An HR adviser at a housing association gets a message from the vendor of their recruitment system: a new feature ranks incoming applications by suitability. The same morning a colleague asks whether the chatbot she uses to write rejection letters now counts as "high-risk" as well, because she read something to that effect.
The first is high-risk, the second is not, and the difference has nothing to do with the technology. The AI Act calls an AI system high-risk when its intended purpose is listed in Annex III, or when it is a safety component in a product that already falls under European product rules. Ranking applications is in Annex III. Writing a letter is not.
What decides whether a system is high-risk?
Article 6 sets out two routes. The first runs through existing product legislation (Annex I): AI as a safety component in a machine, a lift or a medical device. That route only matters to manufacturers of such products.
The second route is Annex III: eight areas, each with specific purposes. If a system's intended purpose is on that list, it is high-risk. Everything turns on the word "intended": the provider sets out the intended purpose in its documentation, and the classification follows from that. A simple scoring model that sorts CVs is high-risk. A large language model that drafts a job advert is not.
Which applications affect an employer?
The eight areas are biometrics, critical infrastructure, education and training, employment, access to public benefits and to services such as credit and insurance, law enforcement, migration and border control, and the administration of justice. An ordinary employer runs into four of them.
| Area in Annex III | What falls under it, in plain language | Who runs into it |
|---|---|---|
| Employment (point 4) | Targeted job adverts, filtering applications, evaluating candidates; deciding on promotion, dismissal and task allocation based on behaviour or personal traits; monitoring and evaluating performance and behaviour | Every employer with a recruitment, rostering or appraisal system |
| Education and training (point 3) | Determining admission, assessing learning outcomes, determining the appropriate level, detecting prohibited behaviour during tests | Educational institutions, training departments that run tests |
| Benefits, credit and insurance (point 5) | Assessing eligibility for benefits and public services, determining creditworthiness, risk and pricing in life and health insurance, assessing emergency calls | Municipalities, benefit agencies, banks, insurers |
| Biometrics (point 1) | Remote biometric identification, categorisation by sensitive traits, emotion recognition | Organisations with access control or customer recognition |
Biometrics comes with a caveat: emotion recognition in the workplace and in education is not high-risk but prohibited (Article 5), except for medical or safety reasons. A tool that scores "enthusiasm" in a video interview is not something you put under oversight; you switch it off. What else the prohibited practices mean for employers is covered in the EU AI Act for employers.
Point 4 goes beyond recruitment. "Monitoring and evaluating performance and behaviour" also covers software that draws conclusions from the work data of individual employees: a rostering system that scores productivity, a tool that rates email behaviour. If a feature like that sits in a package you already use, you are using a high-risk system without ever having bought it as AI.
When is an Annex III application still not high-risk?
Article 6(3) contains an exception, and it is narrower than vendors tend to make it sound. A system listed in Annex III is not high-risk if it poses no significant risk to people's health, safety or fundamental rights, including by not materially influencing the outcome of a decision. That only applies in four situations:
- The system performs a narrow procedural task, such as turning unstructured data into a structured file.
- It improves the result of a human activity that has already been completed, such as the wording of an appraisal that has already been written.
- It detects patterns or deviations in earlier decisions, without replacing or influencing the human assessment without proper human review.
- It performs a preparatory task for an assessment, such as searching, indexing or translating.
Then comes the sentence that limits the exception: a system that profiles natural persons is always high-risk. Profiling has its GDPR meaning here: the automated evaluation of personal aspects of a person. A tool that scores candidates on their traits is profiling, so it never qualifies for the exception, however preparatory the vendor says the task is.
A provider that believes its system falls under paragraph 3 documents that assessment. As a deployer you can ask to see it, and the answer should amount to more than "we are not high-risk". The AI Act requires the European Commission to publish guidelines with practical examples of these exceptions; hold a vendor's assessment up against them.
So is ChatGPT for a job advert high-risk?
No. Writing, summarising and translating text is not in Annex III, and a general-purpose language model has no intended purpose that fits the list. What applies to that kind of use is the GDPR, the AI literacy duty in Article 4 and your own policy.
Two situations change that. An organisation that connects such a model to its applicant records and lets it decide who gets an interview has built a high-risk system and, under the AI Act, becomes its provider. The subtler case is the recruiter who asks a chatbot to rank fifty CVs: in the legal sense he is not using a high-risk system, because the system is not intended for that. But he is making a decision about people with a tool that was never assessed for the purpose, and that is where the GDPR and your policy come in. How that plays out in HR is covered in our article on using AI safely in HR.
Three questions tend to get mixed up here: what the system is (its classification, set by the provider), what you do with it (the use, which is yours) and who is responsible (for use within the organisation, always you). The vendor answers the first.
What does high-risk mean for you as a deployer?
The heavy obligations lie with the provider. For the organisation that uses the system, Article 26 has a shorter list: use it in line with the instructions, assign human oversight to people with the knowledge and authority to intervene, monitor how it operates and keep the logs, inform employees and their representatives in advance and use the provider's information for the DPIA. The guide to the AI Act for employers works through that list.
For Annex III systems those duties apply from 2 December 2027. That date comes from the Digital Omnibus on AI, which pushed back the original date of 2 August 2026; for AI in regulated products it is 2 August 2028. What has and has not moved is set out in the AI Act timeline after the Digital Omnibus.
What does that look like in practice?
Back to the housing association. HR switches the ranking feature off until it is clear who will provide the oversight and what the vendor has documented about how it works. The chatbot for rejection letters stays in use, with one rule added: no pasting in CVs for the chatbot to compare. Taking stock shows that besides Copilot, Perplexity, a transcription tool and a tool that pre-sorts tenant questions are also in use. None of them falls under Annex III; two still have no decision.
That is not an incident. It shows that the high-risk question concerns only a small part of AI use, and that you cannot ask it until you know which AI is being used. BeeSensible links a catalogue of AI tools to the use observed in the organisation: only the domain, at most once a day per device, without a user ID. Every tool in the catalogue carries an EU AI Act classification to help with a first sort; assessing how you actually use a tool remains up to the organisation, which sets the status of each tool itself. The AI tools page explains how that works.
