The EU AI Act in Practice: Classifying High-Risk Deployments Under Annex III
A Step-by-Step Methodology for Corporate Counsel & Compliance Directors in Germany, Ireland & Netherlands
Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act) represents the world's first comprehensive statutory framework for algorithmic governance. Corporate counsel must evaluate enterprise machine learning systems against the strict risk tiers and conformity assessment requirements of Annex III.
1. The Four Risk Tiers of the EU AI Act
The EU AI Act establishes a graduated risk architecture: (1) Prohibited Practices (Article 5: cognitive manipulation, social scoring, untargeted biometric facial scraping); (2) High-Risk AI Systems (Articles 6–51 and Annex III: critical infrastructure, education, employment, essential private services, law enforcement, migration, justice); (3) General Purpose AI (GPAI) Models (Articles 51–56: systemic risk thresholds at 10^25 FLOPs); and (4) Minimal / Low-Risk AI (transparency obligations for synthetic content under Article 50).
2. Annex III High-Risk Classification Analysis
Systems are classified as High-Risk if they are intended to be used in critical domains, particularly employment (recruitment, screening, performance evaluation, automated dismissal) and creditworthiness evaluation. Under Article 6(3), a system will not be classified as high-risk if it does not pose a significant risk of harm to health, safety, or fundamental rights—specifically if it performs a narrow procedural task, improves the result of a previously completed human activity, or detects decision-making patterns without replacing human review.
3. Mandatory Compliance Obligations for High-Risk Deployers
High-risk deployers must satisfy stringent operational mandates prior to market placement: (a) Article 9 Risk Management System; (b) Article 10 Data Governance and Training Dataset Audits; (c) Article 11 Technical Documentation; (d) Article 12 Automatic Logging and Record-Keeping; (e) Article 13 Transparency and Instructions for Use; (f) Article 14 Human Oversight (Human-in-the-Loop); and (g) Article 15 Accuracy, Robustness, and Cybersecurity.
4. National Enforcement: BaFin, DPC Ireland & Autoriteit Persoonsgegevens
While the EU AI Office oversees GPAI models, national market surveillance authorities enforce deployer obligations: in Germany, the Federal Network Agency (BNetzA) and BfDI; in Ireland, the Data Protection Commission (DPC); and in the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and National Supervisory Authority for AI. Penalties under Article 99 reach up to €35 million or 7% of total worldwide annual turnover.