High-risk § 3.7.1

Point 7 of Annex III lists four high-risk AI systems intended to be used by or on behalf of competent public authorities , or Union institutions, bodies, offices or agencies , in the field of migration, asylum, and border-control management, in so far as such use is permitted under relevant Union or national law. In particular, that provision classifies the following use cases as high-risk:

The AI system use cases listed in point 7 of Annex III concern those systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies in the migration , asylum and border-management fields. This covers the national authorities designated pursuant to the EU or national law governing the field, as well as Union institutions, bodies, offices or agencies acting within their mandates under that law.

Without prejudice to the assessment on the compatibility of the use ofan AI system with the Charter and EU secondary law in this context, these authorities may potentially include the following non-exhaustive examples:

• Border-control authorities under Regulation (EU) 2016/399(‘the Schengen Borders Code’)⁷⁹ and Regulation (EU) 2019/1896 (‘the European Border and Coast Guard framework’)⁸⁰. These authorities perform checks at external borders and related tasks. The ‘European Border and Coast Guard” is composed of the national authorities responsible for border management and Frontex;
• Consular authorities and central visa authorities responsible for examining visa applications and taking visa decisions under Regulation (EC) No 810/2009⁸¹ (‘the Visa Code ’) and Regulation (EU) 2021/1134⁸²(‘the VIS framework’);
• Asylum authorities competent under Directive 2013/32/EU⁸³, and, as of 12 June 2026, Regulation (EU) 2024/1348 (‘the Asylum Procedures Regulation’)which will replace the ⁸⁴ Directive; in particular ‘determining authorities” responsible for first-instance examination of applications for international protection;
• Immigration/return/detention authorities acting under the Return Directive 2008/115/EC⁸⁵ including authorities issuing and enforcing return decisions and operating return/detention procedures;
• Competent authorities and other appeal or review bodies (including administrative appeal bodies and judicial authorities), where they examine appeals or associated complaints relating to asylum, visa or residence decisions under the applicable Union and national legal framework;
• Union bodies, offices and agencies acting within their mandate in the aforementioned fields, notably Frontex when acting under Regulation (EU) 2019/1896 (‘the EBCG Regulation’), ⁸⁶ the European Agency for Asylum when acting under Regulation (EU) 2021/2303⁸⁷ , and eu-LISA set up under Regulation (EU) 2018/1726 for the management/operation of large-scale IT systems (VIS, SIS, Eurodac) established under Regulation (EU) No 603/2013⁸⁸, as a Union system supporting asylum and migration management through biometric data processing, and as of 12 June 2026 under Regulation (EU) 2024/1358⁸⁹, which will replace Regulation (EU) No 603/2013.

Depending on the field, the following instruments may be relevant to determine the competent authority, including the competent EU institution, body or agency: Regulation 2024/1356⁹⁰ (‘the Screening Regulation’) as regards preentry screening and referral; the Asylum Procedures-Regulation⁹¹ as regards asylum procedures; Regulation 2024/1349⁹² (‘the Return Border Procedure’) as regards return border procedures ; and Regulation 2024/1351⁹³ (‘the Asylum and Migration Management Regulation’).

The high-risk rules of the AI Act apply to AI systems classified as high-risk pursuant to point 7 of Annex III in addition to the rules on EU asylum, visa and border-management procedures. The intended use of an AI system must comply with those rules, and must therefore respect the applicable guarantees, including the principle of non-refoulement and effective access to the asylum procedure, as well as the Member States’ obligations under the 1951 Refugee Convention and its 1967 Protocol Where an AI system , if deployed as a component and authorised within the infrastructure of systems such as the Visa Information System (VIS), the Schengen Information System (SIS), the European Dactyloscopy database (Eurodac), the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS), the European Criminal Records Information System – Third Country Nationals (ECRIS-TCN), the Central Repository for Reporting and Statistics (CRRS) or EU Interoperability components , is designed to use data from those systems it must respect those instruments’ purpose limits, access conditions and fundamental rights’ safeguards.

Where the functionality of an AI system falling within one of the use cases listed in point 7 of Annex III involves the processing of biometric data or techniques (e.g. face, fingerprints, gait), the system will also be classified as high-risk pursuant to point 1 of Annex III (Biometrics), if it falls in one of the use cases listed in point 1 (a),(b) or (c) and the considerations set out in section 2.3.1 apply. As a consequence, the system will be subject to a third-party conformity assessment, since it is classified as high-risk pursuant to point 1 of Annex III.

AI systems intended to be used to verify travel or identity documents, including checking for morphing, unusual inks, copied signatures, or chip or Public Key Infrastructure (PKI) validity, fall outside the scope of the use case listed inpoint 7(d) of Annex III. By contrast, AI systems intended to be used to perform presentation-attack checks, including on-person liveness checks, used within person detection and recognition flows are not document-verification features and will generally be classified as high-risk under the use case listed in point 7(d) of Annex III, unless the system is used for RBI, in which case it will be classified as high-risk pursuant to point 1(a) of Annex III. In seamless border procedures , where travellers actively present themselves for one-to-one verification a gainst their travel document, presentation-attack detection used solely as an anti-spoofing safeguard remains part of that verification function and does not, on its own, classify the system as high-risk pursuant topoint 7 of Annex III.Where the same functionality is used to support operational person detection, tracking or identification beyond verification, the system will be classified as high-risk pursuant to point 7 of Annex III, unless the conditions for classification pursuant to point 1 of Annex III are met, in which case that classification will apply.

Classification as high-risk follows the intended use of the systems. AI systems intended to be used exclusively for search-and-rescue (lifesaving) do not fall within the border control use case and therefore will not be classified as high-risk pursuant to point 7 of Annex III . The same system intended to be used for migration or border control may be classified as high-risk pursuant to point 7 of Annex III, provided the system meets the other conditions of that point. Many AI systems can be used for both border control and search-and-rescue or navigation safety. Where a system’s intended use includes both, the system will fall within the scope of the use cases listed in point 7 of Annex III because of its intended border-control use.

Where an AI system used by or on behalf of competent public authorities in the field of migration, asylum, and border-control management falls under one of the practices listed in Article 5 AI Act, its use should be prohibited. Where not all of the conditions of that provisions are met for a prohibition to apply, the system should be classified as high-risk, provided it falls within one of the use cases listed in point 1 or point 7 of Annex III AI Act.

Article 5(1)(b) AI Act prohibits AI systems that exploit a natural person’s vulnerabilities (age, disability, specific social or economic situation) with the objective or effect of materially distorting that person’s behaviour in a manner likely to cause significant harm. Behaviour-analysis tools (e.g., those assessing voice-stress, micro-expressions, or gaze patterns) are not, in themselves, prohibited merely because they misinterpret stress or cultural expressions. Such misinterpretations may affect the assessment of evidence, but do not necessarily have the object or effect of distorting a natural person’s behaviour.

AI systems that, over a period of time, evaluate or rank migrants based on physiological reactions, behaviour (including online activity), or other personal data to derive a generalised trustworthiness or risk score, especially where used across contexts or to produce detrimental treatment, may amount to social scoring prohibited by Article 5(1)(c) AI Act.. Providers and deployers must also ensure that the use does not amount to prohibited social-scoring practice under Article 5(1)(c) AI Act.

Tools that predict future criminal behaviour of persons at borders (e.g., ‘criminal intent” from gaze/speech patterns) may fall within the prohibition listed in Article 5(1)( d ) AI Act . Where the conditions of that provision are met, the prohibition applies. Where not all conditions of Article 5(1)(d) AI Act are met, the same tool may be classified as high-risk under point 7(b) of Annex III where its intended purpose is the assessment of a migration risk. Providers and deployers must ensure that the use does not amount to prohibited individualised crime risk assessments under Article 5(1)(d) AI Act.

Deception or credibility analysis AI tools (e.g. micro-expression/voice-stress) used at borders are not considered RBI systems covered by the prohibition in Article 5(1)(h) AI Act, because they do not establish the identity of natural persons via a database comparison. Such AI tools will generally be classified as high-risk pursuant to point 7 of Annex III.

The deployment of an AI system for real-time RBI for law enforcement purposes in the vicinity of a border is only permitted if strictly necessary for the objectives listed in Article 5(1)(h)(i)-(iii) AI Act and if all the requirements of Article 5(2)-(5) AI Act are fulfilled. However, as explained in the Commission Guidelines on prohibited artificial intelligence practices, a border crossing point is not considered a publicly accessible space, so that the prohibition does not apply in that context, whereas the street leading to a border crossing point or a forest in the vicinity normally is such a space. Some spaces may have a dual function. For example, an airport is generally considered a publicly accessible space as regards its common areas, but the area dedicated to border control (where the customs officials stand, and passports or ID checks are carried out) is not and therefore the deployment of real-time RBI systems in such areas is excluded from the scope of the prohibition, but likely to be classified as high-risk pursuant to either point 1 or point 7 of Annex III AI Act.