifies that these benefits include “healthcare services, social security benefits, social services providing protection in cases such as maternity, sickness, industrial accidents, dependency or old age and loss of employment, and social and housing assistance.” The wording is not entirely clear, but it seems to indicate that this category also includes services provided by private entities acting on behalf of the public administration, while excluding those provided by private entities in their own capacity.

The same Recital 58 also clarifies the reasons why these systems have been classified as high-risk. The regulation points out that these technologies “may have a significant impact on persons’ livelihoods and may violate their fundamental rights, such as the right to social protection, non-discrimination, human dignity or an effective remedy.”

The second category concerns AI systems intended to be used to evaluate the creditworthiness of natural persons. This is probably the best-known application of artificial intelligence: these models, used by banks and financial institutions, analyse past transactions and additional information provided by users to develop a credit profile, which is subsequently used to decide whether to grant the applicant a loan or another financial service.

The reasons for including them among high-risk systems, as identified in Recital 58, are essentially twofold. On the one hand, at the level of the individual, the model’s output directly affects access to essential services, such as housing, electricity, and telecommunications services. On the other hand, from a collective perspective, these systems present a clear risk of discrimination: the regulation calls for attention to be paid both to the possible replication of pre-existing biases, such as those linked to ethnic origin or sex, and to the possible creation of new disadvantaged categories. As the text itself explains, these models “may lead to discrimination between persons or groups and may perpetuate historical patterns of discrimination, […] or give rise to new forms of discriminatory impact.”

The legislator nevertheless introduces an important clarification, excluding from the category of high-risk systems those used exclusively to detect financial fraud. This exception should be understood as referring to fraud committed in the provision of financial services, and not to fraud perpetrated by consumers, which remains covered by the high-risk regime. Similarly, the preamble also exempts systems used for prudential purposes to calculate the capital requirements of credit institutions and insurance undertakings.

The third example concerns systems intended for risk assessment and the determination of insurance premiums. Here too, this is a sector in which the adoption of AI is well established: these models estimate the probability of a future, uncertain, and harmful event occurring, and help determine both whether to grant an insurance policy and the corresponding premium. The main risk associated with this type of system is that, “if not duly designed, developed and used, they may infringe their fundamental rights and may have serious consequences for people’s life and health, including financial exclusion and discrimination.” The legislator has nevertheless chosen to classify as high-risk only systems used to calculate risks and premiums in relation to health and life insurance. Although this selection is justified by the vital importance of the coverage involved, other widespread forms of insurance, such as motor and home insurance, remain excluded.

Finally, the category of high-risk systems includes those used to “evaluate and classify emergency calls made by natural persons or to dispatch first response emergency services or to establish priority in the dispatching of such services, including by police, firefighters and medical assistance, as well as systems for patient triage in the context of emergency healthcare.” As clarified by Recital 58, these technologies operate in contexts that are “highly critical for the life and health of persons and their property.” The risk underlying these operations is evident: an error in classifying a call may compromise the chances of survival or recovery of the people concerned, as in the case of a patient suffering a stroke, for whom timely intervention is a key factor.

Law Enforcement

The use of AI in crime prevention and law enforcement is one of the most widespread areas of application. The available technologies are diverse: some estimate the likelihood that a person will commit a crime, while others assess the risk that a crime may occur in a particular location. These applications embody the general benefits that Recital 4 attributes to AI, from improved predictions to the optimisation of operations and resources, but at the same time entail significant risks, since an error can lead to measures that are oppressive to people’s lives.

For this reason, the European Union has decided to classify these uses both among prohibited systems and among high-risk systems. In particular, Article 5(1)(d) prohibits systems designed to assess or predict the risk of an individual committing criminal offences when the assessment is based solely on profiling.

By contrast, Annex III identifies five categories of high-risk systems used by law enforcement authorities and bodies acting on their behalf. It is useful to recall that law enforcement activities are defined in Article 3(46) as “activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”

The five types are: systems that assess the risk of a person becoming a victim of a criminal offence; polygraphs and equivalent tools; systems that evaluate the reliability of evidence; systems that assess the risk of a person committing a criminal offence or reoffending without relying exclusively on profiling or automated assessments of personality traits; and systems that perform profiling during investigations, inquiries, and the prosecution of criminal offences.

