Annex III point 2 - Point 2

Critical digital infrastructure

AI for management, monitoring, security or prioritisation within critical digital infrastructure.

Examples to assess

AI in network management, incident prioritisation or cloud/data-chain monitoring.

Detection of disruptions that can affect availability of critical services.

Classification path

First confirm whether the system is an AI system under Article 3(1).

Determine whether the intended purpose falls within Point 2.

Assess whether the Article 6(3) filter may apply and whether profiling blocks it.

Document provider/deployer roles, human oversight, data governance and evidence.

Read Article 6 for the legal filter Check Annex III in the legal text

What to assess

Which decision, assessment or access point the system supports.

Which data, scores or recommendations determine the output.

Who provides human oversight and which explanations are available.

Sources and status

This route is based on the Commission draft guidelines for high-risk classification, published on 19 May 2026. The examples are not exhaustive and may change when the guidance is finalised.

Always check Article 6 and Annex III of Regulation (EU) 2024/1689 as well. This page supports classification and evidence work, but it is not a supervisory decision.

Commission draft guidelines Official EU AI Act Article 6 on RAIP Annex III on RAIP 2026 guidance overview on RAIP

High-risk obligations

If an AI system is high-risk under Annex III, classification and evidence should be linked to the relevant obligations for providers and deployers.

Article 9: Risk management system Article 10: Data and data governance Article 11: Technical documentation Article 12: Logging Article 13: Transparency and instructions for use Article 14: Human oversight Article 15: Accuracy, robustness and cybersecurity Article 26: Deployer obligations Article 27: FRIA where Article 27 applies

Next step for this use case

Use the classifier for an initial route check or discuss the use case when the AI output may affect access, assessment, priority or rights.

Open classifier Start risk scan Schedule review

Frequently asked questions

Short answers for classification, evidence and next steps under Annex III.

When does Critical digital infrastructure fall under Point 2?

AI for management, monitoring, security or prioritisation within critical digital infrastructure. Assess whether the intended purpose falls within Point 2, then document whether Article 6(3), profiling and concrete rights impact change the classification.

Which practical examples should be assessed?

Examples to assess include: AI in network management, incident prioritisation or cloud/data-chain monitoring. and Detection of disruptions that can affect availability of critical services.. The decisive point is not the tool name, but the function, output and consequences for natural persons.

What is the next step for this use case?

Use the classifier for an initial route check or discuss the use case when the AI output may affect access, assessment, priority, safety or rights within Critical infrastructure.

Other use cases in this domain

Road traffic and traffic management Water, gas, heating and electricity