Annex III is the AI Act’s list of use cases that are treated as high-risk because they can affect people’s rights, access to services, or safety. The list is not about vendor branding; it is about what the system does. A chatbot, scoring tool, camera system, or case-management platform can move into Annex III depending on its purpose and deployment context, especially when a public authority uses it for decisions that matter.
For cyber security, Annex III matters because high-risk systems need stronger controls: documentation, logging, access management, human oversight, testing, and in some cases registration. Those requirements reduce the chance that a flawed model, tampered input, or stolen admin account can silently influence public services. In real operations, security teams use Annex III to classify AI projects, set procurement checks, and decide whether a tool needs extra review before production. It is a compliance list, but also a practical defense tool.