Among these, the fourth plays a central role, given its clear similarity to the prohibition under Article 5. The difference lies in the degree of automation: prohibited applications rely solely on automated processing, whereas high-risk applications involve human intervention and use the output to support decision-making. The essential reference is Article 22 of the GDPR, which grants individuals the rightnot to be subject to decisions producing legal effects that are based solely on the automated processing of personal data. As clarified by the Article 29 Working Party, now replaced by the European Data Protection Board, a decision is based solely on automated processing only if there is no human intervention whatsoever. As Miró Llinares and Galarza point out, the real distinction lies in how the output is used: as support for human decisions in the case of high-risk systems, and as a determining factor in prohibited cases (see F. Miró Llinares and M. S. Galarza, “The Regulation of Predictive Policing Systems in the Artificial Intelligence Act,” The European Union Artificial Intelligence Act. 2025; 4(2) 327-350, edited by L. Cotino Hueso and D. U. Galetta).

The reason for including the fifth case, on the other hand, lies in the counter-exception provided by Article 6(3), under which systems that perform profiling of natural persons must always be considered high-risk.

The annex also includes systems that calculate the probability that an individual will become the victim of a criminal offence. As Lora observes, these tools are not treated in the same way as the preceding ones because an error has consequences of a different degree: mistakenly considering someone a potential victim leads, at most, to protective measures, whereas mistakenly classifying an individual as a potential offender or repeat offender exposes that person to significantly more invasive interventions.

The list is completed by polygraphs and systems intended to verify the reliability of evidence, technologies that share the aim of assisting authorities in investigative activities. The former analyse the truthfulness of suspects’ statements through physiological indicators, while the latter aim to assess the reliability of evidence collected during the investigative phase.

Recital 59 refers to a wide range of risks, from discriminatory outcomes to the possible restriction of fundamental procedural rights. These include the right to an effective remedy and to an impartial tribunal, the rights of the defence, and the presumption of innocence. This explains the legislator’s insistence on the need to guarantee transparency and comprehensibility, which are key requirements for preserving citizens’ trust in the work of law enforcement agencies and ensuring that suspects enjoy full protection of their defence rights.

Finally, the preamble clarifies that the scope of application concerns exclusively law enforcement activities relating to criminal offences. “AI systems specifically intended to be used for administrative proceedings by tax and customs authorities […] should not be classified as high-risk AI systems.”

Migration, Asylum, and Border Control Management

The seventh area included in Annex III concerns border control management. Recital 60 reiterates an essential point: these systems are classified as high-risk because of their possible “effects on persons who are often in a particularly vulnerable position and whose future depends on the outcome of the actions of the competent public authorities.”

The annex lists four use cases. The first closely resembles a use already considered in the field of law enforcement: AI systems intended to be used by public authorities, or on their behalf, as polygraphs or similar tools.

A second case concerns systems used to assist the competent public authorities in examining applications for asylum, visas, or residence permits, as well as related complaints, with regard to the eligibility of the persons applying for such status. The parallel here is with the employment sector: just as systems assess candidates for a job, those used in the field of migration assess applicants’ requirements in order to determine whether a permit may be issued.

Next comes the category of systems intended to assess risks. These include systems for assessing security risks, risks of irregular migration, or health risks arising from the entry of people into the territory of a Member State. Although their purpose is similar to that of the preceding category, their scope is broader: these systems may affect both the possibility of obtaining residence documents and the decision to expel an individual if one of the risks mentioned above arises. As already provided for systems intended for crime prevention, AI in this context may only assist a human decision-maker.

Finally, systems intended to detect, recognise, or identify natural persons in the context of migration, asylum, or border control are classified as high-risk, with the exception of the verification of travel documents. This use brings us back to the category of biometric systems discussed in the first section: when the system does not merely perform verification but carries out identification functions, it falls within the category of high-risk systems.

