[{"data":1,"prerenderedAt":235},["ShallowReactive",2],{"uc-eu-ai-act-insurance":3},{"regulation":4,"term":11,"includeUnpublished":15,"indexable":16,"useCases":17,"asOf":234},{"id":5,"label":6,"issuer":7,"region":8,"url":9,"description":10},"eu-ai-act","EU AI Act","European Union","europe","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","Regulation (EU) 2024\u002F1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",{"id":12,"label":13,"description":14},"insurance","Insurance","Life, health, property and casualty insurers and brokers: distribution, underwriting, claims, fraud and policy servicing.",false,true,[18,24,29,34,39,44,49,54,59,64,68,73,77,81,85,89,94,98,103,107,111,115,120,124,128,132,137,141,145,149,153,157,161,166,170,174,178,182,186,190,194,198,202,206,210,214,218,222,226,230],{"slug":19,"title":20,"tier":21,"basis":22,"organizations":23},"claims-fraud-detection","AI for insurance claims fraud detection","context-dependent","Claims fraud detection by an insurer is not listed in Annex III, and point 5(b) explicitly excludes AI systems used to detect financial fraud from the credit scoring category. Point 5(c) covers only risk assessment and pricing in life and health insurance, so a fraud model becomes high risk when it also feeds those decisions, or when it is used by or on behalf of a public authority to grant, reduce, revoke or reclaim public assistance benefits (point 5(a)). Profiling and automated decisions remain subject to GDPR, including Article 22 where a claim is refused on a decision based solely on automated processing.",12,{"slug":25,"title":26,"tier":27,"basis":28,"organizations":23},"photo-based-damage-assessment","AI for photo based damage assessment in insurance claims","limited","Assessing damage to vehicles or property for property and casualty claims is not listed in Annex III, which covers insurance only for risk assessment and pricing of natural persons in life and health insurance (point 5(c)). Article 50(1) transparency duties apply when the customer interacts directly with the AI, for example a guided photo capture that returns an AI estimate or offer, or a chat agent. A purely internal repairer estimate review with no customer interaction is minimal. A settlement or refusal decided solely by automated processing can fall under GDPR Article 22.",{"slug":30,"title":31,"tier":21,"basis":32,"organizations":33},"claims-triage-and-straight-through-processing","AI for claims triage and straight through processing","Claims handling as such is not listed in Annex III. The same system becomes high risk when it is also used for risk assessment and pricing of natural persons in life and health insurance (point 5(c)), or when it is used by or on behalf of a public authority to grant, reduce, revoke or reclaim essential public assistance benefits and services, including healthcare services (point 5(a)). Otherwise the tier is minimal, so the design and the operator decide. Decisions on claims based solely on automated processing are also subject to Article 22 of the GDPR and the UK GDPR.",11,{"slug":35,"title":36,"tier":21,"basis":37,"organizations":38},"insurance-pricing-and-actuarial-copilot","AI copilot for insurance pricing and actuarial analysis","Pricing and risk assessment of natural persons for life and health insurance is high risk under Annex III point 5(c). Pricing for property and casualty products, and actuarial analysis that does not price individuals, are not listed, although supervisors still expect sound model governance.",9,{"slug":40,"title":41,"tier":42,"basis":43,"organizations":38},"commercial-underwriting-submission-triage","AI for commercial underwriting submission intake and triage","minimal","Intake and triage for commercial insurance is not listed in Annex III, which covers risk assessment and pricing of natural persons in life and health insurance. It moves up to high risk only if the same pipeline is used to assess or price life or health cover for individuals.",{"slug":45,"title":46,"tier":21,"basis":47,"organizations":48},"underwriting-risk-assessment-copilot","AI copilot for underwriting risk assessment","For commercial property and casualty lines the copilot is not listed in Annex III. Used for risk assessment of natural persons in life or health insurance it falls under Annex III point 5(c) and is high risk, with risk management, data governance, logging and human oversight duties, and deployers must carry out a fundamental rights impact assessment under Article 27.",8,{"slug":50,"title":51,"tier":27,"basis":52,"organizations":53},"claims-first-notice-of-loss-agent","AI agent for first notice of loss claims intake","A customer facing intake agent must be designed so that people know they are interacting with AI (Article 50(1)). Claims intake and claims handling are not listed in Annex III: point 5(c) covers risk assessment and pricing in life and health insurance, not claims. One design choice changes this: detecting distress by inferring emotions from the caller's voice is emotion