Article
Is your HR software high-risk under the EU AI Act?
Very few employers buy something called a "high-risk AI system". They buy an applicant tracking system, a rota tool or a performance platform, and an update adds a feature that ranks, scores or allocates. Under the EU AI Act, that feature can be high-risk on its own.
What Annex III lists for employment
Annex III, point 4, is headed "Employment, workers' management and access to self-employment". It lists two groups. The verified wording.
| Point | Systems intended to be used to |
|---|---|
| 4(a) | Recruit or select people, in particular to place targeted job adverts, analyse and filter applications, and evaluate candidates |
| 4(b) | Make decisions affecting terms of work relationships, promotion or termination; allocate tasks based on individual behaviour or personal traits; monitor and evaluate performance and behaviour |
A CV filter, an interview scoring feature, a shift allocator that weighs who worked last weekend, and a dashboard that rates staff on activity data all sit plainly inside that list.
The exception, and why it is narrow
A system in an Annex III area is not high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making. That only works where at least one of four conditions holds: the system performs a narrow procedural task, improves the result of a human activity already completed, detects patterns or deviations without replacing or influencing the human assessment without proper review, or performs a preparatory task to an assessment. How classification works.
So a tool that only converts CVs to a common format may fall under the exception. A tool that orders candidates by predicted fit does not.
From when
The high-risk rules for Annex III systems apply from 2 December 2027, under the dates as amended in 2026. Some duties already apply today, including AI literacy and the ban on inferring emotions at work. The full timeline.
What an employer owes once it is high-risk
The employer is the deployer. Among the duties in Article 26: use and monitor the system according to its instructions, put oversight in the hands of people with competence, training and authority, inform workers' representatives and affected workers before using it at the workplace, and inform the people it makes or helps make decisions about. A person affected by such a decision can ask for a clear and meaningful explanation of the role the system played. Deployer duties.
Where this fits
The AI Act at Work starts where this article stops: trace one process, find every place a system ranks, scores or allocates, write each use down once, and put a person with time and authority in front of each output. It comes with the register, the supplier letter, the oversight log and the two notices as forms.