Which AI use cases in technology and software are high risk under the EU AI Act?

Annex III point 4(b) lists AI systems intended to monitor and evaluate the performance and behavior of workers as high risk. Synthesizing an employee's work history and feedback into a performance evaluation is very plausibly profiling of a natural person under GDPR Article 4(4), which expressly covers analyzing or predicting a person's "performance at work". Article 6(3)'s last subparagraph makes an Annex III system high risk regardless of the derogations whenever it performs such profiling, so a tool built this way is high risk by default however much the manager edits the output. The derogations in Article 6(3), including a narrow procedural task or improving the result of a previously completed human activity, do not fit drafting an evaluation from scratch; the closest is point (d), a preparatory task ahead of a human assessment, which only has a chance of applying to a design that avoids profiling altogether, for example one that only surfaces raw facts without synthesizing a judgment. Where that derogation is argued, the documentation duty under Article 6(4) falls on the provider of the system, and only on the deploying organization when it builds the tool itself. Because the tool is high risk by default, Article 26(7) requires informing affected workers and their representatives before it is put into use in the workplace, whatever the tool's output is used for; using the same system's output directly in pay, promotion or termination decisions removes any doubt and triggers the full high risk regime. Annex III's high risk obligations apply from 2 December 2027.

Annex III point 4(b) lists AI systems intended to monitor and evaluate the performance and behavior of workers as high risk, and scoring an employee's likelihood of leaving from their performance, compensation and engagement data is that kind of evaluation, even though the output feeds a retention conversation rather than a punitive action. Deployers must inform workers' representatives and affected employees before use (Article 26) and keep human oversight over any action taken on the score.

Annex III point 4(a) lists AI systems intended to be used to recruit or select natural persons, including to place targeted job advertisements and to analyze and filter applications. Ranking a company's own past applicants and new candidates against an open role, and deciding who a recruiter sees first, is filtering and evaluating candidates for that purpose.

Annex III point 4(b) covers AI systems intended to monitor and evaluate the performance and behavior of persons in a work related relationship. Scoring every line against the employee's own submission history, and instrumenting a repeat flag rate by employee, is that kind of behavioral evaluation, so this design falls under Annex III. The only carve out, Article 6(3), lets a narrow procedural or preparatory task escape high risk with a documented assessment, but the last subparagraph of Article 6(3) removes that carve out whenever the system performs profiling of natural persons. Scoring lines against an individual employee's history is profiling, so the carve out is not available here: keeping a human auditor as the actual decision maker on any personnel action is a required control, not an exit from Annex III.

Assessing businesses and detecting fraud is not an Annex III use as such, and Annex III point 5(b) excludes systems used to detect financial fraud. If the system evaluates the creditworthiness of a natural person, for example a sole trader applying to accept payments, it can fall under Annex III point 5(b), which covers evaluating the creditworthiness of natural persons or establishing their credit score, and be high risk. Keep credit assessment of individuals separate or treat it as a high risk system.

Drafting outreach that a rep reviews and sends as their own message is typically minimal risk. If the agent holds conversations with prospects itself, for example by replying to emails or calling, people must be told they are interacting with AI (Article 50, limited risk). It is not an Annex III use case.

A tool that only certifies IT system access and revokes over provisioned entitlements is not itself a use listed in Annex III, and makes no decision about a natural person's employment, benefits or creditworthiness. But scoring how an employee's access compares to their peers sits close to Annex III's category on monitoring and evaluating the performance and behavior of workers: if the score is used, or could be read, to judge conduct or performance rather than only system entitlements, treat it as high risk and run the full assessment. Keep the scoring scoped to entitlement risk, documented and reviewed, to stay on the lower risk side of that line.

The tier depends on what the range is used for. When it materially influences an individual hiring offer, it falls under Annex III point 4(a) (recruitment); when it materially influences an individual raise or promotion decision, it falls under point 4(b) (decisions affecting the terms of a work relationship). A recommended range that a recruiter or manager can accept or override, as this use case is designed, still counts as materially influencing that decision. A separate system that only produces an aggregate regression report for the compensation team, with no individual recommendation, is either outside Annex III on that narrower use or falls under Article 6(3) as a preparatory task that detects deviations from prior decision patterns rather than a high risk use in itself. Deployers of the high risk part must inform workers' representatives and affected employees before use (Article 26).

Answering policy questions and starting routine requests is limited risk, with the Article 50 duty to disclose AI. It becomes high risk under Annex III point 4 if it is used to make or support decisions on recruitment, promotion, termination, allocating tasks based on individual behavior or personal traits, or the monitoring and evaluation of workers; an employer deploying it then must also inform workers' representatives and the affected workers before use (Article 26(7)). Sensitive topic detection should work on what the employee writes: inferring emotions of people in the workplace from biometric data such as voice or facial expressions is prohibited under Article 5(1)(f), except for medical or safety reasons.

