Slack AI Under the EU AI Act: Search Is Minimal, Monitoring Is Not
Slack AI search and summaries are minimal-risk under the EU AI Act. The watch-item is worker monitoring (Annex III 4(b)); emotion inference is prohibited.
Slack AI — channel recaps, thread summaries, search answers and huddle notes — is a minimal-risk use under the EU AI Act, Regulation (EU) 2024/1689, for what it actually does. Helping people keep up with their messages is not one of the high-risk uses listed in Annex III. There is one line worth watching, precisely because Slack holds workplace communications: if you turn AI on your employees' messages to monitor or evaluate them, the classification changes.
This page covers the normal case, the worker-monitoring edge, and the prohibited line above it.
Why search and summaries are minimal-risk
Article 6(2) makes a system high-risk only where its intended purpose sits in Annex III. Summarising a busy channel, finding a decision in a thread, or recapping a huddle is not on that list — it does not decide anyone's job, credit or rights. So the everyday Slack AI toolkit is minimal-risk, with no mandatory AI Act obligations and, because it is internal, no Article 50 disclosure duty either.
What still applies is light: Article 4 AI literacy (in force since 2 February 2025, for all AI) for staff, and your GDPR controls over the message content Slack AI processes — employee communications are personal data, and workplace monitoring carries its own GDPR and national-law limits regardless of the AI Act.
The watch-item: worker monitoring and evaluation
Here is the line. Annex III point 4(b) covers AI used for decisions on the terms of work, promotion, termination, task allocation, and the monitoring and evaluation of workers. Slack AI used to help individuals is minimal-risk. Slack AI repurposed to score employees — ranking people by "responsiveness", flagging sentiment in their messages, or feeding performance management — pushes toward that high-risk use, and could make you the provider under Article 25(1)(c) for building it.
A hard stop sits beyond it: using AI to infer employees' emotions in the workplace is prohibited under Article 5(1)(f) — not high-risk, banned — in force since 2 February 2025, with the top penalty tier. "Sentiment analysis of staff messages" is exactly the feature that can cross that line; avoid it rather than try to comply with it.
If a workplace use does become high-risk
Should you deploy a genuinely high-risk worker-management use, Article 26 adds a duty deployers often miss: before putting a high-risk system into use in the workplace, you must inform the workers' representatives and affected employees. Combined with the rest of Article 26 — instructions for use, human oversight under Article 14, log retention of at least six months — this is the operational layer that attaches to a monitoring use, and one more reason to keep Slack AI in its minimal-risk lane.
Provider or deployer?
You are a deployer under Article 26; Slack (Salesforce) is the provider, and any underlying general-purpose model carries its GPAI obligations (Articles 51–55) with the model provider. The Article 25 flip applies only if you substantially modify the system, rebrand it, or repurpose it into a high-risk worker-management use.
Timeline and penalties
Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI duties since 2 August 2025 (with the model provider); Article 50 transparency from 2 August 2026 (rarely relevant for an internal tool). Stand-alone high-risk Annex III legally still reads 2 August 2026 in the statute.
The Digital Omnibus defers high-risk Annex III to 2 December 2027; it was adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026, and enters into force on Official Journal publication, expected before 2 August 2026. The dates are fixed, and the "stop the clock" variant was rejected. Penalties under Article 99: up to €35 million or 7% of worldwide turnover for prohibited practices like workplace emotion inference (99(3)); up to €15 million or 3% for most other breaches (99(4)); up to €7.5 million or 1% for misleading information (99(5)); SMEs and start-ups are capped at the lower figure under Article 99(6).
Worked example: a 110-person agency
Tramline Studio, a 110-person creative agency in Manchester with EU clients and staff, uses Slack AI for channel recaps and search — minimal risk, literacy and GDPR only. An operations lead then proposes using Slack AI to "summarise each person's activity and flag who's disengaged." That is two problems at once: an Annex III point 4(b) worker-evaluation use that would be high-risk, and — if it infers mood about individuals — a potential Article 5(1)(f) prohibited use. Tramline drops the sentiment angle and keeps Slack AI to team-level recaps, leaving the estate minimal-risk. The feature was harmless on Monday and a compliance problem by Friday only because the purpose changed.
How Confir helps
Confir records Slack AI's standard uses as minimal-risk with their light literacy duty, and is built to flag the dangerous drift: a use that monitors or evaluates individual workers (Annex III 4(b), high-risk) or infers their emotions (Article 5(1)(f), prohibited). The engine is deterministic and rule-based — the same plain-English description always yields the same cited finding — so a proposed "staff insights" feature gets caught at classification, before it ships.
Frequently asked questions
Is Slack AI high-risk under the EU AI Act?
No, for its standard features. Search, thread summaries and recaps are minimal-risk uses, because helping people manage messages is not an Annex III use case. It moves toward high-risk only if you repurpose it to monitor or evaluate individual employees under Annex III point 4(b), and inferring employees' emotions is prohibited outright under Article 5(1)(f).
Can Slack AI be used to monitor employees?
Be very careful. Monitoring and evaluating workers is an Annex III point 4(b) high-risk use, with the full provider/deployer stack and a duty to inform workers' representatives before deployment under Article 26. Inferring employees' emotions from their messages is prohibited under Article 5(1)(f), with penalties up to €35 million or 7% of turnover. Standard team-level recaps avoid both.
Do we owe anything for normal Slack AI use?
Light duties only: Article 4 AI literacy for staff, and your GDPR controls over the message content it processes. Employee communications are personal data, and workplace monitoring has its own GDPR and national-law limits. There is no high-risk conformity obligation for search and summaries.
Does Slack AI trigger Article 50 transparency?
Generally no, because it operates internally rather than interacting with the public. Article 50 applies where AI interacts with people outside the organisation or produces content published to them. A purely internal summarisation tool usually has nothing to disclose.
When would Slack AI make us a provider?
Under Article 25, if you substantially modify it, rebrand a configured version as your own, or repurpose it into a high-risk worker-management use. In standard use you are the deployer under Article 26 and Slack is the provider.
Related guides
- How AI risk classification works
- Annex III high-risk use cases
- Article 5 prohibited practices
- Article 26 deployer obligations
- Build your AI system inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →