Between 2016 and 2019, almost all asylum seekers who managed to reach the Greek islands in the North Aegean Sea had to undergo an assessment of their vulnerability within the EU hotspot system. Those who were found vulnerable were exempted from return under the EU-Turkey Agreement and were free to leave for the Greek mainland. This article provides a detailed account of the vulnerability procedure, which classifies migrants through pre-established categories on account of externally distinguishable features rather than individual experiences. As is shown, this type of group-based management of refugees preceded the Refugee Convention, but has since the 1960s primarily been applied in the Global South. The use of this procedure in Europe reflects an exception from the European individualist human rights approach. In the context of EU hotspots, the vulnerability procedure provides a pathway to exemption from externalisation, for those who can live up to its requirements of documentable hardship.