Atlassian Intelligence Under the EU AI Act: A Minimal-Risk Work Assistant
Atlassian Intelligence in Jira and Confluence — summaries, search, writing help — is minimal-risk under the EU AI Act. The duty is Article 4 AI literacy.
Atlassian Intelligence — the AI woven through Jira, Confluence and the rest of the suite for summaries, natural-language search, issue drafting and writing help — is a minimal-risk use under the EU AI Act, Regulation (EU) 2024/1689. Helping teams plan and document work is not one of the high-risk uses in Annex III, so the heavy regime does not attach.
Why it is minimal-risk
Article 6(2) keys high-risk status to Annex III — recruitment, credit scoring, biometric ID, and the rest. Summarising a Confluence page, drafting a Jira ticket, or answering "what changed in this sprint?" is none of those. Atlassian Intelligence sits in the minimal-risk tier, with no mandatory AI Act obligations. Because it works on your internal project data, it generally raises no Article 50 disclosure either.
What applies is light: Article 4 AI literacy (in force since 2 February 2025) for the people who rely on it, including an awareness that AI summaries can be wrong and need a glance before they drive a decision; and your GDPR controls over any personal data in your issues and pages.
When could it change?
Only by repurposing it into an Annex III use — unusual for a work-management assistant. If you wired Atlassian Intelligence into a workflow that evaluated employees (Annex III point 4(b)) or another listed use, that use would be high-risk, and Article 25 could make you its provider. Ordinary planning, documentation and search do not flip you.
Provider or deployer?
You are a deployer under Article 26; Atlassian is the provider, and the underlying general-purpose model carries its GPAI duties with the model provider. The Article 25 flip requires substantial modification, rebranding, or a high-risk repurpose.
Timeline and penalties
For a minimal-risk tool most of the timeline is moot. In summary: Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI since 2 August 2025; stand-alone high-risk Annex III from 2 December 2027 under the Digital Omnibus, adopted in June 2026. Penalties under Article 99 run €35M/7%, €15M/3% and €7.5M/1%, with the Article 99(6) SME cap — but a minimal-risk tool carries no obligation to breach.
Worked example: a 70-person software team
Northbridge Software, a 70-person product company, runs Jira and Confluence with Atlassian Intelligence for sprint summaries, ticket drafting and doc search. Every use is minimal-risk: the team adds a one-line AI-use note to its engineering policy (Article 4 literacy) and checks that customer personal data in tickets is handled under its existing GDPR controls. No high-risk stack, no Article 50 disclosure.
How Confir helps
Confir logs Atlassian Intelligence as a minimal-risk work assistant with its light literacy duty, and would flag any drift toward an Annex III use. The engine is deterministic and rule-based — the same inputs always yield the same cited finding.
Frequently asked questions
Is Atlassian Intelligence high-risk under the EU AI Act?
No. Summaries, search and writing help in Jira and Confluence are minimal-risk, because work management is not an Annex III use case. The Act imposes no mandatory obligations on minimal-risk systems. The realistic duty is Article 4 AI literacy for the people who use it.
Do we owe anything for using it?
Light duties only: Article 4 AI literacy (in force since 2 February 2025) and your GDPR controls over any personal data in your issues and pages. There is no conformity assessment, documentation or registration duty for a minimal-risk tool.
Does it trigger Article 50 transparency?
Generally no, because it operates on internal project data rather than interacting with the public. Article 50 applies where AI interacts with people outside the organisation or produces content published to them.
Could it ever be high-risk for us?
Only if repurposed into an Annex III use — for example, evaluating employees — which would make that use high-risk and could make you its provider under Article 25. Ordinary planning and documentation do not flip you.
Who carries the GPAI obligations?
Atlassian and the underlying model provider, under Articles 51–55 — not you as a deployer.
Related guides
- How AI risk classification works
- Is Microsoft 365 Copilot high-risk?
- Article 4 AI literacy
- Provider versus deployer roles
- Build your AI system inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →