Which AI systems in HR count as high-risk under Annex III

Of every department in a company, HR is the one most likely to be using an AI system classified as high-risk, and the one least likely to know it. Not because the tool is especially sophisticated, but because Annex III of the Regulation focuses precisely there: on decisions that affect a person's employment.

What Annex III says about employment

Point 4 of Annex III classifies as high-risk AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter applications, and to evaluate candidates. It adds a second block: systems intended to make decisions affecting the terms of work-related relationships, the promotion or termination of contracts, to allocate tasks based on behaviour or personal traits, or to monitor and evaluate performance and conduct.

In other words: no exotic system is required. An automated CV filter, a tool that scores interviews, an algorithm that assigns shifts based on historical productivity, or a panel evaluating annual performance all fall under this category once they play a significant part in the decision.

What the high-risk label adds

Being the deployer of a high-risk system does not only change how Article 4 applies to you: it adds the specific obligations of Article 26, worth knowing before signing any contract with a supplier.

• Use in accordance with the provider's instructions, and verification that input data is relevant and sufficiently representative for the system's purpose.
• Human oversight by people with the necessary competence, training and authority, and the genuine ability to override a decision made by the system.
• Retention of the logs automatically generated by the system for at least six months.
• Informing workers' representatives and affected individuals that they will be subject to a high-risk system, before it is put into service.
• Notifying the provider and the market surveillance authority if a serious risk is identified, and suspending use while it is investigated.

The nuance most people miss: inform beforehand, not afterwards

The obligation to inform workers is not a follow-up formality: Article 26(7) requires it to be met before the system is put into service or used for the first time at the workplace. A company already using a screening system and only now considering informing people is, strictly speaking, already behind.

What human oversight genuinely requires

It is not enough that someone could, in theory, review the result. Article 14 requires that the person overseeing understand the system's capabilities and limitations, be able to correctly interpret its output, and be able to decide not to use it or to override a decision based on it. An HR manager who automatically rubber-stamps whatever the algorithm suggests, without any real ability to question it, does not meet the meaningful human oversight the Regulation requires. This is precisely the competence Article 4 requires you to acquire.

Frequently asked

Where to start

If any selection, evaluation or promotion process at your company relies on an automated tool, it is worth checking three things first: whether that use falls under Annex III, whether affected people have already been informed, and whether whoever oversees the system has the real training and authority to override its decisions. Our free assessment helps place your specific case within this framework.