EU AI Act Annex III and HR: Which Systems Require Human Review
Annex III of the EU AI Act (Regulation 2024/1689) identifies eight categories of high-risk AI systems. Category 4 covers employment, workers management, and access to self-employment. Most HR functions have at least one system that falls into this category. Most HR functions have not classified it as high-risk. The gap between those two facts is where the enforcement exposure lives.
What Annex III Category 4 covers
Category 4 applies to AI systems used for recruitment or selection (including CV screening, interview analysis, and candidate ranking), promotion and termination decisions, task allocation and performance monitoring, and access to self-employment and contracting opportunities. The classification is function-based, not technology-based. If your system influences any of those decisions for a natural person, it is in scope, regardless of whether you call it "AI" or "an algorithm" or "a scoring model."
The classification test is not "is this AI?" It is "does this system influence employment decisions for natural persons?" If yes, Annex III applies.
The systems most commonly misclassified
ATS candidate ranking and scoring
If your applicant tracking system ranks candidates or assigns scores that determine who reaches the next stage, it is high-risk under Annex III. This includes vendor-provided "match scores," AI-generated summaries that inform shortlisting, and any automated filtering that removes candidates before human review.
Performance management scoring engines
Systems that produce numerical performance scores, ratings, or rankings used in salary review, promotion, or termination decisions. Includes calibration tools that normalise manager ratings across populations using algorithmic adjustment.
Workforce analytics used for headcount decisions
Predictive attrition models, flight risk scores, and productivity monitoring tools that feed into decisions about who to retain, redeploy, or exit. The critical question is whether the output influences a decision about a specific individual.
AI-generated interview summaries
If an AI system transcribes, summarises, or scores an interview and that output is used in the selection decision, it is in scope. The fact that a human makes the final decision does not remove the system from Annex III. The human-in-the-loop requirement means a qualified human must be able to meaningfully override the system, not just rubber-stamp its output.
HR chatbots and policy lookup tools
Tools that answer employee questions about policy, benefits, or processes without producing outputs that influence individual employment decisions are generally not in scope for Annex III Category 4. They may fall under other AI Act obligations (transparency, general-purpose AI rules) but not the high-risk regime.
What high-risk classification requires
High-risk AI systems under the EU AI Act must meet requirements across six areas before deployment: a risk management system documented throughout the lifecycle; data governance standards for training, validation, and testing data; technical documentation sufficient to demonstrate conformity; logging and audit trail capabilities; transparency information for users; human oversight mechanisms that are genuine, not nominal; and accuracy, robustness, and cybersecurity standards appropriate to the use case.
The human oversight requirement is the one most organisations underestimate. Article 14 requires that natural persons to whom oversight is assigned must be able to understand the system's capabilities and limitations, monitor operation effectively, and disregard, override, or intervene in the output. A process where a manager clicks "approve" on an AI-generated shortlist without reviewing the rejected candidates does not satisfy Article 14.
The EUPTD intersection
Article 10 of EUPTD 2023/970 requires that job evaluation and classification criteria are transparent and accessible, and that artificial intelligence used in remuneration decisions does not perpetuate pay discrimination. This creates a direct overlap with Annex III: if you use AI in any process that influences remuneration (including performance scoring, grading, or benchmarking), both the AI Act and EUPTD requirements apply simultaneously.
Organisations that are preparing EUPTD compliance without simultaneously mapping their HR AI tools against Annex III are creating a gap that will surface when the first enforcement actions begin.
The practical starting point
Build an inventory. List every system in your HR technology stack that produces a score, rank, recommendation, or classification about an individual. For each system, apply the Annex III Category 4 test: does this output influence an employment decision? If yes, classify as high-risk and assess against the Article 9-15 requirements. If uncertain, assume high-risk until you can demonstrate otherwise.
The inventory itself is evidence of good governance. Organisations that can show a documented classification process are in a significantly better position under supervisory review than those that have never conducted one.
HR AI Act readiness review
We map your HR technology stack against Annex III and EUPTD Article 10 in a structured half-day session. Output: a classification register, gap list, and prioritised action plan.
Book the review