Is our AI tool high-risk under the EU AI Act? An Annex III check for small businesses (2026)
Short answer: for most small businesses, no. Under the EU AI Act a tool is high-risk because of what you use it for, not because it is "AI". Writing emails, summarising documents, translating, bookkeeping help or a customer-service chatbot are not on the high-risk list. The list that matters for most firms is Annex III: eight areas such as hiring and staff management, credit scoring and insurance pricing for individuals, and education. If one of your tools is used in those areas, the high-risk rules reach you from 2 December 2027 (moved from 2 August 2026 by the Digital Omnibus on AI). Check each tool once, write down why, and you are done until its use changes.
The eight Annex III areas in plain words
| # | Area | Small-business examples that would be in scope | Usually not in scope |
|---|---|---|---|
| 1 | Biometrics | Remote biometric identification, sorting people by sensitive traits, emotion recognition | Fingerprint or face unlock that only confirms a person is who they claim to be |
| 2 | Critical infrastructure | AI as a safety component in running road traffic, water, gas, heating, electricity or critical digital infrastructure | Energy-use dashboards for your own office |
| 3 | Education and vocational training | Deciding admissions, grading or steering learning, assessing the level of education someone gets, proctoring exams | A tutor chatbot that gives practice questions without grading |
| 4 | Employment and workers | Targeted job ads, filtering CVs, ranking or evaluating candidates; deciding promotion, dismissal or task allocation; monitoring and rating staff performance | Drafting a job ad, scheduling interviews a person already chose |
| 5 | Essential private and public services | Creditworthiness or credit scores of individuals; risk and pricing for life or health insurance; eligibility for public benefits; triaging emergency calls | Fraud detection for financial fraud (expressly excluded from the credit item); invoice reminders |
| 6 | Law enforcement | Uses by or for police authorities | Not a normal SME use |
| 7 | Migration, asylum and border control | Uses by or for competent public authorities | Not a normal SME use |
| 8 | Justice and democratic processes | Helping a judicial authority research and apply the law to facts; influencing election or referendum outcomes or voting behaviour | Campaign admin tools that people are not directly exposed to |
This is a summary. Read the exact wording in Annex III of Regulation (EU) 2024/1689 before you decide a borderline case.
The 10-minute check, one tool at a time
- Write the real use in one sentence. Not "we use Copilot" but "HR uses Copilot to shortlist CVs for sales jobs". The same tool can be minimal-risk in one team and high-risk in another.
- Is that use in one of the eight areas above? If not, it is not high-risk under Annex III. Note "no Annex III use" with the date.
- Is it a safety component of a regulated product (medical devices, machinery, toys, lifts and the other Annex I laws)? That is the separate Article 6(1) route, with rules from 2 August 2028.
- If it is in an Annex III area, does Article 6(3) take it out? It can, if the system poses no significant risk of harm and only:
- performs a narrow procedural task (for example turning unstructured documents into structured data);
- improves the result of work a person already finished (for example polishing the wording of a letter already written);
- detects decision patterns or deviations from earlier decisions, without replacing or influencing the human assessment unless a person reviews it; or
- does a preparatory task for an assessment (for example indexing or translating files before a person decides).
- Profiling override. If the system profiles natural persons (automated evaluation of things like work performance, reliability or behaviour), it is always high-risk, whatever step 4 says.
- Write down the result and why. Date, person, outcome, and which step decided it. If you rely on step 4, keep the vendor's own assessment: a provider that decides its Annex III system is not high-risk has to document that assessment (Art. 6(4)).
Want a guided version? The free risk-tier checker asks the same questions.
Common small-business tools, checked
| Tool and use | Likely result | Why |
|---|---|---|
| ChatGPT or Copilot for emails, proposals and summaries | Not high-risk | No Annex III purpose; check Article 50 if you publish AI text on matters of public interest |
| Website chatbot answering customer questions | Not high-risk | Article 50 disclosure applies: people must know they are talking to AI |
| Applicant-tracking system that scores or ranks CVs | High-risk | Annex III point 4, and scoring candidates is profiling |
| Same system used only to parse CVs into fields, a person reads every CV | Possibly not high-risk | Narrow procedural task under Art. 6(3); keep the vendor's assessment and check it really does not rank |
| Staff productivity tool that rates employees | High-risk | Annex III point 4, monitoring and evaluating performance |
| Lender or broker tool that scores individual borrowers | High-risk | Annex III point 5(b); a fundamental rights impact assessment also applies (Art. 27) |
| Accounting software flagging unusual transactions for fraud | Not high-risk under point 5(b) | Financial-fraud detection is expressly excluded from the credit item |
If a tool is high-risk: what changes for you as the user
If you only use a high-risk tool (you are the deployer), most of the heavy work, such as technical documentation and conformity assessment, is the vendor's. From 2 December 2027 Article 26 asks you to use it as instructed, give trained people human oversight, check the input data you control, monitor it and report serious incidents, keep its automatic logs for at least six months, and inform workers' representatives and affected workers before using it at work. Details: record-keeping for SME deployers and 12 questions to ask your AI vendor.
If you built the tool, or sell it under your own name, you are the provider and the provider duties apply. Get specialist advice.
What applies today, whatever the result
- AI literacy measures for staff who use AI (Art. 4, since 2 February 2025): Article 4 for small business
- No banned practices (Art. 5, since 2 February 2025): the Article 5 list
- Transparency for chatbots and AI-generated content (Art. 50, since 2 August 2026): Article 50 checklist
This check is a starting point, not a legal opinion or proof of compliance. For hiring, credit, insurance, education, biometrics or staff monitoring, get specialist advice. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
The one client question worth asking this year is "do you use AI to choose, score or monitor people or to decide on credit?". Most clients will say no, and the answer goes in their file with a date. The 60-minute client AI inventory workshop shows how to run it alongside the year-end pack. Stay inside your professional rules and pass legal questions to a lawyer.
Partner programme opening soon
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Free start: add each AI tool with its one-sentence use and its Annex III result to the EURO AI Register free edition. Related: What applies now · SME AI inventory template · Staff AI use policy.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 3, 4, 5, 6, 26, 27, 50 and Annexes I and III
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): amended application dates
- European Commission: AI Act regulatory framework
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.