Compliance tools and documents

It depends on where its outputs flow, not on what the tool is called. Annex III point 4 catches systems whose outputs inform recruitment or selection, or decisions about named individuals: promotion, termination, task allocation, monitoring, or performance evaluation. A tool that only produces aggregate results (themes, distributions, team-level analysis) and feeds no individual outcome points away from high-risk. Run the classifier to get a reasoned position and a pre-filled memo in a few minutes.

Yes, squarely. Annex III point 4(a) covers AI used for recruitment or selection: targeted job advertising, filtering applications, and evaluating candidates. For standalone employment systems the high-risk obligations apply from 2 December 2027: risk management, data governance, technical documentation, logging, human oversight, conformity assessment, and EU database registration for providers, plus the Article 26 deployer duties. The classification framework walks through what each obligation demands.

Yes. Annex III point 4(b) covers AI used to monitor or evaluate a named individual's performance or behaviour, and it turns on where outputs actually flow: advisory outputs that reach decision-makers about named people count. Deployers of a high-risk workplace system must also inform affected workers and their representatives before putting it into service (Article 26(7)). If individual-level results are routinely visible to managers, treat the deployment as within point 4.

Yes. Article 5(1)(f) prohibits AI that infers emotions in the workplace or in education institutions, and the prohibition has applied since 2 February 2025, at the Act's top fine tier (up to €35 million or 7% of worldwide turnover). The only carve-out is systems used strictly for medical or safety purposes. This is a prohibition, not a high-risk category: there is no compliance path for it, only cessation or redesign. How Tadeus classifies itself records our own position: comprehension, not emotional state, by design.

Yes, from 2 August 2026. Article 50(1) requires that people are told they are dealing with an AI system, before or at first interaction, unless it is already obvious. The practical bar is evidence: when a works council or regulator asks, you need a timestamped record per person showing the disclosure happened, in which language. A configured setting is a behaviour; the obligation is discharged by a record.

Usually not as intended, and the pivotal fact is aggregate-only output. A listening tool that returns themes and distributions, identifies no individual outcome, and feeds no decision about a named person sits outside Annex III point 4. The real-world risk is drift: individual-level exports finding their way into a performance dashboard by June changes the deployment's classification whether or not anyone re-reads the paperwork. Name the drift triggers, assign an owner, and re-run the classification when anything on the list happens.

Three dates. The Article 5 prohibitions (including workplace emotion inference) have applied since 2 February 2025. The Article 50 transparency duties, including telling people they are dealing with an AI, apply from 2 August 2026. The Annex III high-risk regime for standalone employment systems applies from 2 December 2027. The first date has passed; the second is close enough that evidence mechanisms need to exist now.

Article 6(3) lets a system otherwise in an Annex III category avoid the high-risk regime when its role in the decision is genuinely minor: a narrow procedural step, improving completed human work, flagging patterns for human review, or purely preparatory work. It is never available where the system profiles people. Claiming it is not free: the final Omnibus text reinstated the duty to document the assessment and register the system in the EU database even as claimed-exempt, so a casual claim converts a classification question into a filed position a regulator can mark wrong.

Article 99 sets three tiers. Prohibited practices (such as workplace emotion inference) carry up to €35 million or 7% of worldwide turnover, whichever is higher. Non-compliance with the other obligations, including Article 50 transparency and the high-risk requirements, carries up to €15 million or 3%. Supplying incorrect information to authorities carries up to €7.5 million or 1%. For SMEs each fine is capped at the lower of the two amounts.

The deployer's set, and it does not travel with the vendor's paperwork. Under Article 26 you must use the system per its instructions for use, assign competent human oversight, ensure input data is relevant, monitor operation, retain the logs you control for at least six months, and, for workplace systems, inform affected workers and their representatives before putting the system into service. Ask your vendor for their classification reasoning in writing; the memo template includes the five questions to send.