Which AI use cases in travel and hospitality are high risk under the EU AI Act?

Annex III point 4(a) lists AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyze and filter job applications and to evaluate candidates. Screening, ranking and scoring applications is therefore high risk. A component limited to a narrow procedural task, such as booking interview slots or answering process questions, can fall outside the high risk category under Article 6(3), but only if it does not materially influence the outcome and does not profile people, and that assessment must be documented (Article 6(4)). Deployers of the high risk part must follow the instructions for use, assign competent human oversight, keep logs, inform workers' representatives and inform candidates that a high risk system is used (Article 26). An organization that builds its own screening system becomes its provider, with conformity assessment duties. The chatbot part also carries the Article 50 disclosure duty.

A kiosk that only answers questions is limited risk: Article 50(1) requires that passengers are informed they are interacting with an AI system, unless that is obvious from the context. The camera function decides the tier. Annex III point 1 lists AI systems intended for emotion recognition (point 1(c)) and remote biometric identification (point 1(a)) as high risk, so an assistant that reads emotion from the camera, which Soul Machines describes for the Dallas Fort Worth avatar as "emotional detection and response", or that identifies travelers by their face, is a high risk system with the provider and deployer duties that follow. Keep both out of the design. Article 50(3), the duty to tell people that an emotion recognition system is used on them, is only an additional disclosure and does not lower the tier.

A tool that flags a likely fault for a certified engineer to confirm is not listed in Annex III: predictive maintenance does not decide access to a service, creditworthiness or employment. Annex I Section B point 20 lists Regulation (EU) 2018/1139 only in so far as it concerns the design, production and placing on the market of unmanned aircraft and their engines, propellers, parts and remote control equipment; it does not cover crewed airline fleets such as LATAM's or Frontier's. A ground based maintenance analytics tool for a crewed fleet is therefore not an Annex I Section B product or safety component in the first place, so it does not fall under Article 6(1) through that entry, and it stays advisory, with every finding going through the airline's approved maintenance program and a certified engineer's sign off. Article 108 separately amends Regulation (EU) 2018/1139 so that when EASA adopts implementing or delegated acts on AI systems that are safety components, it must take the AI Act's Chapter III Section 2 requirements into account; that amendment governs aircraft systems within EASA's own certification regime, not a ground based analytics tool like this one. A design where the tool's output determined continued airworthiness without human review would need a different assessment.

Annex III point 4(b) covers AI systems used to make decisions affecting the terms of a work relationship, its promotion or termination, to allocate tasks based on individual behavior or personal traits, or to monitor and evaluate the performance and behavior of workers. Working hours and shift allocation are terms of that relationship, so shift scheduling is the limb this reaches most directly. Classification turns on the system's intended purpose, not on whether a human signs off: Article 14 requires human oversight for systems that are already high risk, it does not exempt a system from the tier. A system whose only purpose is to forecast aggregate, restaurant level demand, with no output about any named worker, sits outside point 4(b). The same forecast, used by a system that allocates shifts to named workers or sets their hours, falls inside it regardless of any review step; staying out of that tier depends on the system's purpose, or on an Article 6(3) derogation, not on manager sign off.

Frying alone is not a use listed in Annex III, so a robot that only plans and runs the frying task is usually minimal risk. That changes under Article 6(1), which is high risk when the robot, or an AI or machine learning component of it, is a safety component of a product covered by the Union harmonization legislation in Annex I, and that law requires a third party conformity assessment of the product. For a kitchen robot the relevant product law is the Machinery Regulation (EU) 2023/1230, which requires that assessment for machinery whose safety function relies on machine learning that can change its own behavior, for example vision guided collision avoidance or an interlock near a crew member. Since the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the Machinery Regulation into Annex I Section B, only Article 6(1), Article 60a and Articles 102 to 112 of the AI Act apply directly to that safety component, and the detailed requirements reach it through delegated acts amending Annex III of the Machinery Regulation; these AI Act rules apply from 2 August 2028. None of the public deployments on this page describes its vision or control system performing a safety function rather than only guiding the task, so check your own robot's design against this before assuming it is out of scope.

Predicting a departure time and alerting on a late turnaround subprocess is not listed in Annex III: it does not decide access to a service, creditworthiness or employment, and it is not a safety component of an aircraft or a product regulated under Regulation (EU) 2018/1139 that Annex I Section B lists. Annex III point 4(b) covers AI used to monitor and evaluate the performance and behavior of workers; a design that uses the same camera feeds to score individual ground staff, rather than to track turnaround subprocesses, would sit closer to that category, and GDPR applies to any footage that identifies staff.

Annex III point 4(b) covers AI used to monitor and evaluate the performance and behavior of workers. A tool that scores each pilot's individual flights against a baseline and shows a pilot where they under performed is a form of worker performance and behavior monitoring, so per pilot scoring and coaching can fall under 4(b) even when the score is never fed into a formal performance review; whether it does depends on whether individual pilot evaluation is actually in scope and on the provider's own Article 6(3) assessment. Fleet or route level aggregate analytics that never attribute a score to a named pilot is the lower risk design and sits outside Annex III, because it does not evaluate a specific worker. Safety critical decisions (how much fuel to carry, whether to divert) stay with the pilot in command under existing flight operations rules regardless of tier.

Recommending schedule, aircraft and passenger recovery plans to controllers is not listed in Annex III. Annex III point 4(b) covers AI used to make decisions affecting terms of work relationships, to allocate tasks based on individual behavior or personal traits or characteristics, or to monitor and evaluate the performance and behavior of workers. A design that reassigns individual crew members on such grounds, or that scores controllers or crew on their performance, falls in that category; one that works on flights, aircraft and crew legality and qualifications alone is less likely to, although assigning duties by qualification can still touch terms of work. The tool is not itself a safety component of an aircraft or other product regulated under Regulation (EU) 2018/1139, which Annex I Section B lists, so that route to high risk does not normally apply. Decisions that affect flight safety stay under aviation safety regulation and the airline's approved procedures; keep crew legality and maintenance limits as hard rules outside the model.

Most personalization and content generation is minimal risk. Providers of systems that generate synthetic audio, image, video or text content must mark the output as artificially generated, and deployers must disclose deep fakes (Article 50(2) and 50(4)). Personalization that deploys manipulative or deceptive techniques, or exploits vulnerabilities due to age, disability or a specific social or economic situation, in a way that causes or is reasonably likely to cause significant harm, is prohibited under Article 5(1)(a) and (b). Using AI to assess creditworthiness or to price life and health insurance is high risk under Annex III point 5(b) and 5(c) and belongs on its own page. Outside the AI Act, the FCA Consumer Duty applies only to FCA regulated firms (the financial services slice of this use case), and the Telephone Consumer Protection Act applies only to campaigns delivered by call or text message in the US.

Deciding a loyalty offer or reward for a customer is not listed in Annex III and does not itself evaluate creditworthiness, employment or access to an essential service, so a back office personalization engine is minimal risk. If a conversational channel is added to talk to members directly, Article 50 would apply and members must be told they are dealing with AI. Personalization that deploys manipulative or deceptive techniques, or exploits a member's vulnerabilities due to age, disability or a specific social or economic situation, in a way that causes or is reasonably likely to cause significant harm, is prohibited under Article 5(1)(a) and (b).

An AI system that interacts directly with people must be designed so that they know they are dealing with AI, unless that is obvious from the context (Article 50(1)). It is not high risk under Annex III as long as it does not evaluate eligibility for essential public assistance benefits and services (point 5(a)), creditworthiness (point 5(b)), risk and pricing for life and health insurance (point 5(c)) or emergency calls (point 5(d)). This holds only if emotion or vulnerability signals are inferred from what the customer says (text or transcript content), not from voice or other biometric features; an agent that infers emotion from a caller's voice is an emotion recognition system (Article 3(39)), which is high risk under Annex III point 1(c) and triggers the deployer disclosure duty in Article 50(3).

A customer facing assistant must tell people they are interacting with AI unless that is obvious from the context (Article 50(1), applicable from 2 August 2026). Recommending and booking travel is not listed in Annex III, so it is not high risk; consumer protection law on price transparency and fair commercial practices still applies to what it says.

A customer facing assistant must tell people they are interacting with AI (Article 50). It is not a high risk use under Annex III: it applies the airline's reaccommodation rules and does not decide on access to an essential public service or on creditworthiness.

A visitor facing assistant must make clear that people are interacting with AI (Article 50), and synthetic speech should be identifiable as AI generated. It is not high risk. It would change if the camera feature were used to identify or categorize visitors by biometric data, which a guide does not need: remote biometric identification, biometric categorization and emotion recognition are high risk under Annex III point 1, and biometric categorization that infers sensitive traits is prohibited under Article 5.

Article 50(1): customers must be told they are dealing with an AI system, unless that is obvious from the point of view of a natural person who is reasonably well informed, observant and circumspect, given the circumstances and context of use. Taking a food order is not an Annex III use, so this stays a transparency obligation, not a high risk one.

Generating presenter video is not listed in Annex III. Providers of tools that generate synthetic video must mark the output as AI generated, and deployers must disclose deep fakes, such as an avatar or cloned voice of a real executive that would falsely appear authentic (Article 50(2) and (4)). The tier changes only if the same system also decides on access to work or services, which these deployments do not describe.

A customer facing agent must disclose that it is AI (Article 50), unless this is obvious from the context. Travel insurance claims handling is not listed in Annex III; point 5(c) covers risk assessment and pricing in life and health insurance, not the handling of claims. Handing a traveler who reports a medical emergency to the assistance team is not the classification of emergency calls or the patient triage in point 5(d), as long as the agent only hands over and does not set medical priorities. Claim decisions based solely on automated processing are subject to GDPR Article 22 (and its UK equivalent), and medical data is special category data under Article 9.

A demand forecasting and pricing tool used by hotel staff is not listed in Annex III and is not a system that decides on a natural person's access to an essential service; it prices a hotel room, not a person. It is not customer facing, so the Article 50 transparency duty for conversational AI does not apply. The AI literacy obligation on staff who use AI systems (Article 4) still applies.