Zoom AI Companion Under the EU AI Act: Meeting Summaries Are Minimal-Risk
Zoom AI Companion — summaries and recaps — is minimal-risk under the EU AI Act. The edge is using it to evaluate staff; emotion inference is banned.
Zoom AI Companion — meeting summaries, recaps, action items and chat compose — is a minimal-risk use under the EU AI Act, Regulation (EU) 2024/1689. Summarising a call is not one of the high-risk uses listed in Annex III, so the heavy regime does not attach. As with other workplace assistants, the only line to watch is whether you point it at evaluating people rather than helping them.
Why it is minimal-risk
Article 6(2) makes a system high-risk only where its intended purpose sits in Annex III — recruitment, credit scoring, biometric identification, and the rest. Summarising meetings and drafting follow-ups is none of those. So Zoom AI Companion sits in the minimal-risk tier, with no mandatory AI Act obligations.
What still applies is light: Article 4 AI literacy (in force since 2 February 2025, for all AI) for staff, and your GDPR controls — meeting transcripts and recordings are personal data, and most member states require that participants are informed before a meeting is recorded or transcribed.
The watch-item: evaluating employees
The line is the same as for any workplace AI. Using Companion to summarise is minimal-risk; using its output to monitor or evaluate workers — scoring participation, ranking performance from meeting behaviour — moves toward an Annex III point 4(b) high-risk use. And using AI to infer employees' emotions in the workplace is prohibited under Article 5(1)(f), in force since 2 February 2025, with the top penalty tier. Keep Companion to summaries and actions, not people-scoring.
Provider or deployer?
You are a deployer under Article 26; Zoom is the provider, and the underlying general-purpose model carries its GPAI duties (Articles 51–55) with the model provider. The Article 25 flip applies only if you substantially modify, rebrand, or repurpose it into a high-risk use.
Timeline and penalties
Article 5 prohibitions and Article 4 literacy are in force since 2 February 2025; GPAI since 2 August 2025; Article 50 transparency from 2 August 2026 (rarely relevant for an internal tool). Stand-alone high-risk Annex III obligations, originally 2 August 2026 in the statute, are deferred to 2 December 2027 under the Digital Omnibus, now adopted by Parliament (16 June 2026) and Council (29 June 2026) and pending only Official Journal publication. Penalties under Article 99: up to €35 million or 7% for prohibited practices (99(3)); up to €15 million or 3% for most breaches (99(4)); up to €7.5 million or 1% for misleading information (99(5)); SMEs capped at the lower figure under Article 99(6).
Worked example: a 130-person consultancy
Adriatic Advisory, a 130-person consultancy in Zagreb, uses Companion to summarise client and internal calls. Minimal risk — literacy, plus a recording-consent notice for GDPR. When a manager asks whether Companion could "rate how engaged each person was in the standup," the firm declines: that drifts toward Annex III 4(b) worker evaluation, and any emotion read would be prohibited under Article 5(1)(f). Companion stays a note-taker.
How Confir helps
Confir records Companion as a minimal-risk tool with its literacy and GDPR notes, and flags the drift to a high-risk worker-evaluation use or a prohibited emotion-inference use before it ships. The engine is deterministic and rule-based — the same description yields the same cited finding.
Frequently asked questions
Is Zoom AI Companion high-risk under the EU AI Act?
No. Meeting summaries, recaps and chat compose are minimal-risk, because they are not an Annex III use case. The duty in normal use is Article 4 AI literacy, plus GDPR for recordings and transcripts. It would only approach high-risk if repurposed to monitor or evaluate employees under Annex III point 4(b).
Can we use Companion to assess staff performance?
Be careful. Using it to monitor or evaluate workers is an Annex III point 4(b) high-risk use, and inferring employees' emotions is prohibited under Article 5(1)(f), with fines up to €35 million or 7% of turnover. Summaries and action items are fine; people-scoring is not.
Do we need consent to use Companion in meetings?
That is a GDPR and national-law question rather than an AI Act one. Meeting recordings and transcripts are personal data, and most member states require participants to be informed before recording or transcription. The AI Act adds Article 4 literacy for staff but no high-risk duty for ordinary use.
Does Companion trigger Article 50 transparency?
Generally no, because it operates internally. Article 50 applies where AI interacts with people outside the organisation or produces content published to them. Internal meeting summaries usually have nothing to disclose.
Who carries the GPAI obligations?
Zoom and the underlying model provider, under Articles 51–55 — not you as a deployer. Your duties are Article 4 literacy and your GDPR controls.
Related guides
- How AI risk classification works
- Is Slack AI high-risk under the EU AI Act?
- Article 5 prohibited practices
- Annex III high-risk use cases
- Build your AI system inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →