This practical exercise presents three case studies. For each, apply Article 6, the Annex III categories, and the Article 6(3) derogation to determine the risk tier and identify the primary compliance obligations.
Case Study A: HR Resume Screening Tool
A multinational corporation deploys an AI system that screens job applications by scoring resumes and ranking candidates. The system uses natural language processing to evaluate qualifications against job requirements. Analysis: Annex III, point 4(a) covers "AI systems used for recruitment or selection of natural persons, notably for advertising vacancies, screening or filtering applications, evaluating candidates in the course of interviews or tests." This system is high-risk under Article 6(2). The Article 6(3) derogation does not apply because the system profiles natural persons. Obligations: full Articles 9-15 requirements; provider obligations under Article 16; deployer FRIA if the deployer is a public body.
Case Study B: Predictive Maintenance AI
A manufacturer deploys an AI system that predicts when industrial machinery will require maintenance by analysing sensor data. The system outputs a maintenance recommendation that is always reviewed by a human engineer before any action is taken. Analysis: Annex III, point 2(a) covers "AI systems intended to be used as safety components in the management and operation of critical infrastructure." If the industrial machinery is not critical infrastructure, this system may not fall under Annex III. Even if it did, the Article 6(3) derogation could potentially apply if the system only narrows options for human review and does not make autonomous decisions. If minimal risk, no mandatory obligations apply.
Case Study C: AI Credit Scoring for Consumer Loans
A fintech company uses an AI system to assess creditworthiness for consumer loan applications. The output directly determines whether a loan is approved. Analysis: Annex III, point 5(b) covers "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud." This is clearly high-risk. The deployer (if a private financial institution) does not trigger the FRIA obligation under Article 26(9) -- but if a public bank or credit institution providing a public service does, the FRIA applies.