recognition based on biometric data, which is high risk under Annex III point 1(c) and needs disclosure under Article 50(3). Detecting vulnerability from what the caller says does not. The limited tier assumes that design: every handover signal on this page (injury, distress, anger, vulnerability) is detected from the words of the conversation, and inferring emotions from the voice itself is out of scope.",7,{"slug":55,"title":56,"tier":27,"basis":57,"organizations":58},"insurance-policy-servicing-agent","AI agent for insurance policy servicing","A customer facing assistant must be designed so that people know they are interacting with AI (Article 50(1), applicable from 2 August 2026). It is not high risk as long as it does not carry out risk assessment and pricing in relation to natural persons in life and health insurance (Annex III point 5(c)).",6,{"slug":60,"title":61,"tier":21,"basis":62,"organizations":63},"insurance-broker-and-agent-assistant","AI assistant for insurance brokers and agents","An employee facing assistant for knowledge answers and drafting is not listed in Annex III and is minimal risk. A lead qualification agent that talks to customers must tell them they are dealing with AI (Article 50). Using performance insights to monitor and evaluate individual agents, or to allocate leads based on their behavior or traits, is high risk under Annex III point 4(b), and any component that does risk assessment or pricing of life or health insurance for individuals is high risk under Annex III point 5(c).",5,{"slug":65,"title":66,"tier":21,"basis":67,"organizations":63},"correspondence-triage-and-routing","AI for inbound correspondence triage and routing","It depends on where the system runs. Classifying and routing a bank's or insurer's correspondence is not a use listed in Annex III, so it is minimal risk: the AI literacy duty of Article 4 applies, and the Article 50 duty to tell people they are dealing with AI does not, because the system does not interact with the sender. Used by or for a public authority in a benefits process covered by Annex III point 5(a), the provider can treat it as not high risk only while it performs a narrow procedural or preparatory task under Article 6(3); the provider must then document that assessment before it goes live (Article 6(4)) and register the system in the EU database (Article 49(2)). If the system evaluates eligibility for benefits or profiles the people who write in, it is high risk, so those judgments stay with people.",{"slug":69,"title":70,"tier":42,"basis":71,"organizations":72},"aerial-imagery-property-risk-scoring","AI aerial imagery risk scoring for property insurance underwriting","Annex III point 5(c) lists risk assessment and pricing of natural persons in life and health insurance. Property condition and wildfire scoring for homeowners or commercial property is not listed. It would move up to high risk if the same scores were used to assess or price life or health cover for individuals.",4,{"slug":74,"title":75,"tier":42,"basis":76,"organizations":72},"catastrophe-exposure-assessment","AI for catastrophe and exposure assessment in insurance","Not listed in Annex III: the system aggregates satellite and portfolio data to prioritize claims response and inform exposure management, and does not decide an individual's cover, price or claim outcome. It would need reassessment if the same output were used to automatically decline or reduce a specific claim without human review.",{"slug":78,"title":79,"tier":21,"basis":80,"organizations":72},"health-prior-authorization-and-claims-adjudication","AI for health insurance prior authorization and claims adjudication support","Annex III point 5(a) makes AI high risk when it is used by or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services, including healthcare services, or to grant, reduce or revoke them, which can cover statutory health schemes run by or for public bodies. Point 5(c) covers risk assessment and pricing in life and health insurance, not claim review. A copilot for a private insurer's claim review, where people decide, is usually outside Annex III; for public schemes, Article 6(3) may exempt a system that only performs a preparatory task, unless it profiles natural persons. GDPR rules on health data (Article 9) and on solely automated decisions (Article 22) apply in every case.",{"slug":82,"title":83,"tier":21,"basis":84,"organizations":72},"insurance-renewal-and-retention","AI for insurance renewal processing and customer retention","Renewal intake for commercial lines and outreach are not listed in Annex III. Renewal risk assessment or pricing for life or health insurance of natural persons is high risk under point 5(c), and so is a lapse score that feeds those decisions; a lapse score used only to decide who gets a service call is not listed. Customer facing renewal assistants carry the Article 50(1) duty to tell people they are interacting with an AI system, unless that is obvious from the