Which AI use cases in media and entertainment are high risk under the EU AI Act?

Recommendation and personalization systems are not listed in Annex III, so most deployments are minimal risk under the EU AI Act. They become a compliance question elsewhere: manipulative or deceptive techniques that materially distort a person's behavior in a way that causes significant harm, or that exploit vulnerabilities linked to age, disability or a specific social or economic situation, are a prohibited practice under Article 5(1)(a) and (b), which is relevant to recommendation systems that target children. A decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on a person falls under GDPR Article 22, though routine content ranking rarely meets that bar on its own.

Transcription and captioning are not listed in Annex III and are not a prohibited practice under Article 5, so the tier depends on how captions are published. Article 50(4) requires deployers to disclose AI generated or manipulated text published to inform the public on matters of public interest, such as news captions, unless it has undergone human review or editorial control and someone holds editorial responsibility, so the editor step keeps most deployments outside this duty. The provider duty to mark output in Article 50(2) does not apply where the system does not substantially alter the input or its semantics, which fits same language transcription better than translated subtitles. Unreviewed news captions or subtitles should therefore be disclosed as automatic.

Cataloguing objects, scenes, logos and spoken content is not listed in Annex III and is typically minimal risk. Annex III point 1(a) covers remote biometric identification: the automated, one to many matching of a person's face or voice, without their active involvement and typically at a distance, against a reference database of identified individuals to establish who they are, in so far as its use is permitted under relevant Union or national law; it excludes one to one biometric verification. A feature that recognizes and names a specific person in archive footage by comparing them against such a database meets that definition and is high risk, while grouping similar looking footage without assigning an identity does not. Article 6(3) lets a provider assess a listed system itself as not high risk when it performs only a narrow procedural task, but that derogation is unlikely to cover a system whose purpose is naming an individual, so treat person recognition as high risk by default. Point 1(b) covers biometric categorization, inferring a sensitive or protected attribute from a person's face or voice. RTVE's 2025 contract specifies speaker gender identification as a feature; whether that counts as a protected attribute under point 1(b) is contested, since Recital 54 ties that category to attributes protected under GDPR Article 9(1), and sex or gender is not listed there. Treat gender inference from voice as potentially high risk and apply the same governance the organization uses for other biometric systems until that question is settled.

Most personalization and content generation is minimal risk. Providers of systems that generate synthetic audio, image, video or text content must mark the output as artificially generated, and deployers must disclose deep fakes (Article 50(2) and 50(4)). Personalization that deploys manipulative or deceptive techniques, or exploits vulnerabilities due to age, disability or a specific social or economic situation, in a way that causes or is reasonably likely to cause significant harm, is prohibited under Article 5(1)(a) and (b). Using AI to assess creditworthiness or to price life and health insurance is high risk under Annex III point 5(b) and 5(c) and belongs on its own page. Outside the AI Act, the FCA Consumer Duty applies only to FCA regulated firms (the financial services slice of this use case), and the Telephone Consumer Protection Act applies only to campaigns delivered by call or text message in the US.

Counting people and estimating flow without identifying or categorizing individuals is not listed in Annex III. The tier changes with the design: remote biometric identification of people in a crowd falls under Annex III point 1(a), biometric categorization under point 1(b), and use by or on behalf of law enforcement to assess or profile individuals under point 6. Real time remote biometric identification in publicly accessible spaces for law enforcement is prohibited under Article 5(1)(h), with narrow listed exceptions. France ran its Paris 2024 trial under a national law that authorized eight listed situations, after an opinion from the data protection authority CNIL, according to the French press.

Article 50(1) requires that readers know they are interacting with AI. Article 50(4) requires deployers to disclose AI generated text published to inform the public on matters of public interest, unless the content has undergone human review or editorial control and a person holds editorial responsibility. Whether answers generated on demand for a single reader count as text published to inform the public is open to interpretation, but they are rarely reviewed before readers see them, so the conservative choice is to label them.

A visitor facing assistant must make clear that people are interacting with AI (Article 50), and synthetic speech should be identifiable as AI generated. It is not high risk. It would change if the camera feature were used to identify or categorize visitors by biometric data, which a guide does not need: remote biometric identification, biometric categorization and emotion recognition are high risk under Annex III point 1, and biometric categorization that infers sensitive traits is prohibited under Article 5.

Article 50(2): a system that generates synthetic audio, text or video content, such as AI generated commentary, must ensure its output is marked in a machine readable format and detectable as artificially generated, unless a narrow exemption applies. That is a technical marking duty on the provider, not necessarily a visible on screen label for viewers; a visible disclosure that commentary is AI generated, as listed in controls below, is a design choice. Article 50(4) can separately require a deployer to disclose that AI generated or manipulated text has been artificially generated, but only for text published with the purpose of informing the public on matters of public interest, and that duty does not apply where the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for publishing it. Routine live match commentary will often sit outside Article 50(4) for both reasons: it is not usually framed as informing the public on a matter of public interest, and an editorial or product team typically reviews it. This is not an Annex III use unless the generated commentary itself were used to make a decision about a natural person, which is not the case in the deployments we found.

Article 50(4) requires deployers to disclose text generated by AI that is published to inform the public on matters of public interest, unless the text has undergone human review or editorial control and a person holds editorial responsibility for it. A newsroom with a journalist who reviews and is responsible for every item meets the exception, but a label is still good practice. Newsroom drafting is not an Annex III use.

Article 50 sets transparency duties for synthetic audio, and they have applied since 2 August 2026. Providers of systems that generate synthetic audio must mark the output in a machine readable way (Article 50(2)). Deployers of a system that produces a deep fake, meaning audio that resembles existing persons, objects, places, entities or events and would falsely appear authentic, must disclose that it was artificially generated (Article 50(4)), with a lighter duty for evidently artistic, creative, satirical or fictional work. Whether a dub is a deep fake depends on the content and the use. Dubbing is not an Annex III use.

Detecting a sporting moment in video the broadcaster already owns the rights to, and cutting or reframing a clip from that real footage, is not listed in Annex III, so it stays minimal risk. The system AWS describes does generate synthetic text: AI generated tags and a short AI generated description of each moment for the internal review portal. That falls inside Article 50(2)'s scope for synthetic content, but the marking duty there sits with the AI system's provider, and the outputs stay internal for an editor to check before anything reaches a fan facing channel, so the practical exposure stays minimal. Cropping real footage to a vertical frame is standard editing, not the kind of content generation Article 50 targets.

Scoring readers for a subscription offer is not an Annex III use and does not interact with people in a way that triggers the transparency duties of Article 50. It would move toward a more regulated setting if the same score decided access to an essential service. The relevant law is data protection: profiling for marketing needs a lawful basis and respects the right to object.

Classifying user generated content against a platform's own policy is not listed in Annex III, and the system does not generate or manipulate content, so it carries no use case specific duty under the EU AI Act. Platform content moderation is instead the direct subject of the EU Digital Services Act (Regulation (EU) 2022/2065), a separate regulation. Article 17 requires a statement of reasons for content moderation decisions, and Article 20 requires an online platform within its scope to offer an internal complaint handling system, though Article 19 exempts micro and small enterprises from that duty; see the cited guidance below.