Is Your Lead Scoring High-Risk? An AI Act Walkthrough

Is your lead scoring high-risk under the EU AI Act? For most marketing and sales teams, the honest answer is no — routine lead scoring appears nowhere in Annex III’s eight high-risk domains. But the question deserves better than a shrug. The Digital Omnibus has just reset the Annex III compliance clock to December 2, 2027, the European Commission’s draft classification guidelines are already circulating, and one carve-out — profiling — has no exceptions at all.

The timing makes this walkthrough unusually easy to get wrong. A wave of coverage written earlier in 2026 assumed that Annex III high-risk obligations would become enforceable on August 2, 2026. That date moved — one week before this article’s publication — and much of what currently ranks for this topic still carries the old deadline. Meanwhile, obligations that genuinely did arrive on August 2 (Article 50 transparency) and duties that have applied for years (GDPR profiling rules) get conflated with the high-risk regime that is still sixteen months out.

This guide walks the actual classification logic for the systems SMBs and mid-market teams really run — lead scoring, churn prediction, credit-adjacent gating, and hiring screens. Which land in Annex III, which escape through the Article 6(3) filter, why profiling overrides that filter, what already applies today, and what the sixteen-month preparation window is actually for.

Start with the correction, because everything else depends on it. Under the AI Act as adopted in 2024, the obligations for stand-alone high-risk systems listed in Annex III were scheduled to apply from August 2, 2026. The Digital Omnibus on AI changed that: political agreement on May 6–7, 2026, a European Parliament vote on June 16 (423 for, 57 against, 174 abstentions), the Council’s final green light on June 29, publication in the Official Journal as Regulation (EU) 2026/1744 on July 24, and entry into force on July 27, 2026 — one week before this article’s publication date.

The substance of the deferral, per the client alerts from Gibson Dunn and Hunton Andrews Kurth: Annex III high-risk obligations now apply from December 2, 2027 — a sixteen-month deferral — and Annex I high-risk systems embedded in regulated products moved from August 2027 to August 2, 2028.

Two other layers of the Act were untouched by the deferral and are worth keeping straight. The Article 5 prohibited practices — the outright bans — have applied since February 2025, with a further tranche of additions (covering non-consensual intimate imagery and related material) operating on a transitional window that runs to December 2, 2026. And the general governance provisions that took effect on August 2, 2026 arrived on schedule. The deferral is specific: it is the Annex III high-risk regime — the documentation, risk management, and oversight duties — that now binds from December 2027, not the Act as a whole.

Annex III enumerates eight domains in which stand-alone AI systems are classified high-risk: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services; law enforcement; migration, asylum, and border control; and the administration of justice and democratic processes.

Read the list twice and note what is absent: marketing and sales lead scoring, churn prediction, and engagement scoring appear nowhere in it. They are not employment, not credit, not insurance, not public benefits, not biometrics, not law enforcement. On our reading of the Annex text, routine commercial scoring is generally not an Annex III system at all — though this is a reasoned inference from the text rather than a citable Commission statement, because the Commission’s draft guidelines stop short of a marketing-specific example. Our risk-tier compliance checklist covers the full four-tier triage; this walkthrough stays on the classification question.

Four Annex III points sit close enough to CRM territory that scoring teams should know them by number. These are the boundaries a scoring system can drift across:

Two further points complete the essential-services picture: point 5(a) covers AI used by or on behalf of public authorities to evaluate eligibility for essential public benefits — including healthcare — and to grant, reduce, revoke, or reclaim them; point 5(d) covers triage of emergency calls and dispatch of first responders. Neither is CRM territory in the ordinary case, but 5(a) matters if your scoring stack ever serves a public-sector client’s eligibility workflow.

Landing inside an Annex III domain is not the end of the analysis. Article 6(3) provides a filter: paraphrasing the operative text, a system that falls within an Annex III use case is nevertheless not high-risk where it does not pose a significant risk of harm to health, safety, or fundamental rights and it meets one of four conditions. In plain English, the four escape routes are:

• Narrow procedural task. The system performs a narrow, procedural step rather than the substantive assessment itself.
• Improving completed human work. The system improves the result of an activity a human has already completed.
• Pattern detection without influence. The system detects decision-making patterns or deviations from them without replacing or influencing the prior human assessment — subject to proper human review.
• Preparatory task. The system performs a task that is merely preparatory to an Annex III-relevant assessment.

The proviso attached to all four: the system must not materially influence the outcome of decision-making in a way that could adversely affect individuals. A “preparatory” score that a human rubber-stamps in practice is not preparatory in substance.

Here is the mechanism most coverage skips, and the one that makes this walkthrough non-trivial. The final subparagraph of Article 6(3) removes all four escape routes for one class of system: an Annex III-domain system that performs profiling of natural persons is always high-risk. The Commission’s draft classification guidelines — published on May 19, 2026 with a targeted stakeholder consultation — restate the point explicitly: as summarized in DLA Piper’s analysis, the filter mechanism does not apply to Annex III systems that profile natural persons, and no Article 6(3) exception can rescue them.

What counts as profiling comes from the GDPR. Article 4(4) defines it, in essence, as any automated processing of personal data used to evaluate personal aspects of a natural person — in particular to analyse or predict things like performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, or location. Measure a standard lead-scoring model against that definition: it ingests personal data to predict a person’s economic situation (budget, buying power), interests (intent signals), reliability, and behaviour (engagement propensity). On its face, ordinary lead scoring meets the GDPR definition of profiling. That chain — our own reading of how the two regimes interact, not a Commission or law-firm statement — is exactly why the classification question has teeth.

