Skip to content

Reg Intel

EU AI Act Annex III Explained: Every High-Risk Category with Real-World Examples

·

, , ,

·

Reading time calculated on load

·

Last reviewed: April 9, 2026

Jurisdictions covered: EU (primary), with US, UK, and South Korea comparison

Reading time: 22 minutes

Regulatory uncertainty: The European Commission has not yet published the Art. 6(5) classification guidelines that were due by February 2, 2026. The analysis in the Art. 6(3) section below is based on the regulation text, recitals, and available commentary. We will update this content when official guidance is published. Last checked: 2026-03-23.

Key Takeaways

– Annex III lists 8 categories of high-risk AI covering biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and democratic processes (EU AI Act Annex III).

– Real products already affected: SCHUFA credit scoring, HireVue video interviewing, Proctorio exam proctoring, Corti emergency triage, Clearview AI facial recognition, and Palantir Gotham, among others.

– Art. 6(3) provides an exception for systems listed in Annex III that do not pose a “significant risk of harm.” But this exception is contested, and Commission guidelines that would clarify it are overdue since February 2, 2026.

– Providers must self-classify. No authority tells you whether your AI system is high-risk. You determine this yourself and document your reasoning (EU AI Act Art. 6(4)).

– High-risk obligations (Art. 9-15) become enforceable August 2, 2026. The Digital Omnibus proposal (Council position agreed March 13, 2026) would extend this to December 2, 2027, but it has not been adopted.

What Annex III Is and Why It Matters

Regulation (EU) 2024/1689 (the EU AI Act) classifies AI systems into four risk tiers: unacceptable (prohibited), high-risk, limited risk, and minimal risk. The high-risk tier carries the heaviest compliance burden, and there are two paths into it.

The first path runs through product safety. Under Art. 6(1), if your AI system is a safety component of a product already regulated under EU harmonisation legislation listed in Annex I (medical devices, machinery, toys, vehicles, aviation, marine equipment, and others), and that product requires a third-party conformity assessment, your AI system is automatically high-risk.

The second path is Annex III. Under Art. 6(2), if your AI system is used for one of the 8 purposes listed in Annex III, it is classified as high-risk regardless of the product it sits in. This article focuses on this second path, because it is the one most organizations will encounter. Annex III covers AI systems that affect people’s rights, their access to services, their employment, and their interactions with the justice system and public authorities.

The deadline is legally binding. High-risk AI system obligations under Articles 9-15 become enforceable on August 2, 2026 (EU AI Act Art. 113(a)). The Council of the EU agreed a position on the Digital Omnibus proposal on March 13, 2026, which would push this deadline to December 2, 2027 for certain providers and extend SME relief to “small mid-caps.” But the Digital Omnibus has not been adopted into law. Until it is, August 2, 2026 remains the enforceable date.

A further complication: harmonised standards that would give providers a “presumption of conformity” are also not ready. The draft standard prEN 18286 failed its Enquiry vote in February 2026 after receiving 1,288 comments — the acceleration measures adopted in October 2025 proved insufficient. The scope was amended in March 2026 and a re-vote is pending, but realistic timelines now point to 2027. No harmonised standard has been published in the Official Journal. Providers must comply with the regulation text directly, without the convenience of standardised compliance checklists.

For practitioners, this means: you cannot wait for guidelines or standards. If your AI system falls under Annex III, start compliance work now.

The 8 High-Risk Categories

Annex III organises high-risk AI systems into 8 areas, each listing specific use cases. Every area below includes the legal basis, the relevant recital, and named commercial products already affected. We have deliberately structured each area differently, because they raise different practical questions.

Area 1: Biometrics

Clearview AI, NEC NeoFace, Cognitec FaceVACS. If you work with facial recognition, you are in this category.

Area 1 covers AI systems for biometric identification, biometric categorisation based on sensitive attributes (race, political opinions, trade union membership, religious beliefs, sex life, sexual orientation), and emotion recognition (Annex III(1); Recital 54).

