Point 7(b) of Annex III classifie s as high-risk AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies to assess a risk, including a security risk, a risk of irregular migration, or a health risk, posed by a natu ral person who intends to enter or who has entered into the territory of a Member State.
The most important element in determining whether an AI system should be classified as high-risk pursuant to point 7(b) of Annex III is the intended purpose of the system to produce an individual risk score, category or flag that can influence decisions on entry, stay, detention, return or related measures. By contrast, AI systems that combine data streams into a higher-level summary (for example, by summing, averaging, or grouping data) to produce aggregate flow or staffing analytics, where outputs are not linked to identified individuals, should not be classified as high-risk pursuant to point 7(b) of Annex III.
AI systems that fall within the scope of the use case listed in point 7(b) of Annex III often amount to profiling because they assess a risk posed by a natural person. What matters is whether the system processes personal data in that context. In such a case, the system cannot benefit from the filtering mechanism in Article 6(3) AI Act. For example, AI systems that output a per-person risk flag or risk score, by using or inferring information about that person, conduct automated processing of personal data to evaluate or predict that person’s behaviour or movements and thus perform profiling. In contrast, if anonymised data are processed by the system so that no individual is identified or identifiable, the system should not be considered to perform profiling. Low-level aggregation or linkability with other datasets can still makeaggregated data (i.e. combined statistics on means, counts, rates) fall under the definition of personal data. AI systems that produce aggregate-only outputs that are never applied to identified or identifiable persons should be considered to fall outside the use case listed in point 7(b) of Annex III . However, if the system applies an aggregate indicator to a named or identifiable traveller to generate a risk flag or triage, its use involves personal data and constitutes profiling and therefore should be classified as high-risk pursuant to that provision.
An AI system falling with the use case listed in point 7(b) of Annex III may only benefit from the filter mechanism in Article 6(3) AI Act where it performs a narrow procedural or purely preparatory function that does not itself amount to profiling and does not materially influence the substance or outcome of an individual risk assessment. However, combined configurations are assessed as a whole, not individually (see Section 2.3. above).
a) Practical examples of AI systems falling within the use case of point 7(b)of Annex III
Person-level migration or security risk scoring
- Risk scoring for entry checks: An AI system intended to analyse a traveller’s personal history, travel patterns and watch-list matches to produce a ‘risk score” used by border guards to decide whether to refer the person to second line checks.
- Automated security risk flagging: An AI system intended to compute per-person risk flags (security, irregular-migration, or health) during travel authorisation or visa processing, using indicators based on certain trends and screening rules, and to refer named travellers for further checks.
- Visa risk scoring (case pattern):An AI system intended to rank visa applicants by predicted overstay risk using nationality and similar proxies, leading to intensive tracks for specific groups. Such an AI system may fall under the prohibition listed in Article 5(1)(c) AI Act only if it a mounts to generalised social behaviour scoring over time across contexts treating the person detrimentally.
- Online search-based migration intent flagging : An AI system intended to infer a named traveller’s likelihood of irregular migration from their recent online search behaviour and to generate a risk flag for individual persons used at entry control. Such an AI system is not prohibited under the AI Act unless (i) it performs social scoring within the meaning of Article 5(1)(c) AI Act, by, for example, generating generalised trustworthiness ranking over time and across contexts treating the person detrimentally or (ii) it predicts criminal behaviour in a prohibited way within the meaning of Article 5(1)(d) AI Act. These systems are intended to produce an evaluative output about an identified or identifiable person (for example, a score, a flag, or a rank) that is used to triage or channel that person for further checks or stricter treatment related to entry or stay in the Member State. Such outputs materially influence the substance of the assessment and are not tasks that qualify for the filter mechanism in Article 6(3) AI Act. Such tools may also be used to infer the risk to security that the individual intending t o enter or who has entered the territory of a Member State may constitute. Person-level health-risk flagging
- An AI system intended to assess whether an individual presents an infectious disease risk based on biometric readings and recent travel history, and to flag them for additional medical checks. This is a substantive evaluation about an identified or identifiable person that directly steers treatment at the border; they are not tasks that could qualify for the exception listed in Article 6(3) AI Act. Object and itinerary signals mapped to person-level risk
- An AI system intended to process licence-plate reads and travel-time data in order to generate an individual alert that a named traveller presents a heightened risk of irregular migration, because their journey between two points was abnormally long, and to refer that person to secondary screening. The alert is specified and used as a risk indicator about a natural person, even if a second AI system or a human performs the final assessment. Although the initial signal originates from a vehicle or a route, the intended use is to generate an alert for a specific person and refer that person to second line checks. Once the system outputs a person-specific risk indicator used for triage, it materially influences the assessment and is not eligible for the filter mechanism in Article 6(3) AI Act. Group-level risk indicators applied to individuals
- An AI system intended to derive group-level risk indicators from aggregate historical data (for example, overstay rates by route and season) and to apply those indicators to the personal data of named travellers to generate individual irregular-migration risk flags that are used to refer the person for enhanced checks. AI system consisting of several non-high-risk components
- An AI system intended to derive group-level indicators from aggregate historical data (for example, overstay rates by route and season) is combined with a non-AI rule-based engine that applies those indicators to named travellers to generate per-person irregular-migration risk flags used to refer the travellers to secondary screening. Taken separately none of the modules is high-risk under point 7(b), the analytics module outputs only aggregate statistics and the rules engine is not an AI system. However, u sed together with the intended purpose of assessing a risk posed by a natural person, the combined set-up should be classified as high-risk; it is not eligible for the filter mechanism in Article 6(3) AI Act.
b) Practical examples of AI systems falling outside the use caseof point 7(b) of Annex III
Aggregate or cohort-level analytics
- An AI system intended to process and aggregate large amounts of data to detect trends and patterns in migration, anticipate flows, or identify possible irregular migration networks at an aggregate level, where no natural persons are identified or identifiable from the aggregated data. Since the outputs do not concern identified or identifiable natural persons the system is not covered by use case listed in point 7(b) of Annex III.
- An AI system intended to process aggregate data (e.g. country of origin, route characteristics, real-time epidemiology) to flag an incoming group as having an elevated health risk and to trigger public-health measures (testing or quarantine). Since the system does not assess the risk posed by an identified or identifiable natural person, and the same measure is applied to all members of the cohort (e.g. everyone on a specific flight is tested), it falls outside the use case listed in point 7(b) of Annex III. If the data used to estimate the group risk is personal, the GDPR applies, but the system remains outside the scope of the use case. If the system, or combined configuration that includes the system, is intended to select specific individuals within the group for different treatment based on their individual features, then it should be considered to assess the risk posed by natural persons and falls within the use case. Vehicle-focused screening without mapping to a person
- An AI system intended to process licence-plate reads and travel-time data in order to flag vehicles with unusually long journeys and route the vehicle to a general secondary lane for a technical inspection, without creating or implying a risk assessment about the driv er or passengers. If the output is framed and used strictly as vehicle-level logistics, not as a personal risk indicator, it will not fall with the use case listed in point 7(b) of Annex III. If the border guards then also check the passengers as a standard operational consequence of a flagged vehicle, that does not convert the AI system’s output into a personlevel risk-assessment.
- An AI system intended to monitor vehicles transiting a border crossing point to flag stolen vehicles for secondary checks does not assess risks posed by a natural person within the meaning of point 7(b) of Annex III. Post-decision data cleaning
- An AI system intended to harmonise terminology and detect duplicate entries in completed risk-assessment records, after human assessment has been concluded. Such an AI system does not produce, nor is it intended to produce, a person-level risk output used in entry or stay decisions.