Tableau Pulse Under the EU AI Act: When Insights Become Decisions

For most companies, Tableau Pulse is minimal-risk under the EU AI Act. It generates plain-language summaries and surfaces trends over data you already have — analytics, not adjudication. Beyond the Article 4 AI-literacy duty that applies to every deployer, there are no mandatory obligations for using it to watch your KPIs.

The line moves only when the insight stops being an insight and starts being a decision about a person. If a Pulse summary feeds — or becomes — a determination about someone's creditworthiness, their access to an essential service, or their candidacy for a job, you have crossed out of analytics and into a potential Annex III use case. The tool did not change; what you do with its output did.

This page sets the default (minimal-risk), names the precise condition that flips it, and shows where the GDPR layer bites before the EU AI Act layer ever does.

---

What Tableau Pulse and Tableau AI actually do

Tableau Pulse, part of Salesforce's Tableau, delivers AI insights on top of metrics you define. It produces personalized KPI summaries, explains the "why" behind a change in natural language with visual context, answers questions in plain English with citations, and pushes those insights into Slack, Microsoft Teams, and email — in the flow of work. The wider Tableau AI family (Tableau Agent, the Concierge and Inspector skills) extends the same idea: prep data, generate visualisations, and monitor metrics through natural language.

What all of this has in common is the subject of the analysis: your own business data. Revenue, churn, pipeline, support volumes, operational metrics. Generating a narrative summary of a sales trend, or alerting you that a metric crossed a threshold, is minimal-risk. It touches no Annex III area, triggers no transparency duty toward a third party, and carries no mandatory requirement under Regulation (EU) 2024/1689 beyond Article 4 — taking measures to support the AI literacy of the staff who use it.

Underneath, Tableau AI runs on general-purpose AI (GPAI) models. Those models carry their own obligations under Chapter V (Article 53) — but those duties sit with the model provider, not with you as a deployer of Tableau. Your classification depends entirely on what you do with the output.

The default and the flip

Two scenarios, same tool, opposite classifications:

The flip condition is precise. Under Article 6 and Annex III, an AI system is high-risk when it is used in one of the listed areas — including, at point 5(b), the evaluation of the creditworthiness of natural persons or establishment of their credit score (fraud detection excluded), and at point 5(c), risk assessment and pricing for life and health insurance. If a Pulse model produces a credit-risk insight that materially drives whether a person gets a loan, that specific deployment can be high-risk — not because Tableau is a credit-scoring product, but because you have wired its output into an Annex III determination.

The decisive question, then, is not "is Tableau Pulse high-risk?" It is: does the output of this Pulse metric drive a decision about a person in an Annex III area? For the overwhelming majority of dashboards — internal performance, marketing analytics, operations — the answer is no, and the tool stays minimal-risk.

Two guardrails keep teams honest here:

• Aggregate business metrics are not decisions about individuals. A churn-rate trend across a customer base is analytics. A score attached to one named customer that gates their access to a service is an assessment.
• A human reading a chart and deciding is not the same as the AI deciding. Where Pulse merely informs a human who makes the call on their own judgment, the Article 6(3) filter may apply — an Annex III system is not high-risk where it performs a narrow task or merely supports, without replacing or unduly influencing, a completed human assessment. But that exemption must be documented, and any system that profiles natural persons is always high-risk regardless of the filter.

The GDPR layer comes first

Before the EU AI Act question even arises, Tableau Pulse raises a data-protection one — because it summarises and reasons over data that frequently includes personal data.

Where Pulse analyses customer, employee, or applicant records, you are processing personal data and the GDPR governs it independently of the AI Act:

• Lawful basis and purpose limitation (GDPR Articles 5–6). Using personal data to generate AI insights must rest on a lawful basis and stay within the purpose for which the data was collected. Feeding HR records into a metric that profiles staff can exceed the original purpose.
• Solely automated decisions (GDPR Article 22). If a Pulse-driven output leads to a decision producing legal or similarly significant effects on a person without meaningful human involvement, GDPR Article 22 restrictions apply — separate from, and additional to, any AI Act high-risk duty.
• DPIA (GDPR Article 35). High-risk processing of personal data may require a Data Protection Impact Assessment under GDPR — which is distinct from the AI Act's Fundamental Rights Impact Assessment (Article 27).

For ordinary business analytics, these obligations are routine. They become acute precisely where the EU AI Act flip also looms — when an insight starts shaping outcomes for identifiable people. Treat the GDPR check as the first gate, not an afterthought.

Worked example: Nordbalt Kredit AS, a 140-person lender

Nordbalt Kredit AS, an Estonian consumer lender, ~140 employees, ~€24M turnover, runs Tableau across the business. Two deployments, two answers.

