The EU AI Act by Industry
High-risk classification covers AI in employment, credit, insurance, healthcare, and education. Here is what it means for your sector.
Insurance
High risk · Annex IIIAI used for risk assessment and pricing in life and health insurance is explicitly classified as high risk. Underwriting models, premium-setting algorithms, and eligibility scoring all fall in scope when they affect individuals.
Insurers acting as providers must run a full risk management system, document training data for bias, and complete a conformity assessment. As deployers, they must assign human oversight and, as private bodies providing essential services, conduct a Fundamental Rights Impact Assessment.
Claims automation and fraud detection are not automatically high risk, but many insurers apply the same controls to avoid fragmented governance.
Fundamental Rights Impact Assessment before deploying any life or health insurance pricing or risk model.
Healthcare
High risk · Annex I & IIIAI that qualifies as a medical device under the MDR or IVDR, diagnostic imaging, clinical decision support, triage tools, is high risk via Annex I, with compliance due by August 2, 2027. AI used to evaluate eligibility for public healthcare services or for emergency patient triage is high risk under Annex III from August 2026.
Requirements layer on top of existing medical device conformity processes: the notified body assessment will cover AI Act requirements alongside MDR obligations.
Hospitals deploying these systems must ensure clinicians can understand, override, and log AI-assisted decisions.
Integrate AI Act technical documentation into your existing MDR/IVDR conformity assessment file.
Financial Services
High risk · Annex IIICreditworthiness evaluation and credit scoring of natural persons are high risk. Banks, lenders, and fintechs using AI to approve loans, set credit limits, or score applicants are directly in scope. Fraud detection is expressly excluded.
Financial institutions can integrate certain AI Act obligations, quality management, logging, and monitoring, into their existing internal governance under EU financial services law, and market surveillance falls to financial supervisors.
Model risk management frameworks are a strong starting point, but must be extended to cover bias testing, human oversight, and explainability to affected individuals.
Extend model risk management to include data governance and bias examination for every credit-scoring model.
Employment and HR
High risk · Annex IIINearly every AI touchpoint in the employee lifecycle is high risk: job ad targeting, CV screening, candidate ranking, interview evaluation, promotion and termination decisions, task allocation, and performance monitoring.
Employers deploying these tools must inform workers' representatives and affected workers before use, keep logs for at least six months, and assign trained staff to oversee outputs. Emotion recognition in the workplace is banned outright.
Most organizations are deployers of vendor tools, but substantial modification or rebranding can turn a deployer into a provider.
Inform employees and their representatives before putting a high-risk HR system into service.
Education
High risk · Annex IIIAI systems that determine admission, assign students to institutions, evaluate learning outcomes, steer the learning process, assess the appropriate level of education, or monitor prohibited behavior during tests are high risk.
Universities, schools, and edtech providers must ensure these systems are accurate, non-discriminatory, and subject to meaningful human review. Emotion recognition in educational settings is prohibited.
Public institutions deploying high-risk AI must also register their use in the EU database.
Human review of any AI-driven admission, grading, or proctoring decision that affects a student's path.
Review the full list of high-risk domains on the risk tiers page and plan your timeline with key dates.
Track every regulatory milestone in one place with the EU AI Act Deadline Tracker.
Operating in a regulated industry? Start with a readiness check.
The governance assessment is built for insurance, healthcare, financial services, HR, and education teams, it maps your AI systems to Annex III and flags the gaps regulators will look for first.