Banks and insurers
Credit scoring falls within Annex III. Fraud detection may not, depending on how it is used. In most environments that line runs somewhere through the same system.
What the audit examines here →
Production
A scheduling algorithm in SAP carries limited obligations. The same model used as a safety component moves into a different category.
What the audit examines here →
Transport and logistics
Optimising routes is one thing. Assessing how drivers drive is workforce management, and falls within Annex III if it feeds decisions about the people concerned.
What the audit examines here →
Recruitment
Ranking CVs falls within Annex III. That applies even where the software comes from a supplier: the obligations remain yours.
What the audit examines here →
Government
Deciding on access to services falls within Annex III. For public bodies, a fundamental rights impact assessment applies in certain cases.
What the audit examines here →
Hospitals
Emergency triage falls within Annex III. AI embedded in a medical device follows a different route, under the product safety regime, with obligations applying from 2 August 2028.
What the audit examines here →
Education
Admissions, assessment and exam proctoring fall within Annex III. The administration around them usually does not.
What the audit examines here →The legal qualification in every audit report is provided by the affiliated lawyers, acting in their own name and under their own professional indemnity insurance.