Point 6 of Annex III AI Act covers AI systems intended to be used by or on behalf of law enforcement authorities or by Union institutions, bodies, offices, or agencies in support of law enforcement authorities, in so far as such use is permitted under relevant Union or national law. The following use cases are classified as high-risk:
AI systems intended to be used to assess the risk of a natural person becoming the victim of criminal offences;
AI systems intended to be used as polygraphs and similar tools;
AI systems intended to be used to evaluate the reliability of evidence in the course of the investigation or prosecution of criminal offences;
AI systems intended to be used to assess the risk of a natural person offending or reoffending, not solely on the basis of the profiling of natural persons, or to assess personality traits and characteristics or past criminal behaviour of natural persons or groups;
AI systems intended to be used for the profiling of natural persons in the course of the detection, investigation or prosecution of criminal offences.
i. The concept of ‘law enforcement authority’
The term ‘law enforcement authority’ is decisive fordetermining whether an AI system falls within the scope of the high-risk use cases listed in point 6 of Annex III AI Act. The definition of ‘law enforcement authority’ in Article 3 (45), points (a) and (b), AI Act is identical to the definition of ‘competent authority’ in Article 3(7)of Directive (EU) 2016/680 ( Law Enforcement Directive, hereinafter ‘LED’). Pursuant to that definition, the concept of ‘law enforcement authority’ should be understood to comprise (a) any public authority competent for the pr evention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or(b) any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to pu blic security.
Given the diversity of legal systems across Member States, the concept of ‘law enforcement authorities’ in Article 3 (45) AI Act should be interpreted using a functional approach. This means that the classification of a body or entity as a law enforcement authority will depend not on the formal designation of the body or entity as such , but on whether the tasks it performs , as granted by law, are of a law enforcement nature, i.e. the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties, but not of an administrative nature.
Examples70 of law enforcement authorities within the meaning of the AI Act include the following bodies, where they carry out a law enforcement tasks (prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties71):
- the police,
- public prosecutors,
- probation and parole services,
- penitentiary (prison) services. For authorities with mixed competences, point 6 of Annex III should not apply merely because the authority has certain law-enforcement powers. It applies only where the AI system is intended to be used by or on behalf of that authority in the exercise of its law-enforcement functions, and where the intended use falls within one of the use cases listed in point 6 of Annex III. See further paragraph 348 below.
For the purposes of the AI Act, judicial authorities acting in criminal matters, or other authorities that exercise judicial functions or constitute part of the judicial system in criminal matters, should be considered as both ‘judicial authorities’ withinthe meaning of point 8 of Annex III , as well as ‘law enforcement authorities’ within the meaning of point 6 of that Annex. This interpretation of the concept of ‘law enforcement authorities’ as including ‘judicial authorities’ is specific to the AI Act, in particular regarding the scope of use cases in points 6 of Annex III . This is because the definition of ‘law enforcement authorities’ in Article 3 (45) AI Act is identical to the definition of ‘competent authorities’ used in Article 3(7) LEDand the concept should be interpreted in a consistent manne r. The scope of the notion ‘law enforcement authorities’ under the AI Actis without prejudice to the interpretation of the same or similar concepts in other Union acts.
Customs authorities in some of the Member States should be considered, in certain cases, as law enforcement authorities, particularly where they prevent, investigate, and detect customs-related crimes. In such instances, those authorities will operate within a law enforcement framework , so that an AI system that is intended to be used in those instances will be classified as high-risk if it falls within one of the use cases listed in point 6 of Annex III AI Act. In contrast, where customs authorities act in an administrative, rather than in a law enforcement, capacity, an AI system intended to be used by those authorities in that capacity will not be classified as high-risk because the use cases listed in point 6 of Annex III related only to law enforcement activities (see Section
iii. Exclusion of AI systems used in administrative proceedings below).
Law enforcement authorities should be distinguished from n ational intelligence authorities (sometimes called national intelligence units, security services, or secret services), although in some instances these authorities will exerciseoverlapping competences. In some Member States, national intelligence authorities may also provide support to law enforcement authorities in the exercise of their competences. Where a national intelligence authority performs law enforcement functions prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, an AI system intended to be used by such an authority in the exercise of those functions may be classified as high-risk pursuant to Article 6(2) AI Act if it falls with one of the use cases listed in point 6 of Annex III. Otherwise, Article 2(3) , second subparagraph, AI Act expressly excludes from its scope AI systems that are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities. Recital 24 AI Act clarifies how the notion ‘exclusively’used in that provision should be interpreted and in which instances an AI system used for such purposes may nevertheles s fall within the scope of the AI Act if it is used also for law enforcement purposes72.
