High-risk AI at work
The deadline moved to December 2027, but the categories did not change, and two prohibitions already apply today.
Two things are banned, not merely regulated
The prohibitions in Article 5 have applied since 2 February 2025 and were not affected by the delay. Two are worth knowing because they can arrive through an ordinary procurement decision.
AI that infers emotions from employees in the workplace, or from students in education, is prohibited, with narrow exceptions for medical and safety purposes. If an HR, wellbeing or monitoring product markets itself on reading engagement or mood from camera or voice, it needs checking before it goes anywhere near your staff.
The amending regulation added an explicit prohibition on tools that generate sexualised imagery of real people without consent, and child sexual abuse material, with a transition period to 2 December 2026.
Which ordinary workplace uses count as high-risk
These are the Annex III categories most likely to reach a normal employer once the new dates arrive. The list here is drawn from consistent secondary summaries of Annex III rather than a direct reading of the annex, so confirm the exact wording before relying on it.
- Recruitment. AI used to target job advertisements, filter applications, or evaluate candidates.
- Worker management. AI used to decide promotion or termination, allocate tasks based on individual behaviour or traits, or monitor and evaluate performance.
- Education and training. AI determining access, evaluating learning outcomes, grading, or monitoring students for prohibited behaviour during exams.
- Credit and essential services. Creditworthiness scoring and access to essential public or private services, including insurance risk pricing.
What deployers have to do
Article 26 sets out the duties that fall on the organisation using a high-risk system, as opposed to the one that built it. These apply from 2 December 2027 for stand-alone Annex III systems. The content of the duties did not change with the delay, only the date.
Use it as instructed, with real oversight
Follow the provider's instructions for use, and assign human oversight to people who are competent, trained and actually authorised to intervene.
Watch the input data
Ensure that input data under your control is relevant and sufficiently representative for the purpose.
Monitor and escalate
Monitor operation, inform the provider and the market surveillance authority about serious incidents or risks, and suspend use where necessary.
Keep the logs
Automatically generated logs must be retained for at least six months.
Tell the workforce first
Before putting a high-risk system into use in the workplace, inform worker representatives and the affected workers.
Tell the people affected
Individuals subject to decisions made with the system have to be informed.
Sources
- AI Act Service Desk, Article 26 — deployer obligations for high-risk systems
- Regulation (EU) 2026/1744 — the new dates and the added prohibition
- AI Act consolidated text — Article 5 and Annex III