context.",{"slug":86,"title":87,"tier":21,"basis":88,"organizations":72},"litigation-and-recovery-triage","AI for litigation and recovery triage","Litigation and recovery triage is not itself listed in Annex III. It becomes high risk when the same system evaluates a natural person's creditworthiness or credit score (Annex III point 5(b)), for example when a debt write off or pursue decision is based on such an assessment; scoring which attorney to instruct or whether an insurance claim is likely to litigate is outside that point on its own. Automated decisions with a legal or similarly significant effect on an individual are also subject to Article 22 of the GDPR.",{"slug":90,"title":91,"tier":92,"basis":93,"organizations":72},"life-underwriting-medical-record-summarization","AI summarization of medical evidence for life and health underwriting","high","Annex III point 5(c): AI intended for risk assessment and pricing in relation to natural persons in life and health insurance. Article 6(3) exempts some purely preparatory tasks, but never a system that profiles natural persons. Extracting an applicant's health conditions and mapping them to the underwriting manual evaluates their health, which is profiling, so treat the system as high risk. Under the timeline as amended, the obligations for Annex III high risk systems apply from 2 December 2027, and Article 27 requires deployers of point 5(c) systems to assess the impact on fundamental rights before first use.",{"slug":95,"title":96,"tier":21,"basis":97,"organizations":72},"live-agent-assist","Real time AI assist for contact center agents","As a pure assist tool for agents it is minimal risk; the customer does not interact with the AI. It becomes high risk under Annex III point 4(b) if its data is used to monitor and evaluate individual agents' performance, and inferring agents' emotions at work is prohibited under Article 5(1)(f).",{"slug":99,"title":100,"tier":21,"basis":101,"organizations":102},"parametric-claims-triggering","AI for parametric insurance claims triggering","Annex III point 5(c) covers AI systems for risk assessment and pricing in relation to natural persons for life and health insurance specifically. A property, agricultural or sovereign disaster index falls outside that point, so most parametric triggers are not high risk on that ground; it becomes high risk only if the same model prices or assesses life or health cover for a natural person. Separately, a fixed rule with no learned model behind it may not meet the Article 3(1) definition of an AI system at all, a question decided case by case rather than settled by this page.",3,{"slug":104,"title":105,"tier":42,"basis":106,"organizations":102},"subrogation-opportunity-detection","AI for subrogation opportunity detection","Detecting recovery opportunities against third parties and other insurers is not listed in Annex III: point 5(c) covers only risk assessment and pricing of natural persons in life and health insurance, and the system does not decide on a natural person's access to a service. It is an internal tool that does not converse with the public or publish generated content, so the deployer transparency duties of Article 50 do not apply. Personal data in claim files, including data about the third party, is still subject to GDPR.",{"slug":108,"title":109,"tier":21,"basis":110,"organizations":102},"straight-through-small-business-cyber-underwriting","AI straight through underwriting for small business cyber insurance","Annex III point 5(c) covers risk assessment and pricing of natural persons in life and health insurance. Underwriting of business cyber insurance is not listed, so the quote decision itself carries no high risk duties. The tier would change if the same engine were used to price life or health cover for individuals. Where an email or chat agent replies to brokers or applicants who are natural persons, the transparency duty of Article 50 applies unless it is obvious from the context that they are dealing with AI.",{"slug":112,"title":113,"tier":21,"basis":114,"organizations":102},"conversational-insurance-quote-and-buy","Conversational AI for insurance quote and buy","The conversational layer carries the Article 50 transparency duty. If the system assesses risk or sets prices for life or health insurance of natural persons, that part is high risk under Annex III point 5(c); pricing for property and casualty products is not listed.",{"slug":116,"title":117,"tier":27,"basis":118,"organizations":119},"travel-insurance-claims-and-assistance-agent","AI agent for travel insurance claims and assistance","A customer facing agent must disclose that it is AI (Article 50), unless this is obvious from the context. Travel insurance claims handling is not listed in Annex III; point 5(c) covers risk assessment and pricing in life and health insurance, not the handling of claims. Handing a traveler who reports a medical emergency to the assistance team is not the classification of emergency calls or the patient triage in point 5(d), as long as the agent only hands over and does not set medical priorities. Claim decisions based solely on automated processing are subject to GDPR Article 22 (and its UK equivalent), and medical data is special category data under Article 9.",2,{"slug":121,"title":122,"tier":27,"basis":123,"organizations":119},"enterprise-knowledge-search","AI enterprise knowledge search for employees","Article 50(1) requires that people who interact directly with an AI system are informed of it, unless this is obvious from the context, as it usually is for an internal assistant. The system would be high risk only if it were intended for an Annex III purpose, such as assessing the creditworthiness of natural persons (point 5(b)) or making decisions on or evaluating workers (point 4(b)).",{"slug":125,"title":126,"tier":21,"basis":127,"organizations":119},"synthetic-test-data-generation","AI for synthetic test data generation","A generator of synthetic tabular test data is not listed in Annex III and does not interact with people, so it is minimal risk with only the AI literacy duty of Article 4. When the system generates synthetic text, images, audio or video, such as documents or conversation transcripts, Article 50(2) requires its provider to mark the output in a machine readable format as artificially generated. When synthetic data is used to train, validate or test a high risk system, such as credit scoring, it falls under that system's data governance duties in Article 10.",{"slug":129,"title":130,"tier":92,"basis":131,"organizations":119},"call-quality-and-compliance-monitoring","AI quality and compliance monitoring of every customer interaction","Scoring individual agents' interactions to monitor and evaluate their performance and behavior falls under Annex III point 4(b), employment and worker management. The Article 6(3) exception does not apply where the system profiles natural persons. Inferring agents' emotions is prohibited under Article 5(1)(f), except for medical or safety reasons. Inferring customers' emotions from their voice is emotion recognition on biometric data: high risk under Annex III point 1(c), and Article 50(3) requires informing the people exposed to it. Analytics that only aggregate interaction themes without evaluating individuals can fall outside the high risk category.",{"slug":133,"title":134,"tier":27,"basis":135,"organizations":136},"corporate-and-marketing-avatar-video","AI avatar and translated video for corporate communications and marketing","Generating presenter video is not listed in Annex III. Providers of tools that generate synthetic video must mark the output as AI generated, and deployers must disclose deep fakes, such as an avatar or cloned voice of a real executive that would falsely appear authentic (Article 50(2) and (4)). The tier changes only if the same system also decides on access to work or services, which these deployments do not describe.",1,{"slug":138,"title":139,"tier":27,"basis":140,"organizations":136},"financial-services-digital-human-guide","AI digital human guide for banks and insurers","Article 50(1): people must be told they are interacting with an AI system unless that is obvious from the context. Camera based emotion recognition of customers, which some of the avatars described here do, is high risk under Annex III point 1(c) and needs the Article 50(3) notice, so leave it out of the design or put it through a separate assessment. An avatar that mimics a real employee or executive may also be deepfake content under Article 50(4), which requires disclosure that the content is artificially generated. General product and service answers are not an Annex III use; the tier would rise if the avatar assessed creditworthiness or priced life or health insurance.",{"slug":142,"title":143,"tier":42,"basis":144,"organizations":136},"board-and-committee-paper-summarization","AI for board and committee paper summarization","An internal assistant that summarizes documents for directors and does not decide on natural persons' access to a service, employment or credit is not listed in Annex III and is not a prohibited practice under Article 5, so it sits at minimal risk beyond the Article 4 AI literacy duty. It would need reassessment if a committee paper's summarization were used to evaluate a named employee's performance, which falls under Annex III point 4(b).",{"slug":146,"title":147,"tier":21,"basis":148,"organizations":136},"compensation-and-pay-equity-analysis","AI for compensation governance and pay equity analysis","The tier depends on what the range is used for. When it materially influences an individual hiring offer, it falls under Annex III point 4(a) (recruitment); when it materially influences an individual raise or promotion decision, it falls under point 4(b) (decisions affecting the terms of a work relationship). A recommended range that a recruiter or manager can accept or override, as this use case is designed, still counts as materially influencing that decision. A separate system that only produces an aggregate