Note the gap the draft guidelines leave open. Their worked examples concentrate on employment — HR tools that filter, score, or rank candidates — and on credit scoring. Marketing-adjacent scoring is left in an interpretive space the Commission has not yet filled. That gap is why the next section exists: nobody has published the mapping for the systems CRM teams actually run, so we built it.

This table is ours, not the Commission’s. It maps the four scoring systems SMBs most commonly run against the three-step logic above — Annex III domain, GDPR profiling status, Article 6(3) filter availability — and states the practical outcome plus the one design choice that flips each row. The cells are built from the Annex III text, Article 6, and the GDPR Article 4(4) profiling definition; the outcome column follows mechanically from the three tests before it.

The pattern worth internalizing: the first two rows and the last two rows fail in opposite directions. Lead scoring and churn prediction are safe on the AI Act axis but carry unexamined GDPR profiling exposure that most teams have never documented. Credit gating and hiring screens feel like natural CRM extensions — a checkout that pre-qualifies financing, a pipeline that doubles as a recruiting funnel — but each one crosses into a named Annex III point, and the profiling override guarantees there is no filter escape.

The December 2027 clock covers the Annex III high-risk regime only. Two sets of obligations bind scoring systems today, and conflating them with the deferred regime is the second-most-common error in current coverage.

Article 50 transparency, live since August 2, 2026. If your CRM stack puts a chatbot in front of customers, generates synthetic content, or runs emotion-recognition features, the disclosure duties apply now — people must be told they are interacting with AI, and synthetic content must be identifiable as such. The watermarking sub-requirement carries a four-month grace window for systems already on the market; the rest arrived on schedule.

GDPR, already live. If lead scoring meets the Article 4(4) profiling definition — and on its face it typically does — then the GDPR’s profiling obligations apply regardless of what the AI Act says. Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects — subject to three narrow exceptions (contract necessity, member-state law, explicit consent), each of which requires safeguards including a route to human review. A scoring system that silently disqualifies people from an offer with no human in the loop is a GDPR question in 2026, not a 2027 one. For teams outside the EU wondering whether any of this reaches them, our guide to what US businesses must do now covers the extraterritorial mechanics.

Keep the two regimes separate in your documentation. “Not Annex III high-risk” and “not GDPR profiling” are different verdicts reached by different tests — most lead-scoring systems will honestly earn the first and fail the second, and collapsing them into one “we’re fine” is how classification memos go wrong.

The fine architecture is set by Article 99, in three tiers — each ceiling the higher of a fixed sum or a share of global annual turnover. None of the analyses we reviewed reported the Digital Omnibus changing these ceilings, but given that the Omnibus just moved the application dates themselves, verify the current consolidated text before building budget models on any figure here.

Notice where scoring systems sit in that structure. A misclassified high-risk system that misses its December 2027 obligations falls in tier 2 — as do Article 50 transparency breaches that are enforceable already. The tier-3 line deserves more attention than it gets: supplying incorrect, incomplete, or misleading information to authorities carries its own ceiling, which is precisely why a sloppy classification memo is worse than an honest open question. Who actually levies these fines — the AI Office versus national market-surveillance authorities — and how the complaint machinery works is its own topic; our companion piece on who enforces the AI Act and what its penalty powers look like covers the enforcement architecture in depth.

If a system in your stack does classify high-risk, the duty set that binds from December 2027 is substantial. For providers — the party that builds the system — the compliance guides tracking the Act converge on four pillars: technical documentation to the Annex IV standard (system description, architecture, data governance, risk management), a documented risk-management system under Article 9, CE marking, and registration in the EU database. For deployers — the party that uses it — effective human-oversight procedures, log-retention obligations, notifying affected individuals where required, and, for public-sector deployers, fundamental-rights impact assessments. If you build scoring in-house, you may hold both roles at once.

Salesforce publishes a dedicated EU AI Act resource hub framing readiness as a shared responsibility between vendor (as provider of AI features) and customer (as deployer) — a framing that is vendor-stated marketing, not independent verification, but whose provider/deployer split is the right mental model. Whatever platform runs your scoring, the deployer-side homework — what data goes in, what decisions come out, who reviews them — stays yours.

Where does this go next? Expect the Commission to finalize the classification guidelines with the marketing gap still only partially addressed — the draft’s worked examples stayed on employment and credit, and nothing signals a marketing example is coming. That leaves scoring teams carrying the interpretive load themselves through 2027, which is an argument for writing the classification memo against the primary text now and revisiting it when the final guidelines land. Expect, too, that the boundary cases multiply: as scoring models absorb more data and gate more decisions, systems built as marketing tools will drift toward the credit and employment lines. The teams that documented their classification logic will adapt with an edit; the teams that never wrote it down will re-litigate from scratch.

The mechanics of building scoring systems that keep these boundaries clean is its own discipline — scoped data inputs, explainable weights, human checkpoints where scores touch decisions. Our guides to building an AI lead-scoring agent and the lead-scoring workflow cover the build side; our bias-audit compliance guide for small business covers the adjacent US obligations. And if you want the classification memo, the scoring build, and the documentation produced as one engagement, that is exactly what our CRM & automation practice does.