Responsible AI Platform
Annex III point 2High-risk domain

AI in critical infrastructure

For operators, vendors and public or private infrastructure managers using AI where failures can affect safety and access to essential services.

Annex III point 2 focuses on AI systems intended for safety components or management of specific critical infrastructure. The draft guidelines cover critical digital infrastructure, road traffic, water, gas, heating and electricity.

Scope according to the guidelines

The Commission splits this area into critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity.

Classification question

Is the AI intended to manage, prioritise or secure infrastructure in a way that can affect safety or availability?

What to document

Intended purpose and context of use.
Why Article 6(2) and Annex III do or do not apply.
Whether the Article 6(3) filter may apply, and whether profiling blocks it.
Which provider and deployer obligations are triggered.

Infrastructure AI Act quick scan

Map the infrastructure function, AI output and impact on safety or availability.

Frequently asked questions

Short answers for classification, evidence and next steps under Annex III.

When should infrastructure be assessed under Annex III?

The Commission splits this area into critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity. The practical starting question is: Is the AI intended to manage, prioritise or secure infrastructure in a way that can affect safety or availability?

Which use cases are included in Critical infrastructure?

This domain page expands the main routes: Critical digital infrastructure, Road traffic and traffic management and Water, gas, heating and electricity. For each system, check the intended purpose, the output and the impact on access, rights or safety.

What should be documented before obligations are determined?

Document the intended purpose, use context, relevant Annex III route, Article 6(3) assessment, any profiling, provider/deployer roles and the required safeguards.