The line between “high-risk” and “prohibited” is thin here. Real-time remote biometric identification in publicly accessible spaces for law enforcement is banned outright under Art. 5(1)(g), with narrow exceptions for missing children, imminent threats, and serious crime suspects. Post-remote identification (analysis after the fact) is high-risk, not prohibited. The distinction matters: if your system processes biometric data in real time on a public street, you have a prohibition problem, not a compliance problem.

Area 2: Critical Infrastructure

Only AI systems that function as safety components fall here. An AI system that optimises billing for a utility company? Not covered. An AI system that manages load balancing to prevent blackouts? Covered.

The category spans critical digital infrastructure, road traffic, and the supply of water, gas, heating, and electricity (Annex III(2); Recital 55). Products already affected include Siemens Grid AI (smart grid management), Google DeepMind’s energy optimization systems, and PTV Optima (real-time traffic signal control).

Our view: the “safety component” qualifier narrows this category significantly. Most AI systems used by utilities, transport operators, and digital infrastructure providers are operational efficiency tools, not safety components. The test is whether a failure or malfunction of the AI system could directly cause harm to people’s health, safety, or property. If the answer is no, you are probably outside this category. Document that reasoning.

Area 3: Education and Vocational Training

Proctorio flags a student for looking away from the screen. High-risk. Turnitin detects AI-generated text and triggers an academic integrity review. High-risk. A system infers a student is bored from their facial expression and adjusts the lesson. Prohibited under Art. 5(1)(e).

Those three examples capture the scope and the boundary. Area 3 covers AI that determines access to or admission to educational institutions, evaluates learning outcomes (including steering the learning process), assesses appropriate education levels, or monitors prohibited behaviour during tests (Annex III(3); Recital 56). Knewton Alta’s adaptive learning platform, which determines student pathways, also falls here.

Monitoring behaviour is high-risk. Inferring emotions and acting on them is banned.

Area 4: Employment, Workers Management, and Access to Self-Employment

Ask yourself this: does your AI system decide who gets hired, who gets promoted, who gets fired, or how work is allocated?

If yes, you are in Area 4. The legal text covers recruitment, screening, filtering, and evaluating candidates. It covers decisions affecting terms of work relationships, promotion, and termination. It covers task allocation based on individual behaviour, personal traits, or characteristics. And it covers monitoring and evaluating performance and behaviour in work-related relationships (EU AI Act Annex III(4); Recital 57).

HireVue’s AI video interview analysis is the textbook example. But consider less obvious ones: Uber and Deliveroo use algorithms for task allocation, performance scoring, and deactivation decisions for gig workers. Eightfold AI’s talent intelligence platform is used for hiring and internal mobility decisions at large organizations. All of these are high-risk under Area 4.

The prohibited boundary sits at emotion recognition. An AI tool that monitors worker keystrokes or task completion is high-risk. A tool that infers worker emotions from facial expressions or voice tone is prohibited under Art. 5(1)(e).

Area 5: Access to Essential Private and Public Services and Benefits

This is the widest category. If you work in financial services, insurance, public administration, or healthcare, at least one of its four sub-areas probably affects you (Annex III(5); Recital 58).

Sub-area (a) covers AI that evaluates eligibility for public assistance, benefits, or services, and AI that grants, reduces, revokes, or reclaims those benefits. Sub-area (b) covers credit scoring and creditworthiness assessment for individuals. Sub-area (c) covers risk assessment and pricing for life and health insurance. Sub-area (d) covers AI for evaluating and classifying emergency calls, including establishing priority for emergency dispatching.

Five products show the range. SCHUFA, Germany’s dominant credit scoring system affecting approximately 70 million people, falls under (b). Earnix, an insurance pricing and risk assessment AI, falls under (c). Corti, which assists emergency call triage in Denmark and the UK, falls under (d). Aidoc, a medical imaging AI used in emergency radiology triage, falls under (d) and also potentially under Annex I as a medical device. Zest AI, a credit underwriting AI used by US and EU lenders, falls under (b).

