Appendix: Applying the Article 6(3)(a) and (d) criteria to illustrative examples

Job applicant data extraction#s. 53

Case The AI system extracts structured data fields from CVs and cover letters: names, contact details, educational qualifications, dates of employment, certifications, and language proficiencies.

Conclusion The system satisfies all six criteria and qualifies for both Article 6(3) carve-out (a) and (d).

Score candidates against clear, rules-based criteria#s. 54

Case The AI system assigns numerical scores to candidates based on transparent, predefined criteria: for example, awarding points for each year of relevant work experience, for specific educational degrees, and for listed language proficiencies. The scoring formula is crafted by natural persons, documented, fixed, and deterministic.

Conclusion The Article 6(3) carve-outs do not apply. The fact that the scoring formula is transparent and rule-based does not change its characterisation as profiling in the context of Article 6(3): The relevant question under the profiling override is not whether the evaluation is sophisticated or opaque, but whether it constitutes an automated evaluation of personal aspects – which it plainly does. It might seem counterintuitive that such clear, rules-based processing should not be covered by a derogation. This use case could in fact be covered by another AI Act “safety valve”, that of the definition of “AI system” in itself: Recital (12) specifies that the notion of “AI system” should not cover systems “that are based on the rules defined solely by natural persons to automatically execute operations”. In other words, such scoring tasks can be automated outside the scope of the AI Act by assigning them to separate systems without machine learning components or other features covered by the “AI system” definition.

Score candidates against ambiguously defined criteria#s. 55

Case The AI system evaluates candidates against soft criteria such as “leadership potential,” “cultural fit,” or “communication skills,” producing a qualitative or numerical assessment.

The analysis is identical to the previous sub-task in its engagement of the profiling override, but the additional ambiguity of the criteria compounds the concerns at every subsequent level. Even setting aside the profiling threshold, the task fails at Criterion 3 (the operation is semantic, requiring evaluative judgment about the person), Criterion 4 (the output bears directly on the substance of the hiring decision), Criterion 5 (the output is opaque – the basis for a “cultural fit” score cannot meaningfully be verified by the human assessor), and Criterion 6 (an evaluative score on ambiguous criteria is maximally susceptible to automation bias). Likewise, as such soft criteria are all but impossible to capture in formal rules designed solely by natural persons, the above-mentioned “AI system”-definition escape is closed.

Create a final ranking of candidates#s. 56

Case The AI system produces a ranked list of candidates for the recruiter’s consideration.

This is the composite output of the preceding scoring stages. Whether the ranking is based on rule-based scores, ambiguous criteria, or a combination, the system evaluates personal aspects of natural persons and produces an output that directly structures the hiring decision. The profiling override applies. Even if the profiling override were not applicable, the system would fail at Criterion 3 (the ranking involves semantic evaluation of candidates’ suitability), Criterion 4 (the ranking bears on the substance of the hiring decision by directing the recruiter’s attention), and Criterion 6 (a relevance ranking is precisely the kind of output that invites uncritical reliance).

Observations from applying the criteria to the recruitment workflow#s. 56

The recruitment workflow example demonstrates a characteristic gradient: the earliest stages (data extraction) are genuinely procedural or preparatory and may qualify for a carve-out, while each successive stage introduces evaluative elements that move the system further from the procedural or preparatory domain and into the territory of substantive assessment. The example also illustrates the importance of the profiling override as a decisive threshold: the moment an AI system begins evaluating the suitability, qualifications, or personal characteristics of candidates – even through transparent, rule-based criteria – it constitutes profiling and is categorically high-risk.106

Transcribe audio recordings to text#s. 56

Case An AI system converts the audio recording of a medical consultation into a written transcript.

Conclusion The Article 6(3)(d) carve-out applies, provided that the original audio remains accessible for verification. This is analogous to the document translation example above.

Classify speakers (doctor, patient(s))#s. 58

Case The AI system identifies and labels which portions of the transcript were spoken by the doctor and which by the patient(s).

Conclusion While the degree of semantic processing is larger than for the transcription subtask, the Article 6(3)(d) carve-out still applies, again provided that the original audio remains accessible for verification.

Classify message content (symptoms, diagnoses, medical advice, prescription references)#s. 59

Case The AI system assigns semantic labels to segments of the transcript, categorising statements as descriptions of symptoms, diagnostic conclusions, therapeutic advice, medication references, and so on.

Conclusion The task is clearly not procedural and challenges the boundaries of the Article 6(3)(d) “preparatory” derogation. Still, given sufficiently high-level classification categories (“symptom”, “diagnosis”, “medication”) and responsible users, an assessment of no significant risk of harm is defensible. On the other hand, a system performing more detailed classification (“symptom of X”, “diagnosis of illness Y”, “recommendation of medication Z”) would fail multiple criteria, including the initial “profiling” filter.

Remove non-relevant content (e.g. interruptions, off-topic discussion)#s. 60

Case The AI system identifies and removes portions of the transcript deemed irrelevant to the medical record – social pleasantries, interruptions, digressions about unrelated topics.

Conclusion Article 6(3) carve-outs do not apply. Selective removal of content from a draft medical record is an editorial function that bears on the substance of the medical documentation and, by extension, of the assessments based on it.

Score confidence of classifications to prioritise human review#s. 61

Case The AI system assigns a confidence score to each of its classifications (from sub-tasks above) and uses these scores to flag portions of the journal for priority human review.

This sub-task has a dual character. On one hand, the confidence scoring is a meta-operation on the system’s own outputs – not a direct evaluation of the patient, or the medical content of transcribed statements. On the other hand, the practical effect of the confidence scoring is to direct the physician’s attention: high-confidence classifications may receive cursory review, while low-confidence classifications are flagged for closer scrutiny. This attention-directing function engages Criterion 6: the confidence score creates a cognitive shortcut that incentivises the physician to defer to the system’s own assessment of which parts of the journal require careful review. The system is telling the human overseer where to look – and, implicitly, where not to look. This is precisely the kind of cognitive pre-structuring that the Article 14 safeguards are designed to counteract.108

Conclusion Article 6(3) carve-outs do not apply. The confidence scoring directs the human assessor’s attention in a manner that bears on the quality and thoroughness of the medical review.

Observations from applying the criteria to the clinical documentation workflow#s. 62

The speaker-labelling and statement-classification subtasks illustrate that an AI system may perform semantically rich operations and still qualify under Article 6(3)(d), provided that the task remains genuinely preparatory and does not steer the subsequent medical assessment. By contrast, the confidence-scoring subtask shows the boundary of that conclusion. A system that labels speakers or statement types without confidence scores may remain within the carve-out, while a system returning the same labels with confidence scores may fall outside it, because the scores direct the physician’s attention and invite reliance on the system’s own assessment of reliability. The result is counterintuitive: providing the physician more information shifts the system into a higher risk category. In my view, de lege lata the distinction is defensible. Article 6(3) is concerned not with the volume of information an AI system produces, but with whether the form of that information meaningfully shifts cognitive effort from the human assessor to the system. A bare classification leaves the assessor in the position of judging whether to trust each label on its own evidentiary footing; a confidence-scored classification invites the assessor to partially delegate that judgment to the system. The Article 14 design requirements are calibrated to the latter case, and so is the high-risk regime as a whole. The de lege ferenda question of whether providers should be incentivised differently, for example, by allowing a graduated regime that admits transparent confidence reporting under stricter human-oversight conditions, is taken up in Section 5.4.