regression report for the compensation team, with no individual recommendation, is either outside Annex III on that narrower use or falls under Article 6(3) as a preparatory task that detects deviations from prior decision patterns rather than a high risk use in itself. Deployers of the high risk part must inform workers' representatives and affected employees before use (Article 26).",{"slug":150,"title":151,"tier":27,"basis":152,"organizations":136},"outbound-notice-drafting","AI for drafting customer letters and outbound notices","Drafting letters for human approval is not listed in Annex III. The decision the letter communicates may come from a separate high risk system, such as credit scoring (Annex III point 5(b)) or a public body's eligibility decision on benefits (point 5(a)); the drafting tool does not make that decision. Article 50(2) requires the provider of an AI system that generates text to mark the output as artificially generated, which puts this on the limited risk (transparency) tier; this includes an organization that builds its own drafting tool. Article 50(2) does not apply where the AI has only an assistive function for standard editing and does not substantially alter the input data or the semantics of the output.",{"slug":154,"title":155,"tier":21,"basis":156,"organizations":136},"conversation-roleplay-training","AI roleplay training for customer conversations","Used only for practice and feedback, the simulator is limited risk. Article 50 requires that people know they are interacting with AI unless that is obvious from the context, as it usually is in a training session, and the provider must mark synthetic voice or text output as AI generated in a machine readable format. It becomes high risk under Annex III point 4(b) if its scores are used to evaluate the performance of workers or to decide on their promotion or termination, and can fall under point 3(b) when a vocational training institution uses it to evaluate learning outcomes. Inferring trainees' emotions from voice or face in the workplace is prohibited under Article 5(1)(f), except for medical or safety reasons.",{"slug":158,"title":159,"tier":21,"basis":160,"organizations":136},"sales-call-coaching-and-crm-update","AI sales call coaching and CRM update","Summaries, CRM suggestions and follow up drafts that the seller reviews are not an Annex III use and are minimal risk. Using call analysis to monitor and evaluate the performance and behavior of individual sellers, or to allocate leads to sellers based on their behavior or personal traits, is high risk under Annex III point 4(b). Inferring sellers' emotions from their voice is prohibited in the workplace by Article 5(1)(f). Emotion recognition applied to customers' voices is high risk under Annex III point 1(c), and Article 50(3) requires deployers to inform the people exposed to it.",{"slug":162,"title":163,"tier":21,"basis":164,"organizations":165},"complaints-handling-agent","AI agent for complaints recognition, investigation and response","Complaint handling is not listed in Annex III, so internal classification and drafting for a handler who decides is minimal risk. Where the agent talks to customers to take the complaint, Article 50(1) requires telling them they are dealing with AI. Only a system that also assessed creditworthiness or priced life and health insurance (Annex III point 5(b) or 5(c)) would be high risk for that part.",0,{"slug":167,"title":168,"tier":42,"basis":169,"organizations":165},"shariah-compliance-screening","AI assistant for Shariah compliance screening and review","An internal assistant that screens contracts for compliance with Shariah standards is not listed in Annex III: it assesses contracts, structures and securities, not the creditworthiness of natural persons (Annex III point 5(b)). If a customer facing version answers product questions, it must disclose that people are interacting with an AI system under Article 50(1). National Islamic finance regulators set their own Shariah governance expectations.",{"slug":171,"title":172,"tier":27,"basis":173,"organizations":165},"marketing-content-compliance-copilot","AI copilot for marketing content with compliance pre review","An internal drafting and review aid that makes no decisions about people. Article 50 transparency duties apply to generated content: providers must mark synthetic content, and deployers must disclose deep fake images, audio or video. Personalized targeting of individuals is governed mainly by data protection and consumer law rather than the AI Act.",{"slug":175,"title":176,"tier":42,"basis":177,"organizations":165},"model-risk-validation-copilot","AI copilot for model risk validation and monitoring","A validation copilot supports internal governance and is not itself an Annex III use, and its drafts are internal, so Article 50 transparency duties do not normally apply. It often helps validate models that are high risk under Annex III (point 5(b), creditworthiness and credit scoring of natural persons; point 