Route 2: the eight Annex III areas

1 — Biometrics

Three sub-points, all ‘in so far as permitted under Union or national law’: (a) remote biometric identification (the post/retrospective kind — real-time law-enforcement RBI in public spaces is handled by Art 5); (b) biometric categorisation according to sensitive or protected attributes; (c) emotion recognition (where not already prohibited in workplaces and schools by Art 5(1)(f)).

Carve-out: biometric verification whose sole purpose is confirming that a person is who they claim to be — your phone’s face unlock, 1:1 airport gate matching — is excluded. Identification (1:many search) is in; verification (1:1 match) is out.

Special status: point 1 is the only Annex III entry where conformity assessment may require a notified body (Art 43(1)) — every other area self-assesses under internal control.

2 — Critical infrastructure

AI used as a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating and electricity.

Note the echo of Route 1: the safety-component concept returns, but here no Annex I product law is needed — a grid-balancing AI enters directly through Annex III. An AI that merely optimises energy billing does not: it manages money, not the safe operation of supply.

3 — Education and vocational training

Four sub-points: (a) determining access or admission or assigning persons to institutions; (b) evaluating learning outcomes, including when that evaluation steers the student’s learning path; (c) assessing the appropriate level of education a person will receive or access; (d) monitoring and detecting prohibited behaviour during tests — the exam-proctoring AI that flags your eye movements.

The through-line: systems that shape educational trajectories or discipline. A vocabulary-drill app recommending the next flashcard is not steering anyone’s life chances; the admissions-scoring model is.

4 — Employment and workers’ management

The area every HR department must memorise: (a) recruitment and selection — including placing targeted job advertisements, analysing and filtering applications, and evaluating candidates; (b) decisions affecting terms of work-related relationships, promotion and termination, task allocation based on individual behaviour or personal traits, and monitoring and evaluating performance and behaviour.

Notice how early the net closes: not just the hiring decision but the ad targeting that determines who ever sees the vacancy, and the CV filter that runs before any human reads a name. Access to self-employment — gig-platform work allocation — is expressly included.

5 — Essential private and public services

Four sub-points: (a) evaluating eligibility for essential public assistance benefits and services — including healthcare — and granting, reducing, revoking or reclaiming them (the toeslagenaffaire scenario, now squarely high-risk); (b) evaluating creditworthiness or establishing a credit score — carve-out: systems used for detecting financial fraud; (c) risk assessment and pricing for natural persons in life and health insurance; (d) classifying emergency calls and dispatching or prioritising emergency first response, including emergency healthcare patient triage.

The credit carve-out is a favourite exam trap: the same bank model is high-risk when it scores your loan application and outside Annex III when it hunts transaction fraud.

6 — Law enforcement

Five sub-points, all ‘in so far as permitted under law’: (a) assessing a person’s risk of becoming a victim of crime; (b) polygraphs and similar tools; (c) evaluating the reliability of evidence in investigations or prosecutions; (d) assessing the risk of offending or re-offending — not solely on profiling — or assessing personality traits or past criminal behaviour; (e) profiling of natural persons in the course of detection, investigation or prosecution of crime.

Keep the boundary with Art 5 sharp: predictive policing based solely on profiling or personality traits is prohibited (Art 5(1)(d)); risk assessment that supports a human judgment grounded in objective, verifiable facts linked to criminal activity is high-risk. One word — solely — separates a ban from a rulebook.

7 — Migration, asylum and border control

Four sub-points: (a) polygraphs and similar tools; (b) risk assessments — security risk, irregular-migration risk, health risk — of persons entering or having entered; (c) assisting the examination of applications for asylum, visas and residence permits, and associated complaints, including assessing the reliability of evidence; (d) detecting, recognising or identifying natural persons in the migration context.

Carve-out: verification of the authenticity of travel documents is excluded from (d). The passport scanner checking for forgery is out; the face-search system matching arrivals against a watchlist is in.

8 — Administration of justice and democratic processes

Two sub-points: (a) assisting a judicial authority in researching and interpreting facts and law and applying the law to facts — or the same use in alternative dispute resolution where its outcomes produce legal effects; (b) influencing the outcome of an election or referendum, or the voting behaviour of natural persons.

Carve-out for (b): tools whose output people are not directly exposed to — the systems that organise, optimise and structure campaign logistics from an administrative angle. The mailing-route optimiser is out; the micro-targeted persuasion engine is in.

Note what (a) does not cover: legal research databases and anonymisation tools used by court staff. The trigger is assisting the judicial decision, not digitising the registry.