Art.7
EU AI Act Guide › Chapter III — High-Risk AI Systems › Article 7

Article 7 — Amendments to Annex III

Governance SME Relevant ~2 min read · 361 words

Article 7 gives the European Commission the power to update the list of high-risk AI systems over time. It defines the criteria that must be met before a new AI use case can be added to Annex III — the list that determines whether your system triggers full high-risk compliance obligations.

✓ Low compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The mechanism for expanding the high-risk list

Article 7 establishes the mechanism by which the European Commission can expand the list of high-risk AI systems in Annex III. It is a future-proofing article — ensuring the regulation can evolve as AI technology develops without requiring a full legislative revision each time.

WHAT IT SAYS

Delegated acts and a structured assessment process

  • The Commission is empowered to add new AI system categories to Annex III through delegated acts — a faster legislative process that does not require full Parliamentary procedure
  • Before adding a new category, the Commission must assess whether the AI system poses a significant risk of harm to health, safety, or fundamental rights
  • The assessment must consider the severity of potential harm, the number of people affected, the reversibility of harm, and the extent to which people can opt out or challenge decisions
  • The Commission must also consider whether existing EU law already provides adequate protection before adding a new category
  • Categories can also be removed from Annex III if they no longer meet the risk criteria

WHO IS AFFECTED

Anyone operating outside the current high-risk list

  • Any business operating in AI sectors not currently listed in Annex III — your system could become high-risk in the future
  • Legal and compliance teams monitoring regulatory developments
  • Industry associations lobbying on behalf of specific sectors during the Commission’s consultation process

WHAT IT MEANS FOR SMES

Build flexible compliance — the list will grow

  • This article means the high-risk list is not fixed — a sector that is out of scope today could be in scope within a year or two
  • Monitor the Commission’s delegated act consultations if you operate in areas like marketing AI, financial advice tools, or automated HR systems — these are plausible candidates for future addition
  • Build your compliance processes with flexibility in mind rather than treating Annex III as permanent
  • The removal mechanism also works in your favour — if your sector is listed but risk is later deemed low, it can be removed

Related Articles

  • Article 6 — High-risk classification (the current two-route system)
  • Article 97 — Commission powers to update the regulation more broadly
  • Annex III — The current list of high-risk use cases
← Back to the Guide
← Previous Art. 6 — Classification of High-Risk AI Systems Next → Art. 8 — Compliance with Requirements