Upcomingv1.0.0

Annex III: high-risk AI

Classification route for standalone high-risk AI systems under Article 6(2) and Annex III.

The core rules in Chapter III, Sections 1 to 3, for systems under Article 6(2) and Annex III become applicable on 2 December 2027.

Which AI is high-risk, with examples per area: Annex III of the EU AI Act.

Praxikon tracks Annex III: high-risk AI under the EU AI Act, checked against the official source on 8 August 2026, citing the source for every statement.

Status: Upcoming
Application date: 2 December 2027
Version: 1.0.0
Last reviewed: 8 August 2026

Review status: placed against the official source (8 August 2026). Next check due by 4 February 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

From source to evidence

Why this obligation applies, what it asks of you, and what you show for it.

Applies

Upcoming · 2 December 2027

For whom

Deployer
Provider of an AI system

What you do

Classify the use case and document the outcome

What you record

Article 6 and Annex III classification record

Official source

Amended Article 113, Article 6(2) and Annex III application date

Who this is relevant to

When this applies

Deployer
An organisation using an AI system under its authority, excluding personal non-professional use.
Provider of an AI system
A party that develops or has an AI system developed and places it on the market under its own name.

1The intended purpose falls within a use case listed in Annex III.
2Classification follows Article 6(2).

What the official source establishes

The core rules in Chapter III, Sections 1 to 3, for systems under Article 6(2) and Annex III become applicable on 2 December 2027.

Our interpretation

The official source remains authoritative. This general interpretation is not legal advice.

The later application date does not remove the classification question. An early classification record avoids design and procurement decisions without evidence.

What you can do now

Document now the intended purpose, Annex III point, Article 6(3) assessment, profiling and selected registration path.

01
Classify the use case and document the outcome
Assess Article 5, Article 6 and Annex III in that order and document purpose, context and any Article 6(3) exception.

What to retain

Article 6 and Annex III classification record

Traceable rationale covering intended purpose, Annex III category, Article 6(3) assessment and registration decision.

Control and reassessment

Reclassification on purpose or context change
Reopen classification when intended purpose, use context or system functionality changes materially.

Public tools

Annex III classification route
Public classifier for the high-risk use cases in Annex III.
Open the eight public classification routes

Conditions and exceptions

A listed Annex III system may fall outside high-risk under the strict conditions in Article 6(3), except where it profiles. The assessment and registration must be documented.

Official sources and locators

Digital Omnibus on AI 2026/1744
European Parliament and Council | official-journal-2026-07-24
Source locator: Amended Article 113, Article 6(2) and Annex III application date
Open official source
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 6 and Annex III
Open official source
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 6(2)-(4), Article 49 and Annex III
Open official source

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Annex III: high-risk AI",
praxikon:eu:ai-act:obligation:annex-iii-high-risk@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.5.1 (schema 1.5.0),
effective_at 2026-07-27T00:00:00.000Z, known_at 2026-08-08T00:00:00.000Z,
sha256 c0afd1789ed393ba3f9ce04205bd74b4831ff0fd58146108fdd8dd08d2f4f6c9,
https://www.praxikon.com/en/verplichtingen/annex-iii-high-risk
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aannex-iii-high-risk&effective_at=2026-07-27&known_at=2026-08-08&lang=en, accessed 2026-11-07)

Short form

praxikon:eu:ai-act:obligation:annex-iii-high-risk@1.0.0 (sha256 c0afd178)

BibTeX

@misc{praxikon-eu-ai-act-obligation-annex-iii-high-risk-1-0-0,
  author       = {{Praxikon}},
  title        = {Annex III: high-risk AI},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:annex-iii-high-risk},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.5.1, schema 1.5.0},
  note         = {effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 c0afd1789ed393ba3f9ce04205bd74b4831ff0fd58146108fdd8dd08d2f4f6c9},
  url          = {https://www.praxikon.com/en/verplichtingen/annex-iii-high-risk},
  urldate      = {2026-11-07},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:annex-iii-high-risk@1.0.0",
    "type": "dataset",
    "title": "Annex III: high-risk AI",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:annex-iii-high-risk",
    "URL": "https://www.praxikon.com/en/verplichtingen/annex-iii-high-risk",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          8
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          11,
          7
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.5.1; schema 1.5.0; effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 c0afd1789ed393ba3f9ce04205bd74b4831ff0fd58146108fdd8dd08d2f4f6c9; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aannex-iii-high-risk&effective_at=2026-07-27&known_at=2026-08-08&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

What changed in this

Moments when this obligation took effect, moved or received official guidance.

2028-08-02 | upcoming
High-risk AI embedded in regulated products
AI as a safety component of products under Annex I follows on 2 August 2028.
2027-12-02 | binding law
Annex III core rules moved to 2 December 2027
The amended application date has been binding law since 27 July 2026.
2026-05-19 | guidance
Draft guidelines on high-risk classification
The Commission explains in consultation when a system falls under Annex I or Annex III.
2025-07-29 | guidance
Guidelines on the definition of an AI system
The Commission draws the line between software that does and does not fall under the regulation.

See the full timeline

What member states are doing with this

Dated signals from the enforcement tracker that refer to this obligation.

EU | 2026-07-27 | Europees Parlement en Raad
Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force
The Digital Omnibus on AI, adopted on 8 July 2026 and published in the Official Journal on 24 July 2026, enters into force on 27 July 2026. The regulation defers the obligations for stand-alone high-risk AI systems (Annex III) from 2 August 2026 to 2 December 2027 and for embedded high-risk systems (Annex I) from 2 August 2027 to 2 August 2028, and adds two prohibitions to Article 5 as of 2 December 2026 (non-consensual intimate imagery and AI-generated child sexual abuse material). This recalibrates the enforcement agenda of the Commission and the Member States.
EUR-Lex
France | 2023-12-27 | Commission Nationale de l’Informatique et des Libertés (CNIL)
CNIL fines Amazon France Logistique 32 million euros for employee monitoring
The CNIL fined Amazon France Logistique 32 million euros for an excessively intrusive system that tracked warehouse workers’ activity via scanners down to the second. Under the AI Act, algorithmic monitoring of workers is a high-risk use (Annex III, employment), with obligations applying from 2 December 2027.
CNIL, besluit SAN-2023-021
Netherlands | 2022-04-12 | Autoriteit Persoonsgegevens (AP)
Dutch DPA fines Tax Administration 3.7 million euros for the FSV fraud blacklist
From 2013 to 2020 the Tax Administration kept signals of possible fraud on around 270,000 people in the Fraud Signalling Facility (FSV). The Dutch DPA imposed six fines, 3.7 million euros in total (decision of 7 April 2022, announced on 12 April 2022), among others for the lack of a legal basis, inaccurate data, excessive retention and asking the data protection officer for advice on the DPIA too late. According to the DPA, staff were also instructed to base the fraud risk partly on nationality and appearance. An AI system that flags fraud in benefits or allowances can fall under Annex III point 5(a) of the AI Act if its output is used to grant, reduce, revoke or reclaim a benefit or allowance, unless Article 6(3) exempts the system.
Autoriteit Persoonsgegevens, persbericht 12 april 2022 en boetebesluit 7 april 2022
Netherlands | 2021-12-07 | Autoriteit Persoonsgegevens (AP)
Dutch DPA fines Tax Administration 2.75 million euros over nationality in childcare benefits
For years the Benefits department unlawfully kept the dual nationality of Dutch citizens and used applicants’ nationality in a risk model and in fraud detection for childcare benefits, although this was not necessary. The Dutch DPA held the processing unlawful and, being discriminatory, also unfair, and imposed a fine of 2.75 million euros (decision of 25 November 2021, announced on 7 December 2021). Under the AI Act a FRIA describes the risks of harm to groups, and the provider of a high-risk system examines its datasets for bias.
Autoriteit Persoonsgegevens, persbericht 7 december 2021 en boetebesluit 25 november 2021
Netherlands | 2020-02-05 | Rechtbank Den Haag
SyRI: legislation for a government risk model offers insufficient safeguards
The court declared the statutory basis of the System Risk Indication (SyRI), which the government used to link data to flag benefit and allowance fraud, non-binding for breach of Article 8 ECHR. Without insight into the risk indicators and the risk model, or statutory safeguards that compensate for that, it cannot be established that the interference with private life is proportionate. The court drew on the GDPR principles of transparency, purpose limitation and data minimisation. An AI system that assesses eligibility for a benefit falls under Annex III point 5(a) of the AI Act, with obligations applying from 2 December 2027.
Rechtbank Den Haag 5 februari 2020, ECLI:NL:RBDHA:2020:865

Open the enforcement tracker

Version history

v1.0.0
27 July 2026
Annex III: high-risk AI
Classification route for standalone high-risk AI systems under Article 6(2) and Annex III.

Corrections to this obligation

No substantive correction to this object has been recorded.

Open the correction log

Behind this page

Zahed Ashkara

Freelance AI and privacy legal adviser · AI governance & safety

View profile LinkedIn

Have it done

Record the classification with a reasoned opinion

A classification that is not recorded anywhere cannot be defended afterwards. In a signed classification opinion I test one system against Annex III and the Article 6(3) exception, and you receive a signed opinion with the obligations and dates that follow.

Signed assessment · From €495 · fixed price per item, excluding VAT · 1 to 4 weeks

See the signed assessment

Carried out by Zahed Ashkara, the legal adviser behind this explanation.

For AI agents and integrations

This page and the machine output derive from the same versioned object. Use the API for deterministic filters by role, topic and time.

Open as JSON Open as JSON-LD Open this object in the explorer Read the methodology