The EU AI Act classifies AI systems by risk level. Annex III defines the categories of AI systems considered high-risk — systems that require the most rigorous compliance obligations before deployment in the European Union.
Autonomous AI agents operating in finance, trading, compliance, and regulated infrastructure frequently fall under one or more Annex III categories. This guide explains what qualifies, what compliance requires, and how Kakunin addresses each obligation.
Article 6 of the EU AI Act establishes that AI systems listed in Annex III are automatically classified as high-risk. This classification is independent of how the system is deployed — the category is based on the purpose and domain of use.
Annex III contains eight categories:
| No. | Category | Examples |
|---|---|---|
| 1 | Biometrics | Facial recognition for identification, emotion recognition |
| 2 | Critical infrastructure | Traffic management, energy supply, water systems |
| 3 | Education | Student assessment, admission decision systems |
| 4 | Employment | CV screening, job application ranking, performance monitoring |
| 5 | Access to essential services | Credit scoring, insurance risk, housing applications |
| 6 | Law enforcement | Profiling, polygraphs, crime prediction |
| 7 | Migration and border control | Asylum processing, document verification |
| 8 | Justice and democratic processes | Court decision support, electoral material distribution |
For regulated AI agents in finance, Category 5 (access to essential services) is the primary concern — specifically credit assessment, insurance risk evaluation, and algorithmic trading systems that affect market access.
The EU AI Act's Annex III, point 5(b) covers AI systems used to evaluate creditworthiness, make or influence decisions about access to financial products, and assess insurance risk.
Algorithmic trading agents that allocate capital, extend credit, determine pricing, or assess counterparty risk fall under this category.
Articles 9 through 15 set out the substantive requirements for Annex III systems.
Operators must establish, implement, document, and maintain a risk management system throughout the AI system's lifecycle.
Required elements:
Agent implementation:
// Kakunin risk management record — maintained per agent
const riskManagementRecord = {
agent_id: agentId,
intended_use: 'algorithmic_fx_trading',
foreseeable_misuse: [
'prompt_injection leading to unauthorised trades',
'scope escalation via crafted counterparty data',
'baseline drift accumulating over extended period',
],
residual_risks: [
{
risk: 'model hallucination producing invalid trade parameters',
mitigation: 'scope policy enforced at certificate layer independent of LLM output',
residual: 'low',
},
{
risk: 'compromised container accessing KMS',
mitigation: 'KMS key policy restricts access to specific IAM role; no key material in container',
residual: 'low',
},
],
last_reviewed: new Date().toISOString(),
reviewed_by: 'compliance@firm.com',
};Training, validation, and testing data must meet specific quality criteria:
For agents, this extends to the behavioural baseline — the behavioural profile used for anomaly detection must be representative of normal operating conditions and reviewed for bias.
// Baseline data governance documentation
const baselineDocumentation = await kakunin.monitoring.getBaselineReport(agentId, {
include: ['data_sources', 'sample_size', 'temporal_coverage', 'exclusions', 'bias_assessment'],
});Before deployment, operators must prepare technical documentation demonstrating compliance. Documentation must include:
Kakunin generates an Article 11 technical documentation package on demand:
const technicalDocs = await kakunin.compliance.generateArticle11Package(agentId);
// technicalDocs contains:
// - agent_registration_record.json (identity, purpose, operator)
// - certificate_specification.json (scope policy, validity, CA chain)
// - risk_management_summary.pdf (from Article 9 records)
// - baseline_data_report.pdf (from Article 10 records)
// - monitoring_architecture.pdf (anomaly detection methodology)
// - human_oversight_procedures.pdf (pre-revocation warning → human review flow)
// - audit_log_extract.jsonl (sample of logged events with signatures)High-risk AI systems must automatically log events throughout operation. Logs must:
Kakunin's implementation:
Every agent action is written to an append-only (WORM) audit log. No application-layer code can modify or delete entries:
-- Enforced at PostgreSQL rule level — cannot be bypassed by application code
CREATE RULE audit_log_no_update AS ON UPDATE TO audit_log DO INSTEAD NOTHING;
CREATE RULE audit_log_no_delete AS ON DELETE TO audit_log DO INSTEAD NOTHING;Each record contains:
event_type — what happenedactor_id — which agentaffected_id — which resource was affectedmetadata — full event payload including risk score, signature, anomaly detailscreated_at — UTC timestampRetention: 5 years (aligned with MiCA and MIFID II record-keeping requirements).
High-risk AI systems must be designed to be sufficiently transparent for operators to interpret outputs and use the system appropriately. Instructions for use must include:
For agent operators:
// Kakunin exposes a machine-readable capability card (MCP-compatible)
const agentCard = await kakunin.agents.getCapabilityCard(agentId);
// agentCard includes:
// - provider identity (Kakunin + operator)
// - agent purpose and permitted actions
// - scope limits (from certificate)
// - known limitations (e.g., no weekend trading; EUR/USD markets only)
// - oversight contacts
// - certificate validity and renewal date
// - anomaly detection methodology and thresholdsThis feeds directly into the /.well-known/agent.json endpoint consumed by agent discovery protocols.
Operators must ensure humans can:
Kakunin's human oversight architecture:
Anomaly Score >= 0.75
│
▼
Pre-Revocation Warning (webhook + notification)
│
├── Human reviews within grace period (300s default)
│ │
│ ├── ACKs → monitoring continues, score logged
│ └── No ACK → automatic revocation triggered
│
└── Score >= 0.85 → Automatic revocation (no human required)
Agent halts; replacement spinup queuedHuman oversight is available at multiple levels:
POST /api/v1/agents/{id}/revoke with audit trail entryHigh-risk AI systems must achieve appropriate levels of accuracy, be resilient against errors and third-party attacks, and maintain consistent performance.
Cybersecurity requirements explicitly include:
Controls:
| Threat | Mitigation |
|---|---|
| Model evasion | Scope policy enforced at certificate layer independent of LLM |
| Data poisoning | Baseline approved by compliance officer; statistical outlier rejection |
| Input confidentiality | Encrypted in transit (TLS 1.3); inputs not stored beyond audit log |
| Prompt injection | Tool guard wraps every tool call; validates against scope before execution |
Before placing a high-risk AI system on the EU market, operators must complete a conformity assessment. For Annex III systems not in the law enforcement or biometrics categories, self-assessment is permitted (no third-party notified body required).
Kakunin's compliance report provides the artefacts needed for self-assessment:
const conformityAssessment = await kakunin.compliance.generateConformityPackage(agentId);
// Package structure:
// 1. Technical documentation (Article 11)
// 2. Risk management records (Article 9)
// 3. QMS evidence (Article 17) — if provider obligations apply
// 4. Human oversight procedures (Article 14)
// 5. Cybersecurity controls evidence (Article 15)
// 6. Audit log samples (Article 12)
// 7. EU Declaration of Conformity templateAfter conformity assessment, high-risk AI systems must:
Kakunin generates the registration data package required by Article 49 and the EU AI Act database entry format.
Article 72 requires providers to have a post-market monitoring system that:
Reporting obligations:
Kakunin sends automated incident notifications when:
Non-compliance with Annex III obligations carries significant penalties under Article 99:
| Violation | Maximum Fine |
|---|---|
| Prohibited AI system or non-compliance with Annex III obligations | €35M or 7% of global annual turnover |
| Other obligations (transparency, record-keeping, oversight) | €15M or 3% of global annual turnover |
| Providing incorrect information to authorities | €7.5M or 1% of global annual turnover |
For SMEs and startups, lower of the absolute amount or the turnover percentage applies.
Before deploying an Annex III agent: