EU AI Act puts workplace tools in the high-risk tier

Regulation (EU) 2024/1689 regulates AI by use case rather than sector, with obligations tied to four risk tiers: banned, high-risk, limited and minimal. The rules apply beyond companies based in the EU when an AI system is placed on the EU market or its output is used in the EU.

Employment and worker-management systems are named as high-risk when AI is used for recruitment, selection, targeted job ads, application filtering, candidate evaluation, promotion, termination, task allocation, monitoring or performance assessment. Providers carry obligations around risk management, data governance, documentation, logging, transparency, oversight, robustness, conformity assessment and registration. Deployers must follow provider instructions, maintain oversight, monitor systems, keep logs, use relevant input data, inform affected workers where required and cooperate with authorities.

The 2026 Digital Omnibus pushed major high-risk deadlines back without removing the rules. Stand-alone high-risk systems, including employment AI, now apply from 2 December 2027, while high-risk AI embedded in regulated products applies from 2 August 2028. Bans, AI literacy duties and general-purpose AI rules already apply. Penalties can reach 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, with lower tiers for other breaches.