EU AI Act Annex III: high-risk AI systems guide for SMEs

Biometric identification and categorisation

1

Low — most SMEs do not operate biometric identification systems

AI systems used for real-time or post-event remote biometric identification of natural persons in publicly accessible spaces. Includes biometric systems for authentication if used for consequential identity verification purposes at scale.

Critical infrastructure management

2

Low — applies to utility, transport, and infrastructure operators

AI intended as safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating, or electricity.

Education and vocational training

3

Medium — applies to training providers using AI assessment

AI used to determine access to educational and vocational training institutions, to evaluate or grade students, to detect prohibited behaviour during assessments, and to recommend the level of education appropriate for an individual.

Employment, worker management, and self-employment

4

High — widely used in SME HR and recruitment

AI used for recruitment or selection of natural persons (including CV screening, job targeting, and interview analysis), for performance evaluation, promotion decisions, task allocation, and monitoring of behaviour and performance in employment contexts. This is the most commonly relevant category for SMEs.

Essential private and public services

5

Medium — applies to financial services, insurance, and utilities

AI used to evaluate the eligibility for and grant of public benefits, to assess creditworthiness, to determine insurance premiums, and for emergency service dispatching. Includes AI credit scoring and AI-assisted loan underwriting.

Law enforcement

6

Very low — applies to police and law enforcement authorities

AI used by law enforcement authorities to assess crime risk, as polygraphs, for analysis of deep fakes in criminal investigations, and related purposes. Does not typically apply to private-sector SMEs.

Migration, asylum, and border control

7

Very low — applies to immigration and border authorities

AI used to assess irregular migration risks, to assist in examination of visa and asylum applications, and for border management. Applies to relevant public authorities and large-scale service providers in this sector.

Administration of justice and democratic processes

8

Very low — applies to courts and electoral administration

AI used to assist judicial authorities in researching and interpreting facts and the law and in applying the law to concrete facts, and AI used to influence the outcome of elections.

Implement human oversight measures

Ensure appropriate human oversight for the AI system's operation and outputs, including clear procedures for when human intervention or override is required.

Monitor operation and report incidents

Monitor the AI system for risks and, where required, report serious incidents to the relevant market surveillance authority.

Conduct a fundamental rights impact assessment (FRIA)

Before deploying certain Annex III AI systems (particularly those affecting large populations or making consequential decisions), prepare a FRIA documenting the potential impact on fundamental rights and the mitigation measures in place.

Register the AI system in the EU AI database

Deployers of specific Annex III AI systems must register them in the EU-wide public AI database before deployment.

Inform employees

Where the AI system affects or makes decisions about employees, ensure those employees are informed that they are subject to the AI system's operation.