The Annex III Scoping Exercise: Which of Your Systems Are Actually High-Risk (and Which Aren’t)

The instinct, when a regulation lands, is to over-classify: call everything high-risk, apply the full weight of obligations, and sleep at night. Under the AI Act that instinct is a mistake — an expensive one — because the Act gives you a filter, and using it well is itself the compliance work.

Annex III of the EU AI Act lists the use cases that make an AI system a candidate for the high-risk regime. Being on that list is not, by itself, a verdict. Article 6(3) sits directly on top of Annex III and lets a system out again if it does not, in substance, pose the risk the list is worried about. Most teams I speak to have read Annex III and stopped there. They have concluded that because they run a CV-screening tool, or a credit model, or a system touching an essential service, they are automatically inside the full high-risk apparatus. Some are. Many are not. Working out which is not a legal footnote — it is a scoping decision with real cost on both sides of it.

What the filter actually is

Annex III enumerates eight areas: biometrics; critical infrastructure; education and vocational training; employment and workforce management; access to essential private and public services, including creditworthiness and insurance risk pricing; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. If your system’s intended purpose falls into one of these, you are in scope of the classification question. You are not yet high-risk.

Article 6(3) provides that a system captured by Annex III is not high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. The Act then gives four conditions, and meeting one of them is the route out. The system is not high-risk if it is intended to perform a narrow procedural task; or to improve the result of a previously completed human activity; or to detect decision-making patterns or deviations from prior patterns without being meant to replace or influence the completed human assessment without proper human review; or to perform a preparatory task to a relevant assessment.

Read those carefully, because the drafting does the work. Each condition draws a line between a system that structures or supports a decision and one that makes or shapes it. A tool that indexes, reformats or deduplicates documents ahead of a human assessment is performing a procedural or preparatory task. A tool that scores, ranks or prioritises those same documents in a way a human then leans on is influencing the outcome, and the filter closes.

The four ways out, and the trap in each

The European Commission has issued draft guidelines on the classification of high-risk systems, published for consultation in 2026, and their consistent instruction is that these conditions are exceptions and must be read narrowly. That matters for how you argue your case. A few patterns come up repeatedly.

“Narrow procedural task” is narrower than it sounds. Structuring input is not the same as evaluating it. The moment your system applies an evaluative judgement — deciding what is relevant, useful, or a priority — you have left the procedural lane, even if a human sees the output.

“Improving a previously completed human activity” cannot change the outcome. Cleaning up the language of a decision a person has already made is improvement. Proposing a different decision, or altering someone’s legal or economic position, is not — that is a fresh assessment wearing the costume of an edit.

Pattern detection has to stay after the fact. The condition is written for systems that flag anomalies in decisions already taken, subject to human review. If the same model starts inferring the criteria for the next decision, it is no longer detecting patterns; it is setting them.

The honest test for each condition is the counterfactual: if this system were switched off tomorrow, would the human decision materially change? If yes, you are influencing the outcome and the filter does not apply. If the decision would look the same because a person was always doing the substantive work, you have a defensible case.

Profiling is the trapdoor under all four

There is one override that collapses the whole exercise. Article 6(3) states that a system referred to in Annex III is always high-risk where it performs profiling of natural persons, in the sense the GDPR uses that term — automated processing to evaluate personal aspects such as performance, economic situation, behaviour, or reliability. No condition rescues a profiling system. This is the first question to ask, not the last, because a great deal of employment, credit and insurance tooling profiles by design. If yours does, stop the scoping analysis; the answer is high-risk and the effort is better spent on the risk management system Article 9 requires and the conformity route that follows.

The decision is only worth what its documentation proves

Article 6(4) is the part teams skip, and it is the part a supervisor will ask for. A provider that concludes an Annex III system is not high-risk must document that assessment before the system is placed on the market or put into service. The self-assessment is not a free pass; market surveillance authorities can review it and force reclassification if the reasoning does not hold. So the deliverable of your scoping exercise is not a decision — it is an evidenced decision. Which Annex III use case the system touches; which of the four conditions you rely on; the counterfactual reasoning; confirmation that no profiling occurs; and the sign-off with a date. That file is your defence, and an undocumented “we decided it wasn’t high-risk” is indistinguishable, to a regulator, from not having thought about it at all.

One catch that surprises people: concluding a system is not high-risk does not always take you off the radar. Under Article 49, providers who consider an Annex III system to be outside high-risk are still expected to register themselves and the system in the EU database. Filtering out of the obligations is not the same as filtering out of visibility — the registration duty still applies, and your documented assessment is what backs the entry.

The deadline you are actually working to

The high-risk obligations for stand-alone Annex III systems were originally set to apply from 2 August 2026. The Commission’s Digital Omnibus package proposes to move that to 2 December 2027, with product-embedded systems under Annex I shifting to 2028. As matters stand in mid-2026 that postponement is a political agreement, not yet adopted or published in the Official Journal — so until it is, the earlier date remains the operative law and you should plan against it rather than against a reprieve that may not have landed. Article 50 transparency duties and the Article 4 AI-literacy obligation are unaffected either way and are already live.

The scoping work is identical regardless of which date binds. Whether your hard deadline turns out to be 2026 or 2027, the classification decision, the documentation and the profiling check are the same, and — as I have argued about why the Annex III reprieve is a trap — the extra months are for doing the assessment properly, not for deferring it. If your filtering-out is right, you have saved yourself a conformity assessment; if it is wrong, you would rather find out now than in an inspection. That choice between internal control and a notified body only becomes real for the systems that genuinely remain high-risk.

Over-scope and you carry obligations you do not owe. Under-scope and you have a compliance failure with your name documented on the wrong side of it. The scoping exercise is where you decide which of those you are risking — so decide it on paper, with reasons, before the system ships.

Sixteen Pillars reads AI system inventories against Article 6 and writes the classification decision — the filter argument, the profiling check and the Article 6(4) file — so it holds up when a market surveillance authority asks to see it. Pricing is published at /pricing/. If your organisation is staring at an Annex III list and reflexively calling all of it high-risk, an independent scoping reading is where to start.

Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, and Middle East, with on-site time where the engagement requires it.