"Not high-risk" is a claim you have to prove, and profiling always counts

An AI tool that falls under an Annex III use case can escape the high-risk label. But you must prove it, and any tool that profiles people never escapes.

Article 6(3) sets out the exit. A tool is not high-risk if it does not pose a significant risk to people's health, safety, or fundamental rights. That usually means it does one of four things. It does a narrow procedural task. It improves the result of work a human already finished. It spots patterns or outliers for a human to review, without replacing the human's judgment. Or it does a preparatory step before a human assessment.

Here is a bank example. A tool that reads payslips and fills in the income field of a loan form may qualify as a narrow procedural task. A tool that turns that data into a score or a ranking of the applicant does not. That is profiling. Article 6(3) says an Annex III system that profiles people is always high-risk.

The exit also comes with paperwork. The provider must document its assessment before the tool goes on the market or into use (Art. 6(4)). Authorities can ask to see it. The provider must also register the tool in the EU database (Art. 49(2)). The Digital Omnibus (Regulation (EU) 2026/1744) kept this registration duty. It only cut a few of the required fields.

What to do now: list every AI tool that touches credit or insurance pricing. For each tool you call "not high-risk", write down which of the four conditions applies and why it does not profile anyone. If you build the tool in-house, you are its provider, so the documenting and registering fall on you. Do this before the Annex III rules apply on 2 December 2027.