Where a provider places on the market or puts into service an AI system that is intended to be used by both law enforcement authorities and national intelligence authorities, such system should be classified as high-risk AI system ( however, national intelligence authorities would not be subject to deployers obligations as they are excluded from the AI Act scope ) . The same applies if law enforcement authorities and national intelligence authorities jointly develop a project and create an AI system, in so far as the AI system is also intended to be used in the context of law enforcement. By contrast, if the system is intended to be used only by intelligence authorities acting exclusively outside law enforcement activities, it would not fall under the AI Act. ii. ‘Union institutions, bodies, offices or agencies in support of law enforcement authorities or on their behalf”
The use cases listed in p oint 6 of Annex III AI Act refer not only to law enforcement authorities and entities acting on behalf of law enforcement authorities, but also to Union institutions, bodies, offices or agencies in support of law enforcement authorities or on their behalf.
As a result, those use cases should be considered to cover, e.g. : Europol ( the European Union Agency for Law Enforcement Cooperation) , which supports law enforcement agencies across Member States in fighting serious crime affecting two or more Member States,terrorism and forms of crime which affect a common interest covered by a Union policy; Eurojust (the European Union Agency for Criminal Justice Cooperation) , which brings together prosecutors and judges from across the U nion and beyond in an effort to effectively tackle all forms of serious cross-border crime; and the EPPO (the European Public Prosecutors Office), which investigates, prosecutes, and brings to judgment crimes against the financial interests of the Union. The use cases listed in point 6 of Annex III AI Act may also apply to Frontex (the European Border and Coast Guard Agency) to the extent that its activities constitute law enforcement activities.
iii. Exclusion of AI systems used in administrative proceedings
The use cases listed in point 6 of Annex III AI Act refer only to AI systems intended to be used in relation to law enforcement activities. AI systems specifically intended to be used for administrative activities, for example, by tax and customs authorities (e.g., those related to customs duties, tariffs, or compliance checks that are not punitive in nature ) , as well as by financial intelligence units carrying out administrative tasks analysing information pursuant to Union anti-money laundering law, should not be classified as high-risk pursuant to that provision (Recital 59). The same logic applies by analogy to administrative entities at EU level working in these domains.
In the case of AI systems intended to be used by customs authorities, they should not be classified as high-risk pursuant to point 6 of Annex III AI Act, so long as their intended use is limited to such administrative proceedings, such as import and entry procedures, export and exit procedures, and transit procedures. However, as noted above, where an AI system is intended to be used for a purpose that falls within a high-risk use case, the system should be classified as a high-risk AI system. An example of such a use case is a customs risk management system which outputs are used by customs officers to assess the likelihood that goods crossing a border do not comply with applicable legal requirements. Such a system will not fall under one of the use cases listed in point 6 of Annex III. In general, such systems are not designed to prevent, investigate, detect or prosecute criminal offences, but to flag possible non-compliance with Union and national rules on agricultural and food safety, plant and animal health, intellectual pro perty rights, product safety, environmental, waste management rules, protection of cultural goods, etc. On the other hand, where AI systems are also used to detect instances that qualify as criminal offences, theyshould be classified as high-risk if they fall within one or more of the use cases in point 6.
As explained in paragraph 218 of the Guidelines on prohibited artificial intelligence practices, for offences that are not regulated by Union law, the national qualification of the offence is subject to scrutiny by the CJEU, since ‘criminal offence’ is an autonomous concept of Union law and should be interpreted consistently across Member States. The CJEU has concluded, in a different context, that the classification of offences by the Member States is not conclusive in that respect73. Relevant criteria used to assess the nature of an offence (criminal or not) may be found in the relevant case-law of the CJEU and of the European Court of Human Rights (‘ECtHR’)74. Administrative offences are excluded from the scope of point 6 of Annex III.
iv. The concepts of risk assessment and profiling of natural persons (points 6(a), 6(d), and 6(e))
Point 6 of Annex III AI Act lists three distinct use cases concerning AI systems intended to be used to assess the risk or profiling of natural persons by law enforcement authorities.
