# The AI Act's High-Risk Classification: Is Your Recruitment or Credit-Scoring Agent an Annex III System?

> The AI Act's Annex III lists high-risk AI systems, including recruitment and credit-scoring agents. Here's how to check classification and duties in time.

- Published: 2026-09-18
- Author: Master Mind
- Canonical: https://aimaster.fi/en/artikkelit/ai-act-korkean-riskin-tekoalyjarjestelma-annex-iii

The AI Act's Annex III lists eight groups of use cases that automatically make an AI system high-risk. Two of the most common in a growth company's daily operations are recruitment and creditworthiness assessment. If your company uses AI to screen candidates or assess customers' ability to pay, check the classification now — not when a regulator asks first.

The AI Act (the EU's artificial intelligence regulation) is already partly in force: prohibitions took effect on 2 February 2025, and obligations for general-purpose AI models followed on 2 August 2025. High-risk system requirements, however, are not yet fully in force, and their timeline has shifted. Many growth-company leaders wrongly assume the whole regulation already applies in full — or, just as wrongly, that there's no urgency at all.

## What makes an AI system high-risk under the AI Act?

A system is high-risk if it's listed in the regulation's Annex III and doesn't meet an exemption. Annex III covers eight areas: biometrics, critical infrastructure, education, employment, access to essential public and private services, law enforcement, migration, and the administration of justice and democratic processes. If a system profiles people — processing personal data to assess things like work performance, financial situation, or behaviour — it's always high-risk, exemptions notwithstanding.

## When is a recruitment agent classified as high-risk?

AI systems related to recruitment and employment are named explicitly in Annex III: targeted job advertising, analysing and filtering applications, evaluating candidates, and systems affecting promotion or termination decisions are all on the list. The exemption applies only to narrow procedural tasks or systems that merely improve the outcome of an already-completed human assessment without replacing it. In practice, most CV-screening agents don't qualify for the exemption, because they filter candidates before a human ever reviews them.

## What about a credit-scoring agent or other affordability check?

AI used to assess creditworthiness is high-risk under Annex III, except when used solely to detect financial fraud. The same applies to risk assessment and pricing for life and health insurance, and to systems used to determine eligibility for public benefits. If your growth company offers consumer-facing financed services or automatically assesses customers' ability to pay, this classification likely applies to you.

## When do these obligations take effect?

The timeline has shifted following the EU's Digital Omnibus amendments. Obligations for Annex III high-risk systems (Article 6(2)) become applicable on 2 December 2027. Obligations for Annex I systems (e.g. products covered by machinery safety legislation) apply from 2 August 2028. Prohibitions have been in force since 2 February 2025, and the Article 50 transparency obligations (e.g. disclosing that a user is talking to a chatbot) apply to all AI systems from 2 August 2026, regardless of risk category. There's still time, but system design and procurement decisions should be finished before the deadline, not after it.

## What obligations fall on the provider of a high-risk system?

If your company builds its own recruitment or credit-scoring agent on top of a [Master Layer](https://aimaster.fi/tuotteet/master-layer)-type data foundation for internal use, you're likely a provider under the regulation, not just a deployer. Provider obligations span the system's full lifecycle: a risk management system, data governance (training and test data must be sufficiently representative), technical documentation, automatic logging, designing for human oversight, accuracy and cybersecurity requirements, a quality management system, and a conformity assessment with CE marking. The system must also be registered in the EU's high-risk database.

## What obligations arise when a growth company buys a ready-made high-risk system?

Most growth companies don't build recruitment or credit-scoring systems themselves — they buy them from a software vendor. In that case, your company is a deployer under the regulation, and deployers still carry clear obligations: use the system according to the provider's instructions, assign a sufficiently competent person for human oversight, monitor how the system operates, retain the logs it automatically generates, and inform a person when a decision affecting them involves a high-risk AI system. Public-sector deployers also carry a registration duty. These obligations don't disappear just because you didn't build the system.