5(c), life and health insurance pricing), and the testing and documentation it supports feed the provider obligations of Articles 9, 11 and 15.",{"slug":179,"title":180,"tier":21,"basis":181,"organizations":165},"account-servicing-execution","AI for back office account servicing execution","The tier depends on how the system is built. It stays minimal when the agent only executes changes approved by a person and any letter comes from a fixed template, since executing servicing changes is not listed in Annex III. It moves to limited risk when the same system talks to customers directly (the Article 50 transparency duty, described on the customer facing servicing page) or when generative AI drafts the confirmation or letter text: the provider of that generative function, the bank if it builds the system, then carries the Article 50(2) duty to mark the generated content in a machine readable way, unless the output only gets an assistive role or standard editing that does not substantially alter the input data. An AI system used to evaluate the creditworthiness of natural persons, for example to decide on a loan restructuring, is high risk under Annex III point 5(b); keep that assessment outside this agent, which only executes the decided change.",{"slug":183,"title":184,"tier":42,"basis":185,"organizations":165},"complaints-root-cause-analysis","AI for complaints root cause and systemic issue analysis","Analyzing complaints in aggregate to find causes is not listed in Annex III, is not a practice prohibited by Article 5 and does not decide on individuals. It does not interact with the public, so the disclosure duty in Article 50(1) does not apply; the machine readable marking of generated text in Article 50(2) is a duty of the provider of the generative model or system that writes the summaries. If the same system decided individual complaint outcomes or redress, or its themes were used to evaluate the performance of individual complaint handlers (Annex III point 4), that design would need its own assessment.",{"slug":187,"title":188,"tier":21,"basis":189,"organizations":165},"continuous-controls-testing","AI for continuous controls testing and control self assessment","Testing controls over transactions and systems is not an Annex III use. Controls that monitor and evaluate individual employees' behavior, such as trading or access conduct, can fall under Annex III point 4(b), so the design decides the tier.",{"slug":191,"title":192,"tier":21,"basis":193,"organizations":165},"healthcare-claims-fraud-waste-abuse-detection","AI for healthcare claims fraud, waste and abuse detection","Claims fraud, waste and abuse detection is not itself listed in Annex III. Annex III point 5(a) only covers AI used by or on behalf of public authorities to evaluate a natural person's eligibility for essential public assistance benefits and services, or to grant, reduce or revoke them, which can cover statutory health schemes run by or for public bodies such as Medicare; it does not cover a private health insurer denying a member's own claim. For a private insurer, only Annex III point 5(c), risk assessment and pricing in life and health insurance, can make a system high risk, and claims fraud, waste and abuse detection by itself is not covered by it. Provider level detection that never decides a patient's own entitlement to care stays outside Annex III either way.",{"slug":195,"title":196,"tier":42,"basis":197,"organizations":165},"policy-drafting-and-gap-analysis","AI for policy drafting and policy gap analysis","Drafting internal policy text for human approval is not an Annex III use and has no direct effect on individuals. The Article 4 AI literacy measures still apply to the staff who use it.",{"slug":199,"title":200,"tier":27,"basis":201,"organizations":165},"regulatory-report-assembly","AI for regulatory report assembly","Not an Article 5 practice and not listed in Annex III: the system prepares filings for authorities and makes no decision on the credit, insurance, employment or access to services of a natural person. It is an internal tool whose users know they are working with AI, and drafted text that ends up in public disclosures passes human review under a named person's editorial responsibility, which takes it outside the Article 50(4) deployer disclosure duty. The system still drafts variance commentary and plain language explanations of validation failures from underlying data, rather than lightly editing existing text, so the assistive function for standard editing exception does not fit. The bank that builds or operates the system is then the provider and carries the Article 50(2) duty to mark that generated text in a machine readable way as artificially generated, which has applied since 2 August 2026. The AI literacy duty of Article 4 also applies.",{"slug":203,"title":204,"tier":27,"basis":205,"organizations":165},"statement-and-tax-document-generation","AI for statement, tax certificate and confirmation letter generation","Generating statements and