Annex III and Annex IV of the EU AI Act: which systems are high-risk, and what technical documentation they require

Annex III or Annex IV of the AI Act: which one applies to you? Both, if your AI system is high-risk. Annex III of Regulation (EU) 2024/1689, the EU AI Act, lists high-risk AI systems in eight areas. Annex IV sets the nine headings of the technical documentation their provider draws up before placing the system on the market. This page joins the two: for each Annex III area, what Annex IV asks you to prove.

These rules apply from 2 December 2027 for Annex III systems. For systems embedded in an Annex I product they apply from 2 August 2028 (Article 113, as amended by Regulation (EU) 2026/1744).

The text quoted is the consolidated text of the Regulation as of 27 July 2026 (CELEX 02024R1689-20260727). Words in quotation marks are the Regulation's own.

Annex III of the AI Act: the eight areas, one line each

Annex III opens with: "High-risk AI systems pursuant to Article 6(2) are the AI systems listed in any of the following areas". Here are the eight areas, with their points.

Three areas (1, 6 and 7) count only "in so far as their use is permitted under relevant Union or national law". Biometric verification whose sole purpose is to confirm an identity does not fall under point 1(a).

The detail of every point, with the borderline cases, is on our page Annex III (Annex 3): the 8 high-risk areas and in our Annex III classification guide.

Article 6: how a system enters Annex III, and how it leaves it

Article 6(2) sets the rule: "AI systems referred to in Annex III shall be considered to be high-risk".

Paragraph 3 opens an exit. An Annex III system is not high-risk "where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons". One of four conditions must be met:

• the system performs a narrow procedural task (point (a));
• "the AI system is intended to improve the result of a previously completed human activity" (point (b));
• "the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns", without replacing or influencing the human assessment "without proper human review" (point (c));
• "the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III" (point (d)).

One limit is not negotiable: an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons".

Paragraph 4 sets the proof. A provider who concludes that an Annex III system is not high-risk "shall document its assessment before that system is placed on the market or put into service". It registers in the EU database (Article 49(2)) and hands the assessment to the national competent authorities on request.

The guidelines required by paragraph 5: the European Commission published a draft on 19 May 2026. It gives examples of systems that are and are not high-risk. On 19 October 2026 the Commission's page still presented it as a draft.

Annex IV of the AI Act: the nine headings of the technical documentation

Article 11(1) requires the technical documentation "before that system is placed on the market or put into service" and wants it "kept up-to date". It "shall contain, at a minimum, the elements set out in Annex IV". Those elements are nine headings:

• a general description of the AI system: intended purpose, provider, versions, hardware, user interface, instructions for use for the deployer (point 1);
• a detailed description of the system and its development: methods, design choices, architecture, training data, human oversight, testing, cybersecurity (point 2);
• detailed information about the monitoring, functioning and control of the system: capabilities, limitations, accuracy for groups of persons, foreseeable risks (point 3);
• a description of the appropriateness of the performance metrics (point 4);
• a detailed description of the Article 9 risk management system (point 5);
• a description of the changes made to the system through its lifecycle (point 6);
• the list of harmonised standards applied, or a description of the solutions adopted instead (point 7);
• a copy of the Article 47 EU declaration of conformity (point 8);
• a detailed description of the system for evaluating performance in the post-market phase, including the Article 72(3) post-market monitoring plan (point 9).

Every heading is explained, with a filled example, on our Annex IV template page. The template is a free DOCX file, in the language of this page, with no sign-up.

Download the Annex IV template (DOCX)

From Annex III to Annex IV: what each area has to prove first

The Regulation does not assign headings to areas: the full documentation is due for every high-risk system. But the Annex III points say where the risk sits, and so which Annex IV headings an authority will read first. This table is our reading of the two annexes, not a rule of the text.

SMEs: the simplified form of Article 11

Regulation (EU) 2026/1744 added a sentence to Article 11(1): "SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner". The Commission is to establish a simplified form for that purpose. Until that form is published, the nine headings remain the reference: the technical documentation is still due, the form is lighter.

The dates: 2 December 2027, 2 August 2028, and what already applies

Article 113, point (c), sets two dates for Chapter III, Sections 1, 2 and 3, which include Article 11 and Annex IV. For AI systems classified as high-risk under Article 6(2) and Annex III: 2 December 2027. For systems under Article 6(1) and Annex I: 2 August 2028.

Already in application: the prohibited practices of Article 5, since 2 February 2025. Also in application: the transparency obligations of Article 50, since 2 August 2026, the Regulation's general date of application.

In France. On 9 September 2025 the DGE and the DGCCRF published a draft designation of the national authorities. The two directorates would coordinate the sectoral authorities, the DGCCRF for market surveillance. The release says this scheme must be submitted to Parliament through a bill. This page takes no designation for granted.

What to do now, in order

1. Inventory your AI systems and match each one against the Annex III points. Our free self-assessment takes five minutes.
2. For every Annex III system you judge outside high-risk, write the Article 6(3) assessment. Plan the Article 49(2) registration too.
3. For the others, open the Annex IV file with the template, heading by heading, starting with those in the table above.
4. Tie heading 9 to a real post-market monitoring plan (Article 72). Our page on continuous monitoring of AI systems explains who monitors what.

How LandingRed helps

In LandingRed, every AI system in your inventory is classified under Article 6 and Annex III. The paragraph 3 assessment stays recorded with its justification. The Annex IV technical documentation is generated from the system's record, heading by heading, in the full or the SME version, and stays editable. Free seven-day trial.

The EU AI Act page sums up the obligations. Our free self-assessment takes five minutes and estimates your exposure and your obligations.

Frequently asked questions on Annex III and Annex IV of the AI Act

Annex III or Annex 3 of the AI Act: are they the same thing?

Yes. The official text writes "Annex III", in Roman numerals. Many searches write "Annex 3". Same list, same eight areas. The same goes for Annex IV, often written "Annex 4".

What is the difference between Annex III and Annex IV?

Annex III says which stand-alone systems are high-risk (Article 6(2)). Annex IV says what their technical documentation must contain (Article 11(1)). The first classifies, the second documents.

Can an Annex III system not be high-risk?

Yes, if one of the four conditions of Article 6(3) is met and it does not perform profiling of natural persons. The provider documents that assessment before placing the system on the market and registers in the EU database (Article 49(2)).

Who writes the Annex IV documentation: the provider or the deployer?

The provider (Article 11(1)). The deployer receives the instructions for use and must, for its part, monitor the operation of the system and keep the logs (Article 26). A deployer that substantially modifies a high-risk system can become a provider (Article 25(1)).

From when is the Annex IV documentation mandatory?

For Annex III systems, from 2 December 2027. For systems embedded in an Annex I product, from 2 August 2028 (Article 113, as amended by Regulation (EU) 2026/1744). Nothing stops you starting the file today.

Related resources

• Annex III (Annex 3): the 8 high-risk areas
• Annex III risk classification explained
• Annex IV technical documentation template
• Continuous monitoring of AI systems: Article 72
• EU AI Act compliance: what LandingRed helps you document

This page gives information, not legal advice. The text quoted is Regulation (EU) 2024/1689 in its consolidated version of 27 July 2026 (CELEX 02024R1689-20260727). The information on France is current as of 19 October 2026.

Reviewed and published under the editorial responsibility of AB Corporate Advisory S.R.L.