Annex III point 6 lists law enforcement uses, including individual risk assessment of offending or reoffending, polygraphs and similar tools, evaluation of the reliability of evidence, and crime analytics for patterns. Point 7 lists migration, asylum and border control uses, including risk assessment of persons entering or applying for protection, examination of applications, and identification and border management. Point 8 lists administration of justice and democratic processes, including systems assisting judicial authorities in researching and interpreting facts and law and applying law to facts, alternative dispute resolution, and systems influencing the outcome of elections or referendums or voting behaviour. Each point is tested on intended purpose, and the Article 5 screen must come first.
What law enforcement uses does point 6 list?
Point 6 lists AI systems intended to be used by or on behalf of law enforcement authorities, or by Union institutions, bodies, offices or agencies in support of law enforcement, for individual risk assessments of natural persons to assess the risk of offending or reoffending or the risk for potential victims, for polygraphs and similar tools, for evaluating the reliability of evidence in criminal proceedings, and for predicting the occurrence or reoccurrence of an actual or potential criminal offence based on profiling or assessing personality traits, or for crime analytics regarding natural persons to discover patterns or to assess past criminal behaviour. The list is detailed because law enforcement uses affect liberty and fair trial rights. A general administrative tool used by a police force, without those functions, follows a different analysis, but the function, not the customer, decides.
What migration and border uses does point 7 list?
Point 7 lists AI systems intended to be used by or on behalf of competent public authorities, or by Union institutions and bodies, as polygraphs and similar tools, to assess a risk posed by a natural person who intends to enter or has entered the territory of a Member State, to assist in examining applications for asylum, visa and residence permits and associated complaints, including eligibility assessment, and to detect, recognise and identify natural persons in the context of migration, asylum and border control, with the exception of verification of travel documents. The point covers both risk assessment and identification in a migration context. A system that only translates documents, without assessing risk, examining an application, or identifying a person, follows a different analysis, but the record should show the function clearly.
For the broader regulatory framework, see high-risk AI systems.
What justice and democracy uses does point 8 list?
Point 8 lists AI systems intended to be used by or on behalf of a judicial authority, or bodies or persons acting on their behalf, to assist in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution. It also lists systems intended to be used to influence the outcome of an election or referendum or the voting behaviour of natural persons in the exercise of their vote in elections or referendums, excluding systems whose output is not directly exposed to natural persons, such as tools used to organise, optimise and structure political campaigns from an administrative and logistical point of view. The distinction between assisting a judicial decision and influencing a vote is central, and the record should state which function is performed and who is affected.
How does Article 5 interact with points 6 to 8?
Article 5 must be screened before Annex III points 6 to 8. Predictive policing based solely on profiling is prohibited under Article 5(1)(d), real-time remote biometric identification in public spaces for law enforcement is prohibited under Article 5(1)(h) outside narrow exceptions, and biometric categorisation and emotion inference prohibitions can also be engaged. A system that survives the Article 5 screen can still be high-risk under points 6 to 8. A system that fails the Article 5 screen is prohibited and should not be treated as high-risk. The screening record should therefore show the Article 5 conclusion for each relevant point, with the facts tested, before the Annex III conclusion is stated.
What safeguards and oversight do these areas require?
Systems in points 6 to 8 commonly require fundamental rights impact assessment under Article 27 where the deployer is a public authority or a private entity providing public services, or where the use is in the listed law enforcement, migration or justice contexts the article specifies. Human oversight, logging, and the right of affected persons to an explanation under Article 86 can also be relevant. The oversight design must reflect the stakes: a judicial research tool that a judge can verify against the primary sources is different from a risk score that a decision-maker cannot interrogate. The record should describe the oversight, the information available to the human, the ability to depart from the output, and the review route for the affected person.
Continue with Article 6 classification routes.
What is left for the competent authority to decide?
This guide explains points 6, 7 and 8 in outline. It does not decide whether any particular law enforcement, migration or justice system is high-risk, whether an Article 5 prohibition applies, or whether a fundamental rights impact assessment is required. Those questions need the function, the authority using the system, the persons affected, and the oversight design, read against the consolidated text and the applicable law enforcement, migration and justice law. Systems in these areas affect liberty, protection and democratic participation, so borderline cases should be confirmed with a competent authority or legal adviser, and with the fundamental rights body where the Act requires it, before deployment.
Frequently asked questions
Is a legal research tool for a judge high-risk?
It can be, where it is intended to assist a judicial authority in researching and interpreting facts and the law and applying the law to a concrete set of facts. A general legal information tool used by a private firm for background research follows a different analysis, which must be evidenced from the intended purpose and user.
Does point 7 cover all border technology?
No. Point 7 covers the listed migration, asylum and border functions, including risk assessment, application examination, and identification, with an exception for travel document verification. Other border functions must be matched to the point wording.
Is campaign organisation software high-risk under point 8?
Point 8 excludes systems whose output is not directly exposed to natural persons, such as tools to organise, optimise and structure political campaigns from an administrative and logistical point of view. A system intended to influence voting behaviour is treated differently and must be assessed on that function.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