Asana AI and the EU AI Act: Where Work Management Sits

Minimal risk, in almost every case. Asana AI — the bundle Asana markets as Asana Intelligence — drafts status updates, fills in custom fields, summarises projects and portfolios, and runs no-code smart workflows over your own work-management data. None of that matches a high-risk purpose in Annex III. For the company that switches it on, Asana AI sits at minimal risk, the base tier the Act leaves unburdened.

This guide is written for the deployer, not the model maker. The provider of the underlying general-purpose AI model carries the Chapter V obligations (Articles 51–55, in force since 2 August 2025); your duties are light — Article 4 AI literacy, a narrow slice of Article 50 transparency, and the governance of where the tool actually runs. There is one path that can lift Asana AI into high-risk territory, and it is worth naming precisely because it is a build choice you would have to make on purpose.

---

Classify the use, not the brand

The question that decides everything is not "is Asana AI high-risk?" It is "is my organisation's use of it high-risk?" For task tracking, project summaries and workflow automation, the answer is no. Annex III, read with Article 6(2), lists the high-stakes purposes that make a stand-alone system high-risk: employment and worker management, access to essential services, creditworthiness, education, critical infrastructure, biometrics. Drafting a smart status update or auto-filling a priority field is none of those.

The heavy model obligations sit upstream, with whoever trained the foundation model Asana calls. Under Articles 51–55 that provider holds the technical documentation, the training-data summary and the copyright-policy duties. You benefit from that compliance without inheriting it — role determines obligation, and yours is deployer (Article 26).

---

What actually triggers a duty — and what does not

Minimal risk: everyday project work

Smart Summaries, Smart Fields, Smart Status, Smart Chat and Smart Workflows used to run your own projects carry no conformity assessment, no Article 11 technical documentation, no Annex IV file, and no Article 49 registration. This is the overwhelming majority of how teams use Asana AI, and it attracts no mandatory AI Act obligation beyond literacy.

Limited risk: only when output reaches outsiders (Article 50)

Article 50 transparency bites where AI output crosses to people outside your organisation. If an Asana-driven automation sends AI-generated replies to external customers, Article 50(1) requires telling them they are dealing with an AI system unless that is already obvious. Most internal status drafting never reaches a third party, so for the typical Asana AI footprint Article 50 simply does not apply.

The one path to high-risk — employment and worker management

Asana is project-management software, but companies do run people-related work inside it: hiring pipelines, performance-review trackers, workload and headcount boards. The moment you wire Asana AI output into a decision about recruitment, candidate selection, task allocation that determines someone's terms, promotion or termination, you are in Annex III point 4 — employment and worker management. Point 4(a) covers recruitment and selection; point 4(b) covers decisions affecting people already in work, including evaluation and task allocation.

That is a deliberate construction, not how Asana AI behaves out of the box. A summary of a sprint is not an employment decision; an AI score that ranks candidates or flags an employee for dismissal is. Even where an Annex III use is in play, the Article 6(3) filter can take a narrow, procedural use back out of scope — for instance where the AI only improves a completed human assessment without influencing the outcome — but any system that profiles a natural person is always high-risk, so that escape hatch is narrow.

---

The three realistic duties for an Asana AI deployer

Article 4: AI literacy for the people who use it

Article 4 has applied since 2 February 2025 and binds you whatever the risk tier. Staff should understand, at a level fitting their role, that AI status updates can miss context, that summaries omit, and that auto-filled fields need a human check before anyone acts on them. A short acceptable-use note plus role-appropriate guidance satisfies this; no formal training programme is required for minimal-risk use.

Article 50: disclosure where output is external

Apply the Article 50 disclosure only where Asana AI output reaches third parties — an interacting-with-AI notice on any external-facing automation. The synthetic-content and interaction provisions that this draws on are phased: most Article 50 transparency applies from 2 August 2026, and the content-marking duty lands 2 December 2026. For purely internal work, scope the obligation to nothing, because nothing external is produced.

Knowing where it runs: the duty the Act assumes you have

The Act assumes you know what AI you operate and on what data. Asana AI can be toggled across an entire workspace, so it spreads through teams that never made a procurement decision. List Asana AI once in your AI inventory, record which projects and data categories it may touch, and decide who can enable it. This is the same record that lets you answer the literacy and disclosure duties — and the same record that would flag, early, if a team started building Asana AI into a hiring or performance workflow.

One data-governance point sits alongside these: GDPR applies independently of the AI Act, so confirm a lawful basis and a data-processing agreement before staff put personal or special-category data into prompts or AI-enabled fields.

---

Asana AI obligation map by use case

The table maps common patterns to risk tier, the duty each triggers, and the reference. Minimal and limited dominate; only the deliberately built employment row reaches high-risk.

The tier column is the whole message: minimal is the default, high-risk the outcome you would have to construct on purpose.

---

Worked example: a 220-person agency turns on Asana Intelligence

Brandweg GmbH, a 220-person marketing agency in Cologne with around €31M turnover, enables Asana Intelligence across its workspace. Teams use Smart Summaries on client projects, Smart Status to draft weekly updates, and Smart Fields to triage incoming briefs. One automation emails AI-drafted acknowledgements to clients who submit a brief.

The internal project work is minimal risk; Article 4 literacy is the only duty. The client-facing automation triggers Article 50(1) — a short notice that the acknowledgement is AI-generated. No Annex III purpose is in play, so no high-risk obligation attaches. The action list is one inventory entry, a one-page literacy note, an interaction notice on the external automation, and a data rule keeping client special-category data out of prompts (GDPR Article 9 layer).

Now the counterfactual. Brandweg's HR team later builds an Asana board that uses Asana AI to score and rank job applicants automatically and surface a shortlist. That single use becomes Annex III point 4(a) high-risk, pulling in Article 26 deployer duties and an Article 27 Fundamental Rights Impact Assessment — because Brandweg is deploying an AI system for recruitment, and recruitment is one of the listed high-stakes uses. It is a new, deliberate system, not the rollout described, which stays a half-day inventory-and-policy exercise.

---

Deadlines and penalties — proportionate, not alarmist

The settled dates: Article 4 AI literacy and the Article 5 prohibitions apply since 2 February 2025; GPAI obligations (Articles 51–55) since 2 August 2025; most Article 50 transparency from 2 August 2026, with the new content-marking provisions landing 2 December 2026.

High-risk timing matters here only as a contingency. Stand-alone Annex III high-risk obligations now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026. The deferral is a fixed calendar date, not the standards-contingent "stop the clock" version that was rejected.

On penalties: Article 50 and most deployer-obligation breaches carry fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited-practice breaches under Article 5 reach €35 million or 7% (Article 99(3)). Supplying incorrect or misleading information to authorities carries up to €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, each fine is capped at the lower of the percentage or the fixed amount (Article 99(6)). For minimal-risk use of Asana AI there is no fine exposure beyond getting the light disclosure right.

---

How Confir helps

List Asana AI in Confir's AI register and answer the intake questions about role, use case, data types and audience. The deterministic, rule-based engine — no model inference, no hallucination — derives the tier (minimal, the Article 50 limited slice, or the rare Annex III employment path) and the matching obligation checklist, stating in plain language the exact rule that fired. The result is a dated, reproducible record of why your use of Asana AI was classified the way it was — and an early flag if a team starts steering it toward a hiring or performance decision.

Related guides

• build your AI system inventory
• detect shadow AI across your workspace
• what minimal risk means under the Act
• is recruitment-screening AI high-risk?
• employment-decision AI and Annex III
• Article 50 transparency obligations