Clari Under the EU AI Act: Minimal to Deploy, Until You Score Your Reps

For the deploying organisation, Clari sits at minimal risk — until you point its conversation analytics at your own staff. Then the classification changes.

Clari is a revenue and RevOps platform: pipeline forecasting, deal inspection, and — through Clari Copilot, the conversation-intelligence layer it acquired as Wingman — call recording, real-time transcription, and AI-generated coaching signals. Used to forecast revenue and surface deal risk, none of that triggers a mandatory obligation under the EU AI Act. The watch-item is narrower and sharper: the moment you use those same call analytics to evaluate or monitor the people making the calls, you may cross into Annex III, point 4(b) high-risk territory. And if you go one step further and infer your reps' emotional state, you may hit an Article 5 prohibition outright.

This page draws those lines, names the GDPR duties that bite first, and gives a worked example.

---

The Baseline: Forecasting and Deal Intelligence Is Minimal Risk

Most of what Clari does is invisible to the EU AI Act's mandatory regime. Forecasting future revenue, ranking pipeline by deal health, flagging which opportunities are slipping, summarising a call so a manager can review it — these are analytics applied to commercial data. They do not classify natural persons in a way the Act regulates, and they sit at minimal risk under Regulation (EU) 2024/1689.

At minimal risk there is no registration, no conformity assessment, no Article 11 technical documentation. The only obligation already live for every organisation is Article 4 AI literacy (in force since 2 February 2025): the sales managers and RevOps staff who act on Clari's outputs should understand, proportionate to their role, what the tool does and where its transcription or scoring can be wrong.

The vendor's own duties sit elsewhere. Clari Copilot is built on third-party general-purpose AI models for transcription and language tasks; those GPAI model providers carry Chapter V obligations (technical documentation, downstream information, training-data summary — Article 53), in force since 2 August 2025. That is their burden, not yours as the deployer.

---

The Watch-Item: Using Call Analytics to Evaluate Staff

Here is where deploying Clari changes character. Annex III, point 4 covers AI used in employment and worker management. Point 4(a) is recruitment and selection; point 4(b) covers AI used to make decisions affecting work relationships, to allocate tasks, or to monitor and evaluate the performance and behaviour of workers.

Clari Copilot records every call, transcribes it, and scores it against talk-ratio, competitor mentions, "next-step" discipline and other coaching signals. Use those signals purely to coach — a manager reading them, deciding what feedback to give — and you are arguably still in support territory. Wire them into something that automatically ranks reps, feeds performance reviews, or drives quota, promotion or termination decisions, and you are using AI to evaluate worker performance: Annex III point 4(b), high-risk.

The Article 6(3) filter can pull a borderline case back out of high-risk — a system performing a narrow procedural task, or merely improving the result of a completed human assessment without replacing it, is not high-risk. But any system that profiles a natural person is always high-risk regardless. Automated, continuous performance evaluation of named employees is close to the definition of profiling, so do not assume the filter saves you; document the assessment either way.

If your organisation crosses into Annex III point 4(b) as a deployer, the duties under Article 26 apply: follow the provider's instructions for use, keep system logs, ensure human oversight (Article 14) of any output affecting a worker, and — critically — inform workers' representatives and affected workers before putting the system into service. The high-risk requirements themselves apply from 2 December 2027 for stand-alone Annex III systems under the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026.

---

The Hard Stop: Inferring Reps' Emotions Is Prohibited

There is a line beyond high-risk. Article 5(1)(f) prohibits AI systems that infer the emotions of a natural person in the workplace (and in education), except for medical or safety reasons. This prohibition has been in force since 2 February 2025 and is not deferred.

If a feature analysed a rep's tone of voice to label them as "frustrated", "disengaged" or "confident", and you ran that across your sales team, that is an emotion-recognition system used in the workplace — a prohibited practice, not a high-risk one. Breaches of Article 5 carry the top penalty tier: up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). Sentiment scoring of customers on a call is a different question (it can be lawful, subject to other rules); sentiment scoring of your own staff in the workplace is the prohibited case. Confirm with your vendor exactly what any "sentiment" or "emotion" signal measures and on whom.

---

GDPR Bites First: Recording Consent and National Rules

Before any AI Act analysis, recording sales calls is processing personal data under the GDPR, and call recording is also governed by national law that varies sharply across the EU. You need a lawful basis (GDPR Article 6), a clear retention policy, and — in many member states — consent or notification from all parties on the call, not just your own rep. Germany, France, Spain and others have specific rules on recording conversations; an all-employee rollout of Clari Copilot without a consent-capture and notice mechanism is a GDPR and national-law exposure independent of the AI Act.

Where Clari Copilot processes EU personal data, you also need a data processing agreement with the vendor and clarity on sub-processors and data location. Treat recording consent as the first gate; the AI Act layer sits on top of it.

---

Worked Example: Nordwind Software OÜ

Nordwind Software OÜ, an Estonian B2B SaaS company with ~140 employees and ~€22M turnover, rolls out Clari with Copilot across a 30-person sales team. Three of its use cases land in three different places:

• Pipeline forecasting and deal inspection — minimal risk. No mandatory obligation beyond Article 4 literacy for the RevOps team.
• Automated rep scorecards that rank the 30 reps weekly and feed directly into quarterly performance reviews — this is AI used to evaluate worker performance: Annex III point 4(b), high-risk. Nordwind must, as deployer, inform its sales team and any workers' representatives, ensure a manager (not the algorithm) makes the review decision under Article 14, and keep logs. The high-risk requirements bind from 2 December 2027.
• A proposed "rep mood" dashboard inferring whether each rep sounded stressed on calls — Nordwind's DPO kills it: inferring employees' emotions in the workplace is prohibited under Article 5(1)(f), already in force, €35M/7% tier.

Net result: the tool is minimal to own, but two of Nordwind's intended uses change the verdict, and one is simply off the table.

---

How Confir Helps

Add Clari to your AI register and Confir's rule-based engine asks not what the tool is but how you use it. The intake separates "forecasting and coaching" from "automated worker evaluation" and from "emotion inference", and routes each to its correct outcome — minimal, Annex III point 4(b) high-risk, or the Article 5(1)(f) prohibition. The classification is deterministic: the same answers produce the same finding, and the rule that fired is written in plain language so your DPO can audit it.

---

Related guides

• EU AI Act prohibited practices
• emotion recognition in the workplace
• employee monitoring AI and Annex III
• Article 6 high-risk classification
• deployer obligations under Article 26
• GDPR and EU AI Act crosswalk
• how to classify AI by use