Which AI use cases in logistics and transportation are high risk under the EU AI Act?

A back office agent that turns business customers' order messages into draft sales orders does not decide on access to services, credit or employment, which is minimal risk. Article 50(1) applies to providers of AI systems intended to interact directly with natural persons. Reading inbound orders and sending a one way acknowledgment is a weak fit, but an agent that holds clarification exchanges with customers on WhatsApp or email does interact directly with the people who write, and those people must be informed they are dealing with an AI system unless that is obvious from the context.

The classification and declaration work in the back office is minimal risk: classifying goods and preparing customs declarations is not listed in Annex III, which covers border control only where AI assesses natural persons (point 7). If the design adds a shipper facing assistant that asks for missing information in chat or by email, that assistant is limited risk and carries the transparency duty of Article 50 (people must know they are dealing with AI). The obligations that matter most come from customs law: the declarant stays responsible for the accuracy of the declaration whatever tool prepared it.

Article 50(1) applies whenever the agent interacts directly with a shipper or carrier, for example replying to a quote email or confirming an appointment: the recipient must be able to tell they are dealing with an AI system, unless this is obvious from the context. Article 50(2) is a separate duty on the provider: the generated quote or confirmation text itself must be marked in a machine readable format as artificially generated, and that duty does not apply only where the system performs an assistive function for standard editing or does not substantially alter input data the deployer supplied. Whether dispatch is high risk depends on who is being ranked. Matching freight capacity and pricing a quote for a shipper is not a listed Annex III use. But allocating loads or tasks based on an individual's behavior in a work related relationship is Annex III point 4(b), so a deployment that ranks or assigns work to a named driver or owner operator based on their own behavior, for example an asset carrier's employed drivers or a platform ranking owner operators on their clicks, saves and booking history, needs a fresh assessment against that point even though the reference design here scores capacity and price, not a person.

A system that flags a wheel or railcar for a qualified inspector to confirm is advisory and usually minimal risk. Under Article 6(1) it is high risk when both conditions hold: the same detection logic is built into a safety component of rolling stock or track equipment (or is itself such a product) covered by Directive (EU) 2016/797 on the interoperability of the rail system, which sits in Annex I Section B, for example if a flag were wired to trigger an automatic stop or speed restriction without a human check, and that directive requires a third party conformity assessment of the product. Under Article 2(2), as amended by Regulation (EU) 2026/1744, a high risk system of that kind is not subject to the full AI Act: only Article 6(1), Article 60a and Articles 102 to 112 apply directly, and Articles 57, 58 and 59 apply only so far as the high risk requirements have been integrated into the interoperability directive. The substantive high risk requirements reach the system through that directive instead, which Article 106 of the AI Act amends to require rail delegated and implementing acts to take those requirements into account.

Planning routes for a fleet is not an Annex III use. It becomes high risk under Annex III point 4(b) when the system allocates tasks to drivers on the basis of individual behavior or personal traits, or monitors and evaluates their performance and behavior, for example by assigning harder routes or scoring drivers from telematics and using that for pay or discipline. A system that only optimizes stops, vehicles and loads, with no per driver profiling, is usually minimal risk.

Counting people and estimating flow without identifying or categorizing individuals is not listed in Annex III. The tier changes with the design: remote biometric identification of people in a crowd falls under Annex III point 1(a), biometric categorization under point 1(b), and use by or on behalf of law enforcement to assess or profile individuals under point 6. Real time remote biometric identification in publicly accessible spaces for law enforcement is prohibited under Article 5(1)(h), with narrow listed exceptions. France ran its Paris 2024 trial under a national law that authorized eight listed situations, after an opinion from the data protection authority CNIL, according to the French press.

Not listed by name in Annex III. Recital 59 says AI systems used by tax and customs authorities in administrative proceedings should not be classified as high risk law enforcement systems; this covers the revenue, misclassification and valuation side of the risk targeting on this page. Contraband and narcotics targeting that leads to seizures sits nearer criminal enforcement: Annex III point 6 (law enforcement) can apply where customs acts in criminal enforcement and the system profiles a natural person, for example building a case around a seizure such as the heroin and methamphetamine finds Indian Customs describes. Annex III point 7(b) covers risk assessment of natural persons entering the Union; it does not apply here, since this use case scores goods, consignments and trading entities, not natural persons. Where a natural person is profiled, GDPR's profiling rules apply; Article 22 covers a decision based solely on automated processing that produces a legal or similarly significant effect, which this use case's human in the loop design (an officer decides every flagged case) is intended to keep out of scope on its own, a separate GDPR question from AI Act classification. Criminal customs investigations fall under the Law Enforcement Directive (EU) 2016/680 instead of the GDPR.

Article 50(1): an assistant that talks directly with recipients must be designed so they know they are interacting with an AI system, unless that is obvious from the context. It is not high risk: explaining tracking, changing a delivery and taking in a parcel claim fall under none of the Annex III areas (it does not decide on public assistance benefits, creditworthiness, insurance pricing or employment), and it involves no practice prohibited by Article 5.

Article 50(1): riders must be told they are dealing with an AI system, unless that is obvious from the context. Answering trip questions and logging reports is not a listed Annex III use; it would need a fresh assessment if the same agent decided eligibility for a reduced fare, a concession or paratransit access, which touches access to an essential public service.

Forecasting a company's cash flows is not listed in Annex III and makes no decision about a natural person, so the forecasting model itself carries no obligations beyond AI literacy (Article 4). The conversational layer interacts directly with treasury staff, so under Article 50(1) they must be informed that they are dealing with an AI system unless that is obvious from the context. Without a conversational layer the use case is minimal risk.

The translation service generates synthetic sign language video, so under Article 50(2) the provider must mark that output as artificially generated in a machine readable format. A deployer must disclose the video as AI generated under Article 50(4) only where the signer is photorealistic enough to count as a deep fake: content that resembles an existing person and would falsely appear authentic. There is no human review or editorial responsibility exemption for video; that Article 50(4) exemption applies only to generated text published in the public interest. Article 50(1), the duty to tell someone they are dealing with AI, applies only if the avatar interacts with a person directly, for example in a conversational digital human channel; a video played on a screen or on request does not by itself trigger that duty.

Annex III point 2 lists critical infrastructure sectors that carry specific obligations: digital infrastructure, road traffic, and the supply of water, gas, heating or electricity. Port call and vessel arrival scheduling is not one of the sectors listed there, and the system does not decide on a natural person's access to an essential service, so it carries no specific EU AI Act obligation beyond the Article 4 AI literacy duty that applies to all providers and deployers. A port that later applies the same kind of model to safety critical vessel traffic management should reassess the tier for that specific use.

Sourcing indirect goods and services for the organization's own use is not listed in Annex III, and the system has no direct effect on individuals, so only AI literacy duties apply. Check the design if bidders are natural persons, for example sole traders, or if the agent produces any assessment of individual workers. Public bodies also remain bound by national public procurement rules on equal treatment and transparency, whichever tool runs the event.

Matching a company's own incoming payments to its own open invoices is a back office finance operation. It is not listed in Annex III and does not decide a natural person's creditworthiness or eligibility for a service, so it is minimal risk and the AI literacy duty of Article 4 applies. Using deduction or payment behavior to score an individual sole trader's creditworthiness would need a fresh risk assessment.