Article 7: Amendments to Annex III

Article 7 empowers the European Commission to amend the list of high-risk AI use cases in Annex III through delegated acts, by adding, modifying or removing use cases.

The Commission may only add new categories if the AI systems are intended for an area listed in Annex III and pose a risk equal to or greater than that of existing high-risk AI systems.

The Commission assesses the intended purpose, extent of use, nature of data processed, autonomy of the system, harm already caused, and the vulnerability of affected persons, among other factors.

Article 7 of the AI Act does not provide a general exemption for SMEs. However, the AI Act includes supportive measures and potentially lighter obligations for small and medium-sized enterprises, depending on their role in the AI value chain.

Article 7 of the AI Act complements the GDPR. While the GDPR protects personal data, the AI Act focuses on the safety and trustworthiness of AI systems. Organisations must comply with both regulations when their AI system processes personal data.

The AI Act follows a phased implementation. Prohibited AI practices apply from February 2025, obligations for high-risk AI systems from August 2026, and other provisions take effect gradually. The specific deadline for Article 7 depends on the category of the obligation.

Yes, Article 7 of the AI Act may also be relevant when you purchase AI systems. As a deployer, you have your own obligations under the AI Act, regardless of whether you developed the system yourself or purchased it from a provider.

Under Article 7 of the AI Act, the provider is the entity that develops or places the AI system on the market, while the deployer is the entity that uses the system under its own authority. Both roles carry different obligations.