High-Risk Obligations in Practice

Two routes land you in the regulated tier:

• Annex I — AI that's a safety component of products already under EU law (medical devices, machinery, toys): the AI inherits the product regime
• Annex III — a list of use cases: biometrics (ID, categorization), critical infrastructure management, education admissions and assessment, employment and worker management, access to essential services (credit scoring, insurance pricing), law enforcement, migration and border control, and administration of justice

The filter is use context, not model sophistication: a logistic regression screening loan applications is high-risk; a giant language model summarizing novels is not. Article 6 carves an escape — a system in an Annex III domain that doesn't materially influence the decision can argue out — but the burden is on the provider to document it.