In all these scenarios, requirements such as accuracy, non-discrimination, and transparency become central, so that the use of AI does not compromise fundamental rights such as freedom of movement, privacy, non-discrimination, and access to international protection.

Administration of Justice and Democratic Processes

The final section of the annex identifies two further areas of AI application: systems used in the administration of justice and those used in democratic processes.

As regards the first, the regulation classifies as high-risk systems intended “to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution.” The provision therefore distinguishes between two functions: researching and interpreting the law and the facts, and applying the law to a specific case. The first activity includes systems developed by legal information companies, which provide data, analyses, and software to support legal professionals and institutions, such as lawyers and judges. As regards the intended users, the provision concerns both public judicial authorities and alternative dispute resolution bodies, such as arbitration bodies.

The reasons for including these systems among those classified as high-risk emerge from Recital 61, which refers to their potential impact on the right to an effective remedy, the guarantee of an impartial tribunal, and individual freedoms, as well as their possible systemic effects on democracy and the rule of law.

The same Recital also clarifies that “[i]t is, however, not appropriate to extend the classification […] to AI systems intended for purely ancillary administrative activities, which do not affect the actual administration of justice in individual cases, such as the anonymisation or pseudonymisation of judicial decisions, documents or data, communication between staff [and] administrative tasks.” This approach is consistent with the exceptions provided for in Article 6(3).

The second function concerns systems “used to influence the outcome of an election or a referendum or the voting behaviour of natural persons in the exercise of their vote in elections or referendums.” In this area, there are recent examples showing how digital tools and online platforms can affect the proper conduct of the democratic process. The case of the 2024 Romanian elections is particularly significant, as foreign influence affected the normal exercise of the right to vote. The extent of this interference led the Romanian Constitutional Court to annul the results of the first round of voting. At the same time, it should not be overlooked that AI is widely used by political parties themselves, for example in advertising targeting, an area also governed by Regulation 2024/900 on the transparency and targeting of political advertising.

Recital 62 highlights the risk of “undue external interference in the right to vote enshrined in Article 39 of the Charter and adverse effects on democracy and the rule of law.” Systems “whose outputs natural persons are not directly exposed to,” such as tools used to organise, optimise, and structure political campaigns from an administrative and logistical perspective, are not included in the high-risk category.

Application of the Exceptions Set Out in Article 6(3)

As anticipated, the approach to high-risk systems adopted in the final text of the regulation differs from the “automatic” approach proposed by the Commission. It recognises that a system listed in Annex III may not be considered high-risk when it performs functions that do not materially influence the decision-making process, for example, when it merely improves work already carried out by a human operator or performs purely procedural and narrowly defined tasks.

When a provider considers that its system falls within one of the four cases provided for in Article 6(3), it must follow the procedure set out in the following paragraph, Article 6(4). The provider is required to document “[its] assessment before that system is placed on the market or put into service” and register the system in the EU database, as specified in Article 49(2). The documentation produced must be made available to the competent authorities upon request. This approach, however, may give rise to a potential conflict of interest: since it is advantageous for a provider to avoid having its system classified as high-risk, self-assessment may lead it to classify the system as not high-risk in order to facilitate its commercialisation.

Article 80(1) serves to balance this discretion by granting the market surveillance authority the power to examine the provider’s documentation if it suspects that a system declared not to be high-risk actually falls within that category. The authority must determine whether the exclusion conditions set out in Article 6(3) are genuinely satisfied. If it considers that the system must be classified as high-risk, the provider is required to take “all necessary measures” to ensure compliance with the AI Act’s requirements and obligations within a deadline set by the authority. If the provider fails to bring the system into compliance by that deadline, it will be subject to a financial penalty in accordance with Article 99.

Obligations and Powers of the Commission Established by Article 6

Article 6 does not merely set out the use cases of AI systems classified as high-risk; it also grants specific powers to the Commission—in particular, the power to amend the exceptions provided for in Article 6(3)—as well as an obligation, set out in paragraph 5.