One carve-out worth noting: AI systems used for fraud detection in financial services are explicitly excluded from sub-area (b) on credit scoring (EU AI Act Annex III(5)(b)). A fraud detection model is not high-risk under this provision. But it may still qualify as high-risk if it profiles individuals, which would bring it under the profiling override in Art. 6(2).

Area 6: Law Enforcement

Palantir Gotham. COMPAS recidivism scoring. Veritone IDentify for suspect identification in investigations. All high-risk. But predictive policing that targets individuals based on profiling? Prohibited.

The prohibited-versus-high-risk boundary matters most in this category, so here is a table:

Use Case Classification
Real-time remote biometric ID in public spaces Prohibited (Art. 5(1)(g)), with narrow exceptions
Post-remote biometric ID (after the fact) High-risk (Annex III, Area 1)
Predictive policing directed at individuals (profiling) Prohibited (Art. 5(1)(h))
Crime analytics on data patterns (not targeting individuals) High-risk (Annex III, Area 6)
Social scoring by public authorities Prohibited (Art. 5(1)(c))
Individual risk assessment for recidivism High-risk (Annex III, Area 6)

Area 6 covers AI used by or on behalf of law enforcement for individual risk assessments, polygraphs, evidence reliability evaluation, and crime analytics (Annex III(6); Recital 59).

Area 7: Migration, Asylum, and Border Control

iBorderCtrl was an EU-funded project that used AI to detect deception at border crossings. It was discontinued, but it perfectly illustrates why this category exists: AI systems that affect whether people can cross a border, claim asylum, or obtain a visa carry fundamental rights implications that the Act treats as high-risk by default.

The legal text covers polygraphs and similar tools, risk assessments for irregular migration and health, examination of asylum and visa applications (including associated complaints), and the detection or identification of persons in the context of border management. Travel document verification is excluded (Annex III(7); Recital 60).

Two active systems are directly affected: Eurodac, the EU fingerprint database for asylum seekers (soon to be upgraded with AI-assisted matching), and ETIAS, the European Travel Information and Authorisation System, which uses automated risk assessment. Both are large-scale IT systems operated by eu-LISA.

These large-scale systems get a longer runway. Art. 111 provides a transition rule: systems established under EU law in the area of freedom, security, and justice (SIS II, VIS, Eurodac, ETIAS, ECRIS-TCN, and the Interoperability Framework) have until December 31, 2030 to achieve full compliance. The condition: operators must publish a plan by August 2, 2027 and meet risk management (Art. 9) and data governance (Art. 10) requirements by August 2, 2029.

Area 8: Administration of Justice and Democratic Processes

Two very different use cases share this final category. The first: AI that helps judges research and interpret facts and law. Luminance, the AI legal research tool used by some judicial authorities, falls here. The second: AI used to influence elections or referendums, including political microtargeting platforms (Annex III(8); Recitals 61-62).

Back-office campaign tools (scheduling, logistics, fundraising optimization) that do not directly target voters are not covered. The line is between AI that influences how people vote and AI that helps campaigns run efficiently.

We recommend: if you supply AI tools to judicial authorities or political campaigns, get a legal opinion now. This category is where civil society organizations and data protection authorities are most likely to file complaints, and enforcement precedent does not exist yet.

Real-World Examples Table

The following table collects the commercial products referenced in this article by Annex III area.