| Obligation | Provider (developer) | Deployer |
| --- | --- | --- |
| Risk management system | Yes, across the full lifecycle | No direct duty, but must monitor use |
| Technical documentation and CE marking | Yes | No |
| Human oversight: design vs. execution | Designs the system to allow oversight | Assigns and trains the overseeing person |
| Log retention | Defines logging requirements | Retains logs under its own control |
| EU database registration | Yes, before market placement | Only public-sector deployers |
| Informing the affected person | No direct duty | Yes, if a decision affects them |

## How does a growth company prepare in practice?

The first step isn't hiring a lawyer — it's an inventory. Which AI systems in your company make or assist decisions in recruitment, creditworthiness, or other Annex III areas? [Master Plan](https://aimaster.fi/tuotteet/master-plan) is an AI strategy sprint that maps where AI creates the most value for your business — measured in euros. The same mapping exercise reveals which use cases fall under Annex III before they become a problem. Once classification is clear, the next step is making sure the data used to run or train the system is traceable and governed — covered in more detail in our article on [data lineage for tracing AI agent decisions](https://aimaster.fi/en/artikkelit/mista-tama-luku-tulee-nain-kasvuyritys-rakentaa-data-lineagen-ai-agentin-paatost).

A slide-deck consultant will sell you a 40-page AI Act compliance report and disappear. A working process is different: it produces a list of your systems, their classification, and a concrete task list before a regulator or a customer asks for it.

## Frequently asked questions

## Does the high-risk classification apply to purchased recruitment software, or only AI built in-house?

Yes. Classification depends on the use case, not who built the system. If you buy a third-party recruitment tool that screens applications, it can still be high-risk. Your company's role is then deployer, with its own obligations — including arranging human oversight and retaining logs.

## Is every AI system used in recruitment automatically high-risk?

No. The exemption covers narrow procedural tasks and systems that merely improve the outcome of an already-completed human assessment without replacing it. Automatically sorting applications into folders without evaluating them likely isn't high-risk. Scoring or filtering out candidates is. In borderline cases, the provider must document why a system isn't high-risk before it's put into use.

## When do the AI Act's high-risk requirements take effect?

Obligations for Annex III high-risk systems apply from 2 December 2027, and for Annex I systems from 2 August 2028, following the EU's Digital Omnibus amendments. Prohibition rules have applied since 2 February 2025, and Article 50 transparency obligations apply to all AI systems from 2 August 2026, regardless of risk category.

## What should a growth company do first?

Build an inventory of AI systems affecting recruitment, credit decisions, or other Annex III use cases. For each one, determine whether you're a provider or deployer, and document the basis for that classification. This work is best done as part of a broader AI strategy mapping, so classification and business value are handled in one process instead of separate exercises.

Book a [free Master Mind analysis](https://aimaster.fi/analyysi) to map which of your company's AI systems fall under the AI Act's Annex III, and what that means in practice for your timeline and procurement decisions.

## Frequently asked questions

### Does the high-risk classification apply to purchased recruitment software, or only AI built in-house?

Yes. Classification depends on the use case, not who built the system. If you buy a third-party recruitment tool that screens applications, it can still be high-risk. Your company's role is then deployer, with its own obligations — including arranging human oversight and retaining logs.

### Is every AI system used in recruitment automatically high-risk?

No. The exemption covers narrow procedural tasks and systems that merely improve the outcome of an already-completed human assessment without replacing it. Automatically sorting applications without evaluating them likely isn't high-risk. Scoring or filtering out candidates is. In borderline cases, the provider must document the assessment before use.

### When do the AI Act's high-risk requirements take effect?

Obligations for Annex III high-risk systems apply from 2 December 2027, and for Annex I systems from 2 August 2028, following the EU's Digital Omnibus amendments. Prohibitions have applied since 2 February 2025, and Article 50 transparency obligations apply to all systems from 2 August 2026, regardless of risk category.

### What should a growth company do first?

Build an inventory of AI systems affecting recruitment, credit decisions, or other Annex III use cases. For each one, determine whether you're a provider or deployer, and document the classification basis as part of a broader AI strategy mapping.

### What's the difference between provider and deployer obligations?

The provider (system developer) handles risk management, technical documentation, CE marking, and EU database registration. The deployer — the company buying the system — must follow the instructions for use, arrange human oversight, retain logs, and inform any person affected by a decision.