The latter entrusts the Commission with the task of publishing “guidelines specifying the practical implementation of this Article.” The guidelines must be published by 2 February 2026, therefore before the obligations for high-risk systems enter into force, which is scheduled for 2 August 2026, and must be prepared following consultation with the European AI Board. In accordance with Article 96, these guidelines must pay particular “attention to the needs of SMEs, including start-ups, local public authorities and the sectors most likely to be affected.” With specific reference to Article 6, it is clear that they must clarify the scope of the exceptions listed in Article 6(3). Indeed, paragraph 5 expressly requires the guidelines to be accompanied by “an exhaustive list of practical examples of use cases of high-risk and non-high-risk AI systems.”

As regards the powers granted to the Commission, these primarily concern the possibility of amending the list of conditions that allow a system used in a use case listed in Annex III not to be considered high-risk. Paragraph 6 grants the Commission the power to add or amend the conditions set out in Article 6(3), provided that they continue to ensure that the AI system does not materially influence the decision-making process. A further restriction also applies: the amendments must be supported by “concrete and reliable evidence of the existence of AI systems falling within the scope of Annex III but not posing a significant risk of harm to the health, safety or fundamental rights of natural persons.”

Conversely, paragraph 7 grants the Commission the power to remove one of the conditions set out in Article 6(3). Here too, any intervention must be based on concrete evidence: the amendment must be justified in light of the risks that these systems may pose to people’s health, safety, and fundamental rights. The ratio is clear: some systems initially considered not to be high-risk, and therefore exempt from the related obligations, may subsequently prove capable of creating risks to people’s health, safety, or fundamental rights.

Finally, paragraph 8 establishes that any amendment—presumably referring above all to the addition of new conditions—must not undermine the level of protection guaranteed for health, safety, and fundamental rights. Furthermore, such interventions must take into account “technological and market developments,” so that the regulation remains up to date and effective over time.

Amendments to Annex III

Again, with the aim of ensuring that the regulation remains effective over time, Article 7 grants the Commission the power to amend Annex III.

The provision is divided into three paragraphs. The first grants the Commission the power to add or amend the use cases listed in Annex III, provided that two conditions are met:

a) AI systems are intended to be used in one of the areas listed in Annex III;

b) AI systems pose a risk of harm to health and safety, or of adverse impact on fundamental rights, and that risk is equivalent to or greater than the risk of harm or adverse impact posed by the high-risk AI systems listed in Annex III.

Thus, Article 7 is also based on the same ratio as Article 6(7): a use case may be added to the list in Annex III if it presents risks at least as serious as those already included.

The second paragraph clarifies the elements that the Commission must take into consideration when assessing whether a new use case should be included in Annex III. As observed by Huergo Lora (A. Huergo Lora, “Classification of AI Systems as high-risk,” in The EU regulation on Artificial Intelligence: A commentary), these criteria differ from the exceptions established in Article 6(3): they do not describe situations in which the risk is negligible, but rather dimensions through which the risk posed by AI systems may become apparent. There are eleven such criteria and, in summary, they are: the intended purpose of the system; the current or expected extent of its use; the nature and quantity of the data processed, with particular reference to special categories of personal data; the degree of autonomy of the system and the possibility of human intervention; any harm that has already occurred or documented concerns; the potential extent of the harm; people’s dependence on the system’s outputs; any power imbalances or situations of vulnerability; the reversibility or possible correction of effects; the expected benefits of the system’s deployment; and the existence in Union law of effective measures or remedies to mitigate the risks identified.

Finally, the third paragraph grants the Commission the power to amend Annex III by reducing its scope, removing certain areas of application if two conditions are met:

a) the high-risk AI system concerned no longer poses significant risks to fundamental rights, health, or safety, taking into account the criteria listed in paragraph 2;

b) the removal does not reduce the overall level of protection of health, safety, and fundamental rights under Union law.

It is significant to note that the list can be amended only by removing areas already included, and not by adding new categories, when evidence shows that a particular area no longer presents significant risks. Ultimately, the criteria already used in Article 6 are confirmed: additions are justified by the presence of significant risks, while removals are permitted only if they do not adversely affect the level of protection.

Matteo Barakat

(translated by MIRAI)