Product Company Annex III Area Classification Path
Clearview AI Clearview AI 1: Biometrics Art. 6(2) via Annex III
NEC NeoFace NEC Corporation 1: Biometrics Art. 6(2) via Annex III
Cognitec FaceVACS Cognitec 1: Biometrics Art. 6(2) via Annex III
Siemens Grid AI Siemens 2: Critical Infrastructure Art. 6(2) via Annex III
Google DeepMind energy Google DeepMind 2: Critical Infrastructure Art. 6(2) via Annex III
PTV Optima PTV Group 2: Critical Infrastructure Art. 6(2) via Annex III
Proctorio Proctorio 3: Education Art. 6(2) via Annex III
Turnitin AI Detection Turnitin 3: Education Art. 6(2) via Annex III
Knewton Alta Knewton (Wiley) 3: Education Art. 6(2) via Annex III
HireVue HireVue 4: Employment Art. 6(2) via Annex III
Uber driver algorithms Uber 4: Employment Art. 6(2) via Annex III
Deliveroo algorithms Deliveroo 4: Employment Art. 6(2) via Annex III
Eightfold AI Eightfold AI 4: Employment Art. 6(2) via Annex III
SCHUFA scoring SCHUFA Holding AG 5: Essential Services Art. 6(2) via Annex III
Earnix pricing AI Earnix 5: Essential Services Art. 6(2) via Annex III
Corti triage AI Corti 5: Essential Services Art. 6(2) via Annex III
Aidoc radiology AI Aidoc 5: Essential Services Art. 6(1) via Annex I (medical device) + Art. 6(2) via Annex III
Zest AI Zest AI 5: Essential Services Art. 6(2) via Annex III
Palantir Gotham Palantir Technologies 6: Law Enforcement Art. 6(2) via Annex III
COMPAS Northpointe (Equivant) 6: Law Enforcement Art. 6(2) via Annex III
Veritone IDentify Veritone 6: Law Enforcement Art. 6(2) via Annex III
iBorderCtrl EU research project 7: Migration Art. 6(2) via Annex III
Eurodac eu-LISA 7: Migration Art. 6(2) via Annex III
ETIAS eu-LISA 7: Migration Art. 6(2) via Annex III
Luminance Luminance Technologies 8: Justice/Democratic Art. 6(2) via Annex III

Note: Aidoc may be classified via both paths, as medical devices are covered under Annex I (Regulation (EU) 2017/745) and radiology triage is covered under Annex III Area 5.

Last updated: 2026-03-23

Note: Product classifications represent our analysis based on publicly available information about each system’s capabilities and use case. These are not official regulatory determinations. Providers should conduct their own classification under Art. 6.

The Art. 6(3) Exception: When High-Risk Classification May Not Apply

Not every AI system listed under an Annex III category is automatically high-risk. Art. 6(3) provides an exception: a system referred to in Annex III is not considered high-risk if it does not pose a “significant risk of harm to the health, safety, or fundamental rights of natural persons.”

This exception is one of the most debated provisions of the entire AI Act. The Commission was supposed to publish guidelines clarifying its application by February 2, 2026 (EU AI Act Art. 6(5)). Those guidelines have not appeared.

The Two-Layer Test

To claim the Art. 6(3) exception, an AI system must pass both layers of a two-part test.

Layer 1 is the mandatory gateway: the AI system does not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons. This must always be met.

Layer 2 is a functional test. The system must satisfy at least one of four alternative conditions:

(a) The system is intended to perform a narrow procedural task.
(b) The system is intended to improve the result of a previously completed human activity.
(c) The system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review.
(d) The system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.

Both layers must be satisfied. But the four functional conditions are alternatives. Meeting any one of (a) through (d) is sufficient for Layer 2.

The Profiling Override

There is one scenario where the exception never applies, regardless of whether both layers are met: if the system performs profiling of natural persons as defined in GDPR Art. 4(4). In that case, the system is always classified as high-risk (EU AI Act Art. 6(2), last paragraph).

Profiling means any form of automated processing used to evaluate personal aspects of a natural person. That includes analysing or predicting work performance, economic situation, health, personal preferences, reliability, behaviour, location, or movements. The GDPR definition is broad. Many AI systems that appear to “merely assist” human decisions will still profile individuals in the GDPR sense, which closes the Art. 6(3) door entirely.

Provider Documentation Obligation

If a provider concludes that Art. 6(3) applies and their system is not high-risk, they must document this assessment and make it available to national competent authorities upon request before placing the system on the market (EU AI Act Art. 6(4)). This is not optional. A provider who claims the exception without documentation is non-compliant.

Three Positions on the Exception

This interpretation is contested. Three distinct positions have emerged, and they are not converging.

