An HR adviser at a housing association receives a message from the vendor of the recruitment system: there is a new feature that ranks incoming applications by suitability. The same morning a colleague asks whether the chatbot she uses to write rejection letters now also counts as "high-risk", because she read that somewhere.
The first is high-risk, the second is not, and the difference is not in the technology. The AI Act calls an AI system high-risk when its intended purpose is listed in Annex III, or when it is a safety component in a product that already falls under European product rules. Ranking applications is in Annex III. Writing a letter is not.
What decides whether a system is high-risk?
Article 6 gives two routes. The first runs through existing product legislation (Annex I): AI as a safety component in a machine, a lift or a medical device. That route only matters for those who make such products.
The second route is Annex III: eight areas, each with concrete purposes. If the purpose a system is intended for is on that list, it is high-risk. The word that carries everything is "intended": the provider lays down the intended purpose in the documentation, and the classification hangs on that. A simple scoring model that sorts CVs is high-risk. A large language model that drafts a job advert is not.
Which applications touch an employer?
The eight areas are biometrics, critical infrastructure, education and training, employment, access to public benefits and to services such as credit and insurance, law enforcement, migration and border control, and the administration of justice. An ordinary employer runs into four of them.
| Area in Annex III | What falls under it, in plain language | Who runs into it |
|---|---|---|
| Employment (point 4) | Targeted job adverts, filtering applications, evaluating candidates; deciding on promotion, dismissal and task allocation based on behaviour or personal traits; monitoring and evaluating performance and behaviour | Every employer with a recruitment, rostering or appraisal system |
| Education and training (point 3) | Determining admission, assessing learning outcomes, determining the appropriate level, detecting prohibited behaviour during tests | Educational institutions, training departments with testing |
| Benefits, credit and insurance (point 5) | Assessing eligibility for benefits and public services, determining creditworthiness, risk and pricing in life and health insurance, assessing emergency calls | Municipalities, benefit agencies, banks, insurers |
| Biometrics (point 1) | Remote biometric identification, categorisation by sensitive traits, emotion recognition | Organisations with access control or customer recognition |
Biometrics comes with a caveat: emotion recognition in the workplace and in education is not high-risk but prohibited (Article 5), except for medical or safety reasons. A tool that scores "enthusiasm" in a video interview is not something you put under oversight; you switch it off. What the prohibited practices otherwise mean for employers is in the EU AI Act for employers.
Point 4 is wider than recruitment. "Monitoring and evaluating performance and behaviour" also covers software that derives a judgement from the work data of individual employees: a rostering system that scores productivity, a tool that rates email behaviour. Anyone with such a feature sitting in an existing package is using a high-risk system without having bought it as AI.
When is an Annex III application still not high-risk?
Article 6(3) holds an exception, and it is narrower than it tends to sound in vendor conversations. A system from Annex III is not high-risk if it poses no significant risk to people's health, safety or fundamental rights, including by not materially influencing the outcome of a decision. That only applies in four situations:
- The system performs a narrow procedural task, such as turning unstructured data into a structured file.
- It improves the result of a human activity that has already been completed, such as the language of an appraisal already written.
- It detects patterns or deviations in earlier decisions, without replacing or influencing the human assessment without proper human review.
- It performs a preparatory task for an assessment, such as searching, indexing or translating.
And then the sentence that bounds the exception: a system that profiles natural persons is always high-risk. Profiling is the automated evaluation of personal aspects of a person, in the GDPR sense. A tool that gives candidates a score based on their traits profiles, and therefore never falls under the exception, however preparatory the vendor calls the task.
A provider who believes its system falls under paragraph 3 documents that assessment. As a deployer you may ask for it, and the answer should amount to more than "we are not high-risk". The AI Act instructs the European Commission to publish guidelines with practical examples for these exceptions; compare a vendor's assessment with those examples.
So is ChatGPT for a job advert high-risk?
No. Writing, summarising and translating text is not in Annex III, and a general-purpose language model has no intended purpose that fits the list. For that use the GDPR, the AI literacy duty from Article 4 and your own policy apply.
It changes in two ways. An organisation that connects such a model to its applicant records and lets it decide who gets an interview has built a high-risk system and, under the AI Act, becomes its provider. More subtle is the recruiter who has a chatbot rank fifty CVs: in the legal sense he is not using a high-risk system, because the system is not intended for that. But he is taking a decision about people with a tool that was never assessed for it, and there the GDPR and the policy apply. How that plays out in HR is in using AI safely in HR.
Three questions run into each other here: what is the system (the classification, by the provider), what do you do with it (the use, yours), and who is responsible (for use in the organisation, always you). The vendor answers the first.
What does high-risk mean for you as a deployer?
The heavy duties sit with the provider. For the organisation that uses the system, Article 26 has a shorter list: use it according to the instructions, assign human oversight to people with the knowledge and the authority to intervene, monitor its operation and keep logs, inform employees and their representatives in advance, and use the provider's information for the DPIA. The pillar on the AI Act for employers works that list out.
For Annex III systems those duties apply from 2 December 2027. That date comes from the Digital Omnibus on AI, which moved the original date of 2 August 2026; for AI in regulated products it is 2 August 2028. What did and did not move is in the AI Act timeline after the Digital Omnibus.
What does that look like in practice?
Back to the housing association. HR switches the ranking feature off until it is clear who does the oversight and what the vendor has documented about how it works. The chatbot for rejection letters stays in use, with one agreement added: no pasting in CVs to have them compared. When taking stock, it turns out that besides Copilot, Perplexity, a transcription tool and a tool that pre-sorts tenant questions are also in use. None of them is in Annex III; two have no decision yet.
That is not an incident. It shows that the high-risk question touches a small part of AI use, and that you can only ask it once you know which AI is in use. BeeSensible links a catalogue of AI tools to the use observed in the organisation: only the domain, at most once a day per device, without a user ID. Every tool in the catalogue carries an EU AI Act indication as a help with the first sorting; the assessment of your concrete use stays with the organisation, which sets the status per tool itself in the AI Tools module.