Deployment one: portfolio analytics. The risk team uses Tableau Pulse to track default rates, delinquency trends, and collections performance across the loan book, with weekly NL summaries pushed to Slack. This is aggregate analytics over the portfolio. No individual is being scored by the AI; humans read the trends and set policy. Minimal-risk under the AI Act. The GDPR obligations on the underlying personal data still apply, but no Annex III duty attaches.

Deployment two: applicant-level credit insights. A product manager wires a Pulse metric to generate a per-applicant risk insight that loan officers then use to approve or decline applications, with the AI's score weighing heavily in the call. This sits in Annex III, point 5(b) — creditworthiness evaluation. Because the output materially drives a decision about a person, the deployment is potentially high-risk; whether it escapes via the Article 6(3) filter depends on showing the loan officer exercises genuine independent judgment — and profiling would defeat the filter outright. Nordbalt, as the deployer (Article 26), would owe deployer duties; if it substantially built or rebranded the scoring logic, Article 25 could make it the provider with the full Article 16 stack — either way from 2 December 2027, the Annex III date set by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026).

Same tool, same company — the second deployment created a high-risk programme and the first did not. The difference was a wiring decision, not a procurement one.

On exposure: a deployer breach of the high-risk requirements sits at €15,000,000 or 3% of worldwide annual turnover under Article 99(4), and for an SME the Article 99(6) cap takes the lower of the two figures.

How Confir helps

Confir registers each way your company uses a tool like Tableau Pulse as a distinct AI system and classifies it by its actual use under Articles 5 and 6 with Annex III logic — so the portfolio dashboard and the applicant-scoring deployment get different verdicts, and the Article 6(3) filter and the GDPR cross-map are applied explicitly rather than assumed. The engine is deterministic and rule-based: same intake, same finding, with the rule that fired shown in plain English. Where a deployment reaches high-risk, it scopes the Article 26 deployer duties and the Article 27 FRIA where relevant.

Frequently Asked Questions

Is Tableau Pulse high-risk under the EU AI Act?

By default, no — Tableau Pulse is minimal-risk. Generating natural-language summaries and trend insights over your business metrics touches no Annex III use case and carries no mandatory obligations beyond Article 4 AI literacy. It becomes potentially high-risk only in the specific case where its output materially drives a decision about a person in an Annex III area, such as creditworthiness or access to an essential service.

What exactly makes a Tableau Pulse deployment high-risk?

The flip happens when the AI output is wired into an Annex III decision about a natural person — for example, a per-applicant credit-risk insight that drives loan approvals (Annex III, point 5(b)). Aggregate analytics over a customer base or operational KPIs do not qualify, because no individual is being assessed by the AI. The question is whether the insight drives a decision about a person, not whether the tool is "AI".

Does the Article 6(3) exemption apply if a human reviews the insight?

It can. Article 6(3) means an Annex III system is not high-risk where it performs a narrow task or merely supports a human who makes the decision on their own judgment, without being unduly influenced. If a loan officer genuinely decides and the Pulse insight is one input among many, the filter may apply — but you must document the assessment, and any system that profiles natural persons is always high-risk regardless of the filter.

Do GDPR obligations apply to Tableau Pulse?

Yes, and often before the AI Act question arises. Where Pulse analyses personal data, you must have a lawful basis (GDPR Articles 5–6), respect purpose limitation, and watch GDPR Article 22 if an output leads to a solely automated decision with significant effects. A DPIA under GDPR Article 35 may be required — distinct from the AI Act's Article 27 FRIA. Treat the GDPR check as the first gate.

Who is responsible for the GPAI model inside Tableau AI?

The model provider. The general-purpose AI models behind Tableau AI carry Chapter V obligations under Article 53 — technical documentation, downstream information, a copyright policy, and a training-data summary — that rest with their providers, not with you as a Tableau deployer. Your obligations flow only from how you use the output, which is why classification is about deployment, not the model.

Are we a deployer or a provider when we use Tableau Pulse?

Almost always a deployer (Article 26) — you use the tool under your authority for your own purposes. You would only become a provider under Article 25 if you placed an AI system built on Pulse output on the market under your own name, substantially modified it, or repurposed it for a high-risk use. For most companies running internal dashboards, deployer status is the right answer, and the deployer duties are lighter than the provider stack.

Related guides

• Salesforce Einstein under the EU AI Act
• Is creditworthiness scoring high-risk? Annex III explained
• Article 6 — how high-risk AI systems are classified
• Article 26 — deployer obligations explained
• Deployer — definition and obligations
• High-risk AI system — definition and thresholds
• Provider vs deployer — which one are you?