Position A: civil society says read it narrowly. Organizations including the EU Fundamental Rights Agency (FRA), AccessNow, and AlgorithmWatch argue that the exception should be interpreted restrictively. AccessNow’s consultation response calls Art. 6(3) a “glaring loophole” that could allow providers to self-exempt from high-risk obligations. Daniel Leufer of AccessNow has argued that the conditions are vague enough that “almost any provider could construct an argument that their system merely assists human decision-making.” The FRA’s 2025 report “Assessing High-risk AI” recommends that Member States interpret the exception restrictively and require providers to demonstrate, not merely assert, that the conditions are met.

Position B: industry says read it broadly. Law firms including WilmerHale, Taylor Wessing, and William Fry have argued that the exception is wider than civil society reads it. Under this interpretation, many auxiliary AI systems that perform preparatory or filtering tasks in Annex III domains would qualify. A CV-screening tool that sorts applications into “reviewed” and “not reviewed” piles but does not make the hiring decision? Possibly exempt. An AI tool that highlights relevant legal precedents for a judge but does not draft the ruling? Possibly exempt. The industry position is that Art. 6(3) reflects a legislative intent to exempt AI systems that genuinely support, rather than replace, human decision-making.

Position C: the Commission is silent. The European Commission was required under Art. 6(5) to publish guidelines on the practical implementation of Art. 6(2), including the Art. 6(3) exception, by February 2, 2026. As of March 23, 2026, no guidelines have been published. The AI Act Service Desk has not issued interim guidance.

This is an open question because the legal text is ambiguous, the three camps disagree on how to read it, and the body responsible for clarifying it has missed its own deadline by seven weeks.

Our Recommendation

Treat your system as high-risk until the Commission publishes guidelines. The cost of wrongly claiming the exception (non-compliance with Art. 9-15, penalties of up to EUR 15M or 3% of turnover) is far higher than the cost of over-classifying. If you believe the exception applies to your system, document your reasoning rigorously under Art. 6(4), include analysis of all four functional conditions in Layer 2 and the profiling override, and be prepared to defend that reasoning to a national competent authority.

Self-Classification Decision Tree

No authority classifies your AI system for you. Providers self-classify under the EU AI Act. The following five steps walk through the classification logic.

Step 1. Is your AI system a safety component of a product covered by EU harmonisation legislation listed in Annex I, and does that product require a third-party conformity assessment?

  • Yes → Your system is high-risk via Art. 6(1). Comply with Art. 9-15. Stop here.
  • No → Go to Step 2.

Step 2. Does your AI system fall under any of the 8 areas listed in Annex III?

  • No → Your system is not high-risk under Art. 6(1) or Art. 6(2). It may still have transparency obligations under Art. 50 if it is a chatbot, deepfake generator, or emotion recognition system. Stop here.
  • Yes → Go to Step 3.

Step 3. Does your AI system perform profiling of natural persons as defined in GDPR Art. 4(4)?

  • Yes → Your system is high-risk regardless of any exception. The profiling override in Art. 6(2) last paragraph applies. Comply with Art. 9-15. Stop here.
  • No → Go to Step 4.

Step 4. Does your AI system pass the Art. 6(3) two-layer test? Layer 1: Does it pose no significant risk of harm? Layer 2: Does it meet at least one of the four functional conditions (narrow task, improves prior human activity, detects patterns without replacing human assessment, preparatory task)?

  • Yes, both layers satisfied → Your system may qualify for the exception. But guidelines that would confirm this interpretation are overdue. Document your reasoning under Art. 6(4). We recommend treating your system as high-risk until the Commission publishes guidance.
  • No, one or both layers not met → Your system is high-risk. Comply with Art. 9-15.

Step 5. Result and next actions:

  • High-risk: Begin compliance with Art. 9-15. Conduct a conformity assessment under Art. 43. If you are a public-sector deployer, conduct a Fundamental Rights Impact Assessment under Art. 27.
  • Uncertain (Art. 6(3) exception may apply): Seek specialist legal advice. Document your classification reasoning. Monitor the Commission’s website for Art. 6(2) guidelines.

