High-Risk AI Under the EU AI Act: What Annex III Section 8 Means for Law Firms Deploying Legal AI Tools

Why Annex III Section 8 Matters for Your Law Firm — Not Just for Courts

A persistent misconception among legal practitioners is that the EU AI Act's high-risk classification for "administration of justice" under Annex III Section 8 applies only to courts, tribunals, and public judicial bodies. That reading is incorrect — and potentially costly. The regulation defines high-risk status by the function an AI system performs, not by the institutional identity of the entity deploying it. A law firm using an AI tool to analyze case law, evaluate evidence, or assist in settlement negotiations is deploying a system that falls squarely within the same risk classification as a court using that identical tool.

This functional-risk principle means that the growing portfolio of legal AI tools — from research platforms to document analysis engines to alternative dispute resolution software — triggers a set of compliance obligations for the firms that deploy them. The obligations are not trivial, and the preparation window is closing faster than most firms realize.

According to analysis by Pinsent Masons, AI systems "intended to be used by courts or another dispute resolution body to research and interpret facts and the law, or to apply the law to a concrete set of facts" are listed as potential high-risk under Annex III. The critical phrase is "intended to be used" — the classification attaches to the system's design purpose, not the user's institutional status. A contract analysis tool marketed to law firms for litigation strategy work is captured by the same provision as a system sold to a national court.

Which Legal AI Systems Are Captured Under Annex III Section 8?

Annex III Section 8 identifies three specific categories of AI systems in the administration of justice and democratic processes domain. Each category maps directly to tools currently marketed to and used by law firms.

• Systems for researching and interpreting facts and the law. This covers AI legal research platforms that retrieve, summarize, and analyze case law, statutes, and regulatory materials. When a tool goes beyond simple keyword search and provides interpretive analysis — ranking authorities, suggesting arguments, or flagging inconsistencies — it enters the high-risk zone.
• Systems for applying the law to a concrete set of facts. This captures AI tools used in case assessment, litigation strategy, and document analysis where the system evaluates evidence against legal standards. Examples include AI that predicts case outcomes based on factual inputs, tools that assess settlement ranges, and systems that evaluate contract terms against regulatory requirements.
• Systems used in alternative dispute resolution. This extends the high-risk classification to AI-assisted mediation, arbitration, and negotiation platforms. Any tool that analyzes party positions, suggests resolution terms, or evaluates the likely outcome of a dispute falls under this category.

The breadth of this classification is significant. A firm using an AI tool to conduct due diligence on a cross-border transaction — where the tool interprets regulatory requirements and flags compliance gaps — is deploying a high-risk system under the first two categories simultaneously. An AI-assisted mediation platform used in family law or commercial disputes is captured under the third.

The Provider vs. Deployer Distinction: What It Means for Your Firm

The EU AI Act creates a layered compliance architecture with distinct obligations for providers (the developers who place AI systems on the market) and deployers (the organizations that use those systems in practice). For law firms, understanding this distinction is essential because it determines which obligations are the vendor's responsibility and which fall directly on the firm.