Annex III point 2 covers AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity. Annex III point 3 covers AI systems intended to be used to determine access or admission, or to assign natural persons to education and vocational training institutions, to evaluate learning outcomes, to assess the appropriate level of education, to monitor and detect prohibited behaviour during tests, and related education uses listed in the point. Both points are tested on intended purpose, and both are subject to the Article 6(3) filter where its conditions are met and profiling does not apply.
What is a safety component in critical infrastructure?
Point 2 uses the safety component concept: a component whose failure or malfunctioning endangers health and safety, or which fulfils a safety function. In critical infrastructure, the relevant systems are those used in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity. The point is not about every system used by an infrastructure operator. An administrative tool, a billing system, or a customer service assistant that does not perform a safety function in managing or operating the infrastructure follows a different analysis. The record should describe the infrastructure, the safety function, the failure effect, and the link between the AI system and the safe operation of the infrastructure.
Which infrastructure sectors are named, and which are not?
Point 2 names critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity. Other infrastructure sectors, such as health infrastructure or financial infrastructure, are addressed through other Annex III points or through Annex I product routes, not through point 2. A system used in a hospital's energy supply might engage point 2 through the electricity supply, while a clinical system in the same hospital would be assessed through the product route. The sector label of the operator is not decisive. What matters is the specific infrastructure function the system manages or operates, and whether the system is a safety component in that function. The point wording should be checked, because sector lists in summaries can overstate the coverage.
For the broader regulatory framework, see high-risk AI systems.
What education uses does point 3 list?
Point 3 lists AI systems intended to determine access or admission to education and vocational training institutions or to assign persons to those institutions, systems to evaluate learning outcomes and steer the learning process, systems to assess the appropriate level of education for an individual, and systems to monitor and detect prohibited behaviour of students during tests. The common thread is consequential influence on a person's education: access, placement, evaluation and examination integrity. A general learning resource, a timetable tool, or a content recommender that does not determine access, evaluate outcomes, assess level or monitor tests follows a different analysis, although data protection and other duties can still apply. The record should name the specific education decision the system influences.
How do safety and access decisions affect the analysis?
Safety component analysis asks what happens if the system fails. Access and evaluation analysis asks what happens to the person if the system decides. Both analyses require the intended purpose to be stated specifically, the affected people to be named, and the human review to be described. In critical infrastructure, the human review question is whether an operator can detect and respond to a failure in time. In education, the question is whether a learner can understand, challenge or correct an evaluation or assignment. A system that only prepares information for a human who makes the decision, without materially influencing the outcome, may engage the Article 6(3) filter, but that filter has its own conditions and profiling override, and must not be assumed.
What evidence should be kept for these points?
For point 2, the record should include the infrastructure function, the safety analysis, the failure modes, the testing of the AI component, and the operational safeguards. For point 3, the record should include the education decision, the criteria used, the data about learners, the validation of the evaluation method, and the appeals or review route available to the learner. Both records should include the Article 6(3) analysis where it is relied on, the Article 5 screen, and the Article 50 check. Where a system serves both an infrastructure and an education function, the two points should be assessed separately, because the evidence and the affected people differ.
Continue with Article 6 classification routes.
What is not concluded by this guide?
This guide explains points 2 and 3 in outline. It does not decide whether any particular infrastructure system is a safety component, whether any particular education system determines access or evaluates outcomes, or whether the Article 6(3) filter applies. Those questions need the function, the failure analysis, the decision affected, and the human review design, read against the consolidated Annex III wording. Infrastructure and education systems affect safety and life chances, so borderline cases should be confirmed with a competent authority or legal adviser before the system is placed on the market or put into service.
Frequently asked questions
Is every system used by a utility high-risk?
No. Point 2 covers AI systems intended to be used as safety components in the management and operation of the named infrastructure. Administrative, billing and customer service systems that are not safety components follow a different analysis.
Is an online learning platform high-risk?
Not necessarily. Point 3 covers systems that determine access or admission, assign learners, evaluate outcomes, assess level, or monitor tests. A platform that only delivers content, without those functions, is assessed differently, although other duties can apply.
Can the Article 6(3) filter apply to infrastructure and education systems?
It can be considered where its conditions are met, including no significant risk of harm and one of the four listed conditions, and where the system does not perform profiling. The filter must be documented and registered under Article 49(2), and it must not be assumed from a claim that the system is only assistive.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