Note: An interactive version of this decision tree is planned at /tools/high-risk-classifier/

What Happens If You Are High-Risk: The Art. 9-15 Obligations

High-risk classification triggers seven mandatory obligations. All become enforceable August 2, 2026. Here is what they require in practice, and where organizations get tripped up.

Start with risk management under Art. 9. This is not a one-time assessment. You build a risk management system that runs continuously from design through post-market monitoring. Identify known and foreseeable risks, estimate them, evaluate them against your training data, intended use, and foreseeable misuse. Then keep doing it. The word “system” is deliberate: the Act requires an ongoing process, not a document you file and forget.

Data governance (Art. 10) requires that your training, validation, and testing data be relevant, representative, and as error-free as possible. You must also examine that data for biases, specifically biases that could affect health, safety, or fundamental rights given how and where the system will be used.

Then comes the paperwork. Technical documentation under Art. 11 must be completed before you place the system on the market, following the format in Annex IV. Your system must automatically record events relevant to identifying risk situations, with a minimum retention period of 6 months (Art. 12). And transparency requirements under Art. 13 mean you provide instructions for use covering the provider’s identity, the system’s capabilities and limitations, intended purpose, and tested accuracy, robustness, and cybersecurity levels. Deployers need enough information to interpret the output and use it appropriately.

Human oversight under Art. 14 is the obligation that catches organizations off guard. A human must be able to fully understand the system, monitor its operation, and have the authority to override, reverse, or stop it. “We have a human in the loop” is not enough if that human cannot actually intervene. We see this mistake constantly: teams designate a human reviewer who lacks the technical knowledge, the authority, or the time to genuinely oversee the system. That does not satisfy Art. 14.

Finally, Art. 15 requires you to declare your accuracy metrics in the instructions for use and maintain them throughout the system’s lifecycle. The system must resist errors, faults, and attempts by third parties to alter its performance.

Get any of this wrong, and fines reach EUR 15 million or 3% of global annual turnover, whichever is higher (Art. 99(4)). SMEs and startups pay the lower amount. Prohibited practices carry stiffer penalties: EUR 35M or 7% (Art. 99(3)).

How Other Jurisdictions Define “High-Risk”

The EU is not the only jurisdiction classifying AI systems by risk. Here is how the EU’s approach compares with three other frameworks, as of March 2026.

Dimension EU (AI Act) US (NIST AI RMF) UK (DSIT Framework) South Korea (AI Basic Act)
Classification method List-based (Annex III, 8 categories) Risk levels (context-dependent, no fixed list) Sector-regulator approach (no single list) 11 high-impact AI categories
Legally binding? Yes (Regulation (EU) 2024/1689) No (voluntary framework) No (principles-based guidance) Yes (AI Basic Act, enacted 2025)
Pre-market assessment Yes (conformity assessment, Art. 43) No No Yes (impact assessment required)
Who classifies? Provider (self-classification) Organization (self-assessment) Sector regulator determines applicability Provider + MSIT (Ministry of Science and ICT)
Fixed list of categories? Yes (Annex III, amendable by Commission via Art. 7) No No Yes (11 categories, similar to EU)

Comparison current as of: 2026-03-23

The EU and South Korea share the most structural similarities. Vietnam’s AI Law, effective March 2026, also uses a risk-based classification but with three tiers instead of the EU’s four. Both use binding legislation with fixed lists of high-risk categories and require pre-market assessments. South Korea’s AI Basic Act defines 11 high-impact AI categories that overlap substantially with the EU’s Annex III, including employment, credit, education, and law enforcement.

The US approach under the NIST AI Risk Management Framework is fundamentally different. It provides a voluntary structure for organizations to assess AI risks in context, without prescribing fixed categories or mandatory assessments. No federal AI law exists.

The UK’s DSIT pro-innovation framework delegates classification to existing sector regulators. The FCA handles financial services AI, Ofcom handles communications, the CQC handles healthcare. There is no single “high-risk” list, and the framework is not binding.

