Article 7: Amendments to Annex III

Article 7 is the Act’s dynamic list mechanism for Annex III high-risk use-cases:

- Paragraph 1: The Commission may adopt delegated acts (under Article 97) to amend Annex III by adding or modifying use-cases where both (a) the systems are intended for areas already covered by Annex III and (b) they pose risks to health, safety, or fundamental rights that are equivalent to or greater than risks from high-risk systems already listed in Annex III.

- Paragraph 2: When assessing (b), the Commission must apply a structured checklist of criteria (a)–(k) (intended purpose, scale of use, data processed including special categories, autonomy, documented harms, intensity and group impacts, dependency and power imbalances, reversibility, societal benefits, and the adequacy of existing Union redress)—the complete text is set out in the official wording section below.

- Paragraph 3: The Commission may remove Annex III entries only when both removal conditions in the authentic text are satisfied, including that deletion does not reduce overall Union protection.

Treat this article as the bridge between policy learning and your product classification work under Article 6.

• Article 6 — Classification depends on Annex III; Article 7 can change which purposes are high-risk.
• Annex III — Operational list Article 7 amends.
• Article 97 — Delegated acts procedure referenced in Article 7(1) and (3).
• Articles 8–15 — Once a new Annex III use-case captures your system, Chapter III requirements apply from the relevant Article 113 dates (subject to Article 111 transitional rules on EUR-Lex).
• Article 5 — Prohibited practices remain a separate gate; expanding Annex III does not relax Chapter II.
• Article 49 — Registration and database duties may interact when classification or exceptions shift.
• Article 113 — Application calendar for obligations tied to amended lists.

• Subscribe to OJ / EUR-Lex updates and map any Annex III delegated act to your product catalogue within a defined governance SLA.
• Re-run Article 6 classification when the intended purpose or Annex III text moves; archive the prior legal baseline with dates.
• For Article 7(2)-style evidence, keep incident logs, DPIAs, user research, and market surveillance references that explain risk evolution—they inform internal debate even when you are not the Commission.
• Align technical documentation (Article 11) and conformity artefacts to the Annex III wording in force on the date you place on the market or put into service.
• Pair Annex list changes with communication to enterprise customers and procurement counterparties.

The following reproduces Article 7 in full from the English consolidated text of Regulation (EU) 2024/1689.

1. The Commission is empowered to adopt delegated acts in accordance with Article 97 to amend Annex III by adding or modifying use-cases of high-risk AI systems where both of the following conditions are fulfilled:

(a) the AI systems are intended to be used in any of the areas listed in Annex III;

(b) the AI systems pose a risk of harm to health and safety, or an adverse impact on fundamental rights, and that risk is equivalent to, or greater than, the risk of harm or of adverse impact posed by the high-risk AI systems already referred to in Annex III.

2. When assessing the condition under paragraph 1, point (b), the Commission shall take into account the following criteria:\n\n(a) the intended purpose of the AI system;\n\n(b) the extent to which an AI system has been used or is likely to be used;\n\n(c) the nature and amount of the data processed and used by the AI system, in particular whether special categories of personal data are processed;\n\n(d) the extent to which the AI system acts autonomously and the possibility for a human to override a decision or recommendations that may lead to potential harm;\n\n(e) the extent to which the use of an AI system has already caused harm to health and safety, has had an adverse impact on fundamental rights or has given rise to significant concerns in relation to the likelihood of such harm or adverse impact, as demonstrated, for example, by reports or documented allegations submitted to national competent authorities or by other reports, as appropriate;\n\n(f) the potential extent of such harm or such adverse impact, in particular in terms of its intensity and its ability to affect multiple persons or to disproportionately affect a particular group of persons;\n\n(g) the extent to which persons who are potentially harmed or suffer an adverse impact are dependent on the outcome produced with an AI system, in particular because for practical or legal reasons it is not reasonably possible to opt-out from that outcome;\n\n(h) the extent to which there is an imbalance of power, or the persons who are potentially harmed or suffer an adverse impact are in a vulnerable position in relation to the deployer of an AI system, in particular due to status, authority, knowledge, economic or social circumstances, or age;\n\n(i) the extent to which the outcome produced involving an AI system is easily corrigible or reversible, taking into account the technical solutions available to correct or reverse it, whereby outcomes having an adverse impact on health, safety or fundamental rights, shall not be considered to be easily corrigible or reversible;\n\n(j) the magnitude and likelihood of benefit of the deployment of the AI system for individuals, groups, or society at large, including possible improvements in product safety;\n\n(k) the extent to which existing Union law provides for: (i) effective measures of redress in relation to the risks posed by an AI system, with the exclusion of claims for damages; (ii) effective measures to prevent or substantially minimise those risks.\n\n3. The Commission is empowered to adopt delegated acts in accordance with Article 97 to amend the list in Annex III by removing high-risk AI systems where both of the following conditions are fulfilled:\n\n(a) the high-risk AI system concerned no longer poses any significant risks to fundamental rights, health or safety, taking into account the criteria listed in paragraph 2;\n\n(b) the deletion does not decrease the overall level of protection of health, safety and fundamental rights under Union law.

The recitals in the same consolidated AI Act on EUR-Lex explain how risk, fundamental rights, and proportionality inform Annex III design and future adjustments. Use the official preamble on EUR-Lex—do not rely on unofficial recital lists without checking sequence and wording against the authentic text.