These two annexes get merged into one search query constantly, and they answer different questions. Annex III decides whether your system counts as high-risk in the first place. Annex IV only shows up once that's already decided, and it specifies what the resulting paperwork has to contain.
If you landed here searching some version of "Annex III vs Annex IV," the short answer is that they're not alternatives, they're sequential. Annex III is a list of use-case categories: get your system onto that list (and fail to qualify for an exemption) and it's classified high-risk. Annex IV is a completely separate list, of nine documentation sections, that applies once a system is high-risk for any reason. You don't choose between them. Annex III tells you whether Annex IV applies to you at all.
| Annex III | Annex IV |
|---|---|
| Defines which AI systems are high-risk, by use-case category | Defines what the technical documentation file must contain, once a system is high-risk |
| Referenced by Article 6 (classification) | Referenced by Article 11 (documentation obligation) |
| Eight categories: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration/border control, justice and democracy | Nine sections: general description, architecture/development, monitoring & control info, performance metrics, risk management, change log, standards applied, EU declaration of conformity, post-market monitoring plan |
| Contains no documentation requirements itself | Assumes classification is already settled; doesn't classify anything |
If you need the section-by-section breakdown of what actually goes in the documentation file, that's covered separately in our fill-in Annex IV template and the plain-English explainer. This post is specifically about the classification step that happens before any of that, because it's where teams either over-scope (documenting a system that was never in scope) or under-scope (skipping documentation on a system that actually needed it).
A system is a candidate for high-risk status if it falls into one of these use-case areas (Article 6(2), Annex III):
Landing in an Annex III category doesn't automatically make a system high-risk. Article 6(3) carves out an exemption: a system in an Annex III category is not high-risk if it doesn't pose a significant risk to health, safety, or fundamental rights, and it meets at least one of four conditions:
This is the exemption that gets a lot of narrow, assistive tools out of high-risk scope: a system that flags resumes for a recruiter to review, rather than rejecting candidates outright, can plausibly land under condition 2 or 4. A system that pre-drafts an eligibility decision but doesn't finalize it can too. The exemption is written for exactly that shape of tool.
This is the part that surprises the most people: if you conclude your Annex III system qualifies for the Article 6(3) exemption, you don't just stop. Article 6(4) requires you to document that assessment before the system is placed on the market or put into service, and it makes you subject to the registration obligation in Article 49(2). In practice that means:
So the actual decision tree isn't "high-risk, do Annex IV" versus "not high-risk, do nothing." It's closer to three outcomes: not in an Annex III category at all (no documentation obligation from this Annex), in an Annex III category but exempt under Article 6(3) (a documented, registered assessment, but not Annex IV), or in an Annex III category and not exempt (full Annex IV technical documentation under Article 11).
As of the 2026 Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), the compliance deadline for standalone Annex III high-risk systems was pushed from 2 August 2026 to 2 December 2027. AI embedded in products already covered by separate EU product-safety law (the Annex I pathway) moves to 2 August 2028. That deferral is conditional, not fixed: the Commission can pull it forward to six months after it formally confirms the supporting standards and guidance are ready, so December 2027 is a backstop, not a date to plan the rest of a roadmap around.
What didn't move: the Article 50 transparency and AI-content-labeling duties, the general-purpose AI model obligations (in force since August 2025), and the Article 5 prohibited-practices regime (in force since February 2025). If your system touches any of those, the Annex III/IV timeline extension doesn't help you.
If your classification lands you in "not exempt, high-risk," the next question is what the Annex IV file actually needs to contain and how much of it can be built from evidence you already have (scan results, eval runs, incident logs) versus written from scratch. That's the part covered in the Annex IV template and, for what a finished section looks like, the worked examples post. If you've already been through one documentation cycle, this post covers why the file stops matching reality within a few months and what actually keeps it current.
If you have Sentinel Scan (or similar) results sitting in a JSON file, we'll map them directly into the relevant Annex IV sections instead of you writing it by hand, delivered within 24 hours.
We're validating demand for a guided intake that turns a short questionnaire into a first Annex IV draft, one-time purchase, no subscription. It doesn't exist yet; we're building it if there's real demand.
Sources cited: EU AI Act Annex III and Annex IV, artificialintelligenceact.eu; Article 6 (classification and the Article 6(3)/6(4) exemption and documentation duty); Article 11 (technical documentation obligation); Regulation (EU) 2026/1744 (the Digital Omnibus on AI) for the revised high-risk deadlines, as reported by Gibson Dunn and Secure Privacy.