confirmations from system data is not listed in Annex III and takes no decision about credit, insurance or access to essential services. If a customer facing agent takes the requests, Article 50(1) requires telling people they are interacting with an AI system. Under Article 50(2), providers of systems that generate text must mark the output as AI generated, unless the system only performs an assistive function for standard editing, or does not substantially alter the input data provided by the deployer or the semantics thereof; the free text the model drafts here is checked against source, but marking still applies where those exemptions do not.",{"slug":207,"title":208,"tier":42,"basis":209,"organizations":165},"supervisory-exam-response-assembly","AI for supervisory exam and information request responses","Drafting regulatory correspondence for human approval is not an Annex III use. The main risks are confidentiality and accuracy, which are handled by supervisory information rules, data protection law and internal controls.",{"slug":211,"title":212,"tier":42,"basis":213,"organizations":165},"vendor-due-diligence","AI for third party and vendor risk due diligence","Assessing organizations as vendors is not an Annex III use. If assessments score individual natural persons, such as sole traders, check the design against Annex III and data protection rules. The EU AI Act also shapes what to ask AI vendors, since providers of high risk systems carry specific obligations.",{"slug":215,"title":216,"tier":27,"basis":217,"organizations":165},"regulatory-horizon-scanning","AI regulatory horizon scanning and obligation mapping","An internal tool that monitors and classifies regulatory publications for staff makes no decisions about natural persons, so it is not listed in Annex III and is not a prohibited practice under Article 5. Staff know they are using an AI tool and its summaries are not published to the public, so the Article 50 duties to inform users and to disclose published generated text add little for the deploying organization. Article 50(2) still requires the provider of a system that generates text to mark its output, in a machine readable format, as AI generated: usually the vendor, but an organization that builds its own summarizer can itself be that provider, which is what puts this use case at the limited tier rather than minimal. Beyond this and AI literacy (Article 4), no specific obligations apply. General model risk and third party rules still apply.",{"slug":219,"title":220,"tier":21,"basis":221,"organizations":165},"ai-model-inventory","AI system and model inventory with shadow AI discovery","Minimal for a system level register of systems and owners with no monitoring of individual employees; it is not listed in Annex III and is the instrument deployers use to meet obligations such as the Article 26 duties for high risk systems and the Article 49 registration of Annex III systems in the EU database. Limited where the plain language assistant that staff and auditors query is not obviously an AI system to its users: under Article 50(1) its provider must then design it so people are told they are dealing with AI. Possibly high risk under Annex III point 4(b) on worker management if the discovery process monitors or evaluates the behavior of individual employees rather than staying at the level of systems and owners.",{"slug":223,"title":224,"tier":27,"basis":225,"organizations":165},"payer-member-service-virtual-assistant","AI virtual assistant for health insurance member service","Article 50(1): members must be told they are talking to an AI system. Answering benefit and claims status questions is not itself an Annex III use. It would become high risk under Annex III point 5(c) if the same system assessed or priced an individual's health insurance risk, or under point 5(a) if it decided eligibility for a public health scheme; keep those decisions in the plan's existing underwriting and adjudication process, which this use case only informs the member about.",{"slug":227,"title":228,"tier":42,"basis":229,"organizations":165},"internal-audit-copilot","Generative AI copilot for internal audit","An internal drafting and analysis assistant for auditors that makes no decisions about natural persons. It would need reassessment if used to evaluate individual employees' behavior or performance, which falls under Annex III point 4(b).",{"slug":231,"title":232,"tier":27,"basis":233,"organizations":165},"governed-text-to-sql-analytics","Governed text to SQL analytics assistant","Article 50(1) requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with AI, unless this is obvious from the context, as it usually is for an internal assistant. An analytics assistant that makes no decisions about people is not a prohibited practice under Article 5 and is not listed in Annex III. It would be high risk only if it were intended for an Annex III purpose, such as assessing the creditworthiness of natural persons (point 5(b)).","2026-10-14",1792420066544]