Our view: if you comply with the EU AI Act’s Annex III requirements, you will likely meet or exceed what other jurisdictions require. The EU standard is the most prescriptive and the most demanding. For organizations operating across jurisdictions, start with EU compliance and map outward.

What to Do This Week

The compliance deadline is August 2, 2026. If you are reading this in March, you have roughly four months. Here is where to start.

Inventory your AI systems. Map every AI system your organization provides or deploys against the 8 Annex III categories. If a system does not match any use case, document why. If it does match, move to the next step. Do not skip systems that “probably” do not qualify. Write it down.

Assess the Art. 6(3) exception for each system. For every system that falls under an Annex III category, check whether both layers of the exception test are met. Document your reasoning in writing. Remember the profiling override: if the system profiles natural persons as defined in GDPR Art. 4(4), the exception does not apply.

Determine your conformity assessment pathway. Most high-risk systems use the internal control procedure (Annex VI). But biometric identification systems in law enforcement and certain financial-sector AI require a third-party assessment by a notified body (Art. 43(1)). Know which one applies to you before you start building your compliance file.

Watch for the Commission’s Art. 6(2) guidelines. They are overdue since February 2, 2026. When they arrive, they will clarify the Art. 6(3) exception and could change how borderline systems are classified. Bookmark the AI Act Service Desk.

If you are a public-sector deployer: start your Fundamental Rights Impact Assessment now. Art. 27 requires it before you put a high-risk system into use. The AI Office is developing a FRIA template with the FRA, but it has not been published yet. Use the FRA’s existing guidance in the meantime.

Disclaimer: This content is for informational and educational purposes only. It does not constitute legal advice. AI regulation varies by jurisdiction and changes frequently. Consult qualified legal counsel for advice specific to your organization’s circumstances and jurisdiction. Reg-Intel is not a law firm and does not provide legal services.

Jurisdiction note: This content covers the EU primarily, with comparative references to the US, UK, and South Korea. Requirements summarized here reflect the state of the law as of March 23, 2026. For jurisdiction-specific compliance decisions, consult local legal counsel familiar with the applicable regulatory framework.

Last verified: 2026-04-09

Sources

Official Sources

Data Sources

  • European Radiology (2025), “173 CE-certified AI diagnostic imaging products from 90+ vendors” — Last accessed: 2026-03-23

Analysis and Commentary

Cross-Jurisdiction Frameworks

Compare: EU vs UK

For the comprehensive comparison across twelve dimensions — structural divergence, risk classification, the 19 UK regulators vs the EU AI Office, enforcement penalties, the Data (Use and Access) Act 2025, AISI vs the EU AI Office, and a five-step dual-market compliance baseline — see EU vs UK AI Regulation: Precaution vs Innovation Compared (2026).

Singapore Wave 2 — Deep Dives + EU Comparison

Compare: EU vs China

For the global keystone comparison across twelve dimensions — algorithm filing vs conformity assessment, content moderation conflicts, asymmetric extraterritoriality, enforcement philosophy, and a five-step dual-market compliance baseline — see EU vs China AI Regulation: Two Systems, Two Philosophies (2026).

Compare: EU vs South Korea

For the global keystone comparison across twelve dimensions — high-impact vs high-risk classification, mandatory vs voluntary conformity, KRW 30M vs €35M penalties, Korea’s innovation chapter, and a five-step dual-market compliance baseline — see EU vs South Korea AI Act: High-Impact vs High-Risk Compared (2026).

Disclaimer

This content is for informational and educational purposes only. It does not constitute legal advice. AI regulation varies by jurisdiction and changes frequently. Consult qualified legal counsel for advice specific to your organization’s circumstances and jurisdiction. Reg Intel is not a law firm and does not provide legal services.

The Weekly Brief

5 AI regulation developments that matter. Every Tuesday.

Reg Intel
Published: March 23, 2026 · Updated: May 1, 2026 · Jurisdictions: European Union, South Korea, United Kingdom, United States
Source: https://reg-intel.com/annex-iii-explained/