Annex III Categories
High-risk categories include: critical infrastructure, education/vocational training, employment/worker management, access to essential private services, law enforcement, migration/border control, administration of justice, biometric categorization.
CRM Intersection Points
Hiring AI in Workday/Dynamics integrated with CRM. Credit decisions triggered from CRM data. Customer service AI making access decisions. Employee-monitoring AI via HR/CRM integration. Most B2B sales CRM use cases are not Annex III; specific enterprise use cases are.
Compliance Essentials
Technical documentation of the AI system. Risk management system throughout lifecycle. High-quality training data with bias mitigation. Logging for traceability. Transparency to users. Human oversight. Accuracy, robustness, cybersecurity requirements.
Audit Readiness
Don’t wait for the first penalty case. Internal audit: what AI is deployed where, what category it falls under, what documentation exists. Remediate gaps before August 2, 2026. External audit post-deployment is part of the conformity regime.