Triage of phishing, endpoint, network and cloud alerts for an organization's own cyber defense is not listed in Annex III. Recital 55 of the AI Act says that components intended to be used solely for cybersecurity purposes should not qualify as safety components, so the agent does not fall under Annex III point 2 (critical infrastructure), and for this scope the tier is minimal. The design changes that when the agent triages identity, data loss prevention, insider risk or user behavior alerts in a way that scores or monitors individual employees: monitoring and evaluating the behavior of persons in a work relationship falls under Annex III point 4(b), so that scope needs its own high risk assessment before it goes live. The Article 50(1) duty to disclose AI interaction does not apply because it is obvious to a reasonably well informed analyst that they are working with an AI agent. An operator that lets AI act autonomously on network or operational technology controls should assess that design separately, and reading employees' emails and sign in data remains subject to data protection law.

Generating training content is not listed in Annex III. Providers of tools that generate synthetic audio, image, video or text content must mark the output as AI generated (with an exception for assistive editing that does not substantially alter the source), and deployers must disclose deep fakes, such as an avatar or voice that resembles a real person and would falsely appear authentic (Article 50(2) and (4), with the definition in Article 3(60)). If the same system evaluates learning outcomes or decides access to training that affects a person's work, Annex III point 3 (education and vocational training) and point 4 (employment) must be checked, and those parts can be high risk.

Transcribing and summarizing meetings for the participants is minimal risk. It becomes high risk under Annex III point 4(b) if transcripts are analyzed to monitor or evaluate individual workers' performance or behavior, and inferring participants' emotions from their voices or faces at work is prohibited by Article 5(1)(f). Recording and transcription also need a lawful basis and clear information to participants under GDPR.

As a pure assist tool for agents it is minimal risk; the customer does not interact with the AI. It becomes high risk under Annex III point 4(b) if its data is used to monitor and evaluate individual agents' performance, and inferring agents' emotions at work is prohibited under Article 5(1)(f).

A chatbot that interacts with developers must disclose that it is AI (Article 50). Code generation for integration is not listed in Annex III.

Generating presenter video is not listed in Annex III. Providers of tools that generate synthetic video must mark the output as AI generated, and deployers must disclose deep fakes, such as an avatar or cloned voice of a real executive that would falsely appear authentic (Article 50(2) and (4)). The tier changes only if the same system also decides on access to work or services, which these deployments do not describe.

A customer facing sales agent must make clear that people are talking to an AI system, unless that is obvious (Article 50(1)). Qualifying and routing prospects is not an Annex III use. It becomes high risk where the same system takes on an Annex III task, for example evaluating the creditworthiness of natural persons (Annex III point 5(b)) or assessing risk and pricing for life or health insurance (point 5(c)); those decisions then need the high risk controls.

Article 50(1) requires an assistant that talks with people to make clear they are interacting with AI, unless that is obvious from the context. It is not listed in Annex III. The agent does allocate work, but it routes tickets to resolver and assignment groups based on the content of the request, not to individual workers based on their behavior or personal traits or characteristics, so Annex III point 4(b) does not apply. It also does not decide on recruitment, promotion, credit or access to essential services. Any use that assigns work to individual analysts, or monitors and evaluates them from their behavior or performance (including through the agent's logs), would need its own assessment.

Drafting bid responses for staff to review is not listed in Annex III, and the buyer receives the seller's own document rather than interacting with an AI system, so the high risk tier and the Article 50(1) duty towards the buyer do not apply. Staff who chat with the agent must know it is an AI system, which an internal tool labeled as an AI assistant meets by design. Article 50(2) does apply to the drafting itself: the provider of a system that generates text must mark its output in a machine readable format as artificially generated, whether or not a person reviews the draft, unless the system only performs an assistive function for standard editing. A seller that uses a third party drafting tool relies on that tool's provider for the marking; a seller that builds its own agent that generates proposal text, as GroupeActive did with Witivio on Copilot Studio, can be the provider and then carries the duty itself. AI literacy under Article 4 applies in both cases, and the seller remains responsible for every statement in the submitted response.

A treasury assistant interacts directly with staff, so Article 50(1) requires that they are informed they are dealing with an AI system unless that is obvious from the context. It is not listed in Annex III and makes no decision about a natural person.

Article 50(1) requires providers to design AI systems that interact directly with people so that those people are informed they are dealing with AI, unless this is obvious from the context, as it usually is for an internal assistant. An analytics assistant that makes no decisions about people is not a prohibited practice under Article 5 and is not listed in Annex III. It would be high risk only if it were intended for an Annex III purpose, such as assessing the creditworthiness of natural persons (point 5(b)).

A drafting copilot whose output an agent reviews and sends falls under the transparency tier at most. When replies are sent without human review, customers interact with the AI system directly, and Article 50(1) requires that they are informed unless this is obvious from the context. Article 50(2) separately requires the provider of a system that generates text to mark its output in a machine readable format as artificially generated, whether or not a person reviews the draft. It becomes high risk only if it is used for a purpose listed in Annex III, such as evaluating eligibility for public benefits or creditworthiness (point 5), or evaluating the performance of the agents who use it (point 4).

An internal tool that optimizes infrastructure spend and makes no decision about a natural person, so the default case falls outside Annex III. The relevant Annex III entry to check against is point 2, AI safety components in the management and operation of critical digital infrastructure: a cost agent stays outside it as long as its policy keeps it to cost actions (rightsizing, commitment purchases, idle cleanup) rather than acting as a safety component of the infrastructure itself. The Akamai deployment on this page shows the scope can extend to core production infrastructure, so an operator should confirm this against its own policy rather than assume it.

An internal tool that supports engineers on IT incidents; it is not a use listed in Annex III and makes no decisions about people. Annex III point 2 covers AI used as a safety component in the management and operation of critical digital infrastructure, and recital 55 limits safety components to systems that directly protect the physical integrity of that infrastructure or the health and safety of persons and property. A triage copilot that proposes causes and fixes to engineers does not normally do that, but operators of critical digital infrastructure (cloud, data centers, telecom networks) should confirm this for their own design.

A coding assistant used by developers is not a prohibited practice under Article 5 and is not listed in Annex III. Developers know they are working with an AI tool, so the Article 50 disclosure duty has no practical effect for the deploying organization, and the marking of generated content under Article 50(2) falls on the tool's provider. What remains is AI literacy (Article 4). Using an AI system to monitor or evaluate individual developers' performance would fall under Annex III point 4(b), and the software the assistant helps build may itself fall under the Act.

Tools that analyze, document and translate code are not prohibited practices under Article 5 and are not listed in Annex III, so no high risk obligations apply to the tooling. Engineers and analysts know they are working with an AI tool, including when they query the documentation through a chat assistant, so the Article 50 disclosure duty has no practical effect for the deploying organization. What remains is AI literacy for the staff who use it (Article 4). If the system being modernized is itself an AI system in an Annex III area (for example creditworthiness assessment, point 5(b)), its new version still has to meet the high risk requirements.

Triaging internal engineering tickets and drafting code for a human to review has no listed use in Annex III and does not produce a decision with legal or similarly significant effects on a person outside the company, so it carries no use case specific AI Act obligation beyond the general purpose model duties in Chapter V that apply to the provider of the underlying model.

Generating detection rules for an organization's own cyber defense is not an Annex III use, and recital 55 of the AI Act says components used solely for cybersecurity purposes do not qualify as safety components. The tier stays minimal while engineers approve each rule and the rules do not themselves decide on people, for example by scoring employees.

Drafting and triaging code fixes for an organization's own software is not an Annex III use, and developers, not the public, interact with the system. The software being fixed remains subject to its own security and resilience rules, whoever wrote the fix.

Sourcing indirect goods and services for the organization's own use is not listed in Annex III, and the system has no direct effect on individuals, so only AI literacy duties apply. Check the design if bidders are natural persons, for example sole traders, or if the agent produces any assessment of individual workers. Public bodies also remain bound by national public procurement rules on equal treatment and transparency, whichever tool runs the event.

An internal data engineering tool that flags anomalies in pipelines and tables; it is not a use listed in Annex III and makes no decision about a natural person. If the monitored data feeds a high risk system, such as a credit or employment decision, the AI Act obligations attach to that downstream system, not to this monitoring layer.

An internal assistant that drafts requirements artifacts and test cases for engineers is not listed in Annex III and does not interact with the public, so no specific obligations apply beyond AI literacy (Article 4). The system under test may itself fall under the Act.

Forecasting a company's own foreign currency flows is not listed in Annex III and makes no decision about a natural person. The model is used by treasury staff and does not interact with the public, so the obligations are limited to AI literacy (Article 4).

Summarizing public threat reporting for an organization's own cyber defense is not an Annex III use, and recital 55 of the AI Act says components used solely for cybersecurity purposes do not qualify as safety components. The tier stays minimal while the assistant works on public sources and an analyst reviews and takes responsibility for what is published. It changes if the same tooling is used to profile or score employees.

Tracking contractual obligations and sending reminders is not among the Annex III high risk uses; an internal tool that extracts terms and alerts an owner makes no decision about a natural person's access to a service, employment or credit, so it is minimal risk under the EU AI Act, with the Article 4 duty to give staff who operate it appropriate AI literacy. The DORA and APRA CPS 230 entries below apply only when the deploying organization is itself a regulated bank, insurer or other financial entity; for other industries they do not apply.

Classifying user generated content against a platform's own policy is not listed in Annex III, and the system does not generate or manipulate content, so it carries no use case specific duty under the EU AI Act. Platform content moderation is instead the direct subject of the EU Digital Services Act (Regulation (EU) 2022/2065), a separate regulation. Article 17 requires a statement of reasons for content moderation decisions, and Article 20 requires an online platform within its scope to offer an internal complaint handling system, though Article 19 exempts micro and small enterprises from that duty; see the cited guidance below.