These three use cases serve three types of purposes. First, point 6(a) concerns potential victim risk assessment or profiling, specifically the use of AI systems intended tobe used to assess the risk that a natural person may become a victim of criminal offences, which entails a forward-looking, preventive and protective function. Second, point 6(d) concerns the risk assessment or profiling of a potential offender or group of potential offenders, specifically AI systems intended to be used to assess concrete person(s) to evaluate their (potential) criminal behaviour. Third, point 6(e) concerns more general profiling relevant in cases where profiling is applied in the context of the detection, investigation and prosecution of criminal offences, for instance to identify a list of potentialsuspects singling them out from the general population or from a specific group using certain criteria.
Article 6(3), last paragraph, AI Act provides that AI systems falling within one of the use cases listed in Annex III should always be considered high-risk where it performs profiling of natural persons. This means that, even if the AI system fulfils the conditions for the filter mechanism in Article 6(3) AI Act, it will nevertheless be classified as high-risk if it performs profiling of natural persons.
If an AI system analyses data at the group level rather than at the individual level, and thus no personal data is processed in that context , such use would not constitute profiling as defined in Article 3(4) LED (i.e. for profiling to exist, automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person is required)75. In contrast, applying the profile to individual persons would amount to profiling, since it would directly affect them and influence their personal situation.
It is important to note that the use cases listed in points 6(a), 6(d), and 6(e) of Annex III AI Act do not cover the analysis or mapping of locations or geographic areas. Consequently, an AI system designed to predict risk areas during mass events (e.g. sport events, concerts)would not be classified as high-risk if it does not profile individuals, but relies solely on geographical and non-personal data, or density of people in a certain area. However, if the AI system possesses emotion recognition capabilities to identify, e.g., anger and aggressiveness, the system would fall under the use case of point 1(c) of Annex III AI Act.
For example, a police authority deploys an AI system to assess the threat level for terrorism (e.g. ‘low,” ‘moderate,” ‘substantial”) in a district housing government building s based on threat indicators from intelligence reports, number of recent incidents, and political developments. In such a case, no profiling is performedon natural persons, sincethe assessment is not tied to evaluating the personal characteristics of any identified natural person, and the output of the system (i.e., the estimated threat level) applies collectively to all persons present in the district. Such a threat level assessment is also not applied to single out individuals considered as potential suspects or v ictims. The AI system would therefore not be classified as high-risk pursuant to point 6 of Annex III AI Act.
- The definition of a ‘law enforcement authority’ varies across EU Member States’ national laws, therefore, this list is for orientation purposes only.
- Further discussion as to the concept and the activities covered can be found in the Commission Guidelines on prohibited artificial intelligence practices, points 319-325.
- See furtherGuidelines on prohibited artificial intelligence practices, Section 2.1.5.
- See, for example, CJEU,judgment of 14 November 2013,Marián Baláž, Case C-60/12, EU:C:2013:733.
- According to the CJEU’s case law, it is for national courts to determine whether a non-criminal penalty may be regarded as ‘criminal’ in light of the so-called ‘Engel criteria’, See: ECtHR, judgment of 8 June 1976, Engel and Others v. the Netherlands, App lication nos. 5100/71, 5101/71, 5102/71, 5354/72 and 5370/72, CE:ECHR:1976:0608JUD000510071, paragraph 82. Originally developed by the European Court of Human Rights (ECtHR) and subsequently endorsed by the CJEU, these criteria are alternative and not cumulative. When examining whether a penalty has a criminal nature, the competent national court should assess: (1) the classification of the relevant provisions under domestic law; (2) the very nature of the offence; and (3) the severity of the penalty. In ev aluating the nature of the offence, aspects taken into account include inter alia whether the proceedings are instituted by a public body with statutory powers of enforcement; whether the legal rule has a punitive or deterrent purpose; whether the legal ru le seeks to protect the general interests of society usually protected by criminal law; whether the imposition of any penalty is dependent upon a finding of guilt. Regarding the severity of the penalty, relevant reference is the maximum potential penalty p rovided in the national law. These criteria are alternative and not necessarily cumulative. See European Court of Human Rights, Guide on Article 6 of the European Convention on Human Rights, Right to a fair trial (criminal limb), updated 29 February 2024. See also CJEU, judgment of 5 June 2012, Bonda, Case C-489/10, EU:C:2012:319, paragraphs 37ff.; CJEU, judgment of 26 February 2013, Åkerberg Fransson, Case C‑617/10, EU:C:2013:105, paragraph35.
- See more detailson profilingin Section 2.7.2.