Is Gig-Worker Management AI High-Risk Under the EU AI Act? Annex III Point 4(b)

Yes. The algorithm that assigns rides, ranks couriers, sets task offers by individual performance, and rates platform workers is high-risk under Annex III point 4(b) of the EU AI Act, Regulation (EU) 2024/1689 — and the work relationship it manages does not have to be classic employment for the provision to bite. One feature is off the table entirely: an algorithm that infers a worker's emotions is prohibited under Article 5(1)(f), not high-risk.

If you run a ride-hailing, delivery, or task-marketplace platform — or build the dispatch engine behind one — this page sets out exactly what point 4(b) covers, the Article 26 deployer duties (including informing workers' representatives), and how the EU's separate Platform Work Directive interacts without being part of the AI Act.

---

What Annex III point 4(b) covers — and why gig platforms are in scope

Annex III point 4 splits employment AI: point 4(a) is recruitment (advertising, screening, evaluating candidates); point 4(b) is the management of people already in a work relationship. Point 4(b) designates as high-risk AI intended to be used to make decisions affecting the terms of work-related relationships, to allocate tasks based on individual behaviour or personal traits and characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships.

The phrase "work-related relationships" is deliberately broader than a formal employment contract. The Act's recitals make clear the intention to reach platform and gig work — the very systems that allocate jobs, score performance, and shape earnings for people the platform may not classify as employees. So the dispatch/allocation engine that decides who gets the next ride or delivery by individual rating and behaviour, the performance-and-ratings system that can throttle or deactivate a worker, and the task-offer pricing tuned to individual conduct all fall inside point 4(b). It does not matter that a human does not review each assignment, and it does not matter how the platform labels the worker's status.

The Article 6(3) narrowing filter exists, but any system that profiles a natural person is always high-risk — and individualised allocation and rating engines profile by design. Treat point 4(b) systems as high-risk and register under Article 49; even a non-profiling system you document as 6(3)-exempt must still be registered, with lighter content.

The line you cannot cross: inferring worker emotion is prohibited

The single hard boundary for platform AI: Article 5(1)(f) prohibits AI to infer the emotions of a natural person in the workplace, in force since 2 February 2025, with only a narrow medical-or-safety exception. A feature that reads a driver's "mood" or "stress" from a selfie check or in-cab camera, or scores a courier's "attitude" from voice, is a banned practice — not a high-risk one you can document and run — carrying the top penalty of up to €35 million or 7% of total worldwide annual turnover (Article 99(3)). Detecting fatigue is not emotion recognition: recital 18 excludes physical states such as pain or fatigue, so a driver- or operator-fatigue alert is not prohibited under Article 5(1)(f). It can still be high-risk under Annex III point 4(b) where it monitors workers, and GDPR applies.

Keep the distinction sharp: monitoring what a worker does (acceptance rate, delivery time, route adherence) can be lawful high-risk performance monitoring under point 4(b). Inferring what a worker feels is prohibited. The first is a compliance project; the second you simply cannot ship.

Deployer duties (Article 26) — and informing workers' representatives

The platform applying the algorithm to its workforce is the deployer under Article 26; the company that built the dispatch engine is the provider under Article 16 (and substantially modifying a bought-in engine can flip a platform into the provider role under Article 25). Deployer duties: operate per the provider's instructions, assign competent human oversight (Article 14), monitor operation, and keep the automatically generated logs.

One duty is specific to the workplace and easy to overlook. Article 26(7) requires a deployer that is an employer to inform the workers' representatives and the affected workers, in advance, that they will be subject to a high-risk system. For platform work this is operationally awkward — worker representation is often thin — but the duty is owed before go-live, on top of any national labour-law consultation rights.

Where the Platform Work Directive fits — and where it does not. The EU's Platform Work Directive (Directive (EU) 2024/2831), which member states must transpose by 2 December 2026, regulates algorithmic management of platform workers directly: human review of significant automated decisions, limits on processing certain data, transparency to workers, and a presumption-of-employment mechanism. It is a separate instrument from the AI Act — different legal base, different authorities, different deadline — but it stacks on top of the point 4(b) high-risk duties for the same systems. Treat them as parallel obligations, not as one regime; this page is about the AI Act, and the Directive is a related compliance track to scope alongside it.

Deadline. The point 4(b) high-risk obligations were originally timetabled for 2 August 2026; the Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved that to a fixed 2 December 2027. The Article 5(1)(f) prohibition is separate and already in force. Plan high-risk work against 2 December 2027.

Worked example: Trekko Mobility OÜ

Trekko Mobility OÜ runs a courier-and-rides app across the Baltics, ~70 employees plus thousands of platform couriers, ~€18M turnover. It operates three AI features.

1. A dispatch engine that offers the next job based on each courier's rating, acceptance history and location — high-risk under point 4(b). Trekko is the deployer (its vendor is the provider); it must run Article 14 human oversight, keep the logs, and inform courier representatives under Article 26(7) before relaunching the engine.
2. A ratings-and-deactivation model that can suspend low-rated couriers — also point 4(b) high-risk, and squarely the kind of "significant decision" the Platform Work Directive will require be open to human review.
3. A vendor add-on that scores a courier's "engagement and mood" from periodic selfie check-ins — prohibited under Article 5(1)(f). Trekko declines it; shipping it would expose it to the 7% tier.

Because Trekko is a private operator, no Article 27 FRIA is triggered. Its binding AI-Act duties are the Article 26 deployer obligations including the 26(7) information of representatives; separately, it must prepare for the Platform Work Directive once transposed. As an SME, fines are capped at the lower of the percentage or fixed figure under Article 99(6).

How Confir helps

Confir registers each platform-management AI use, derives the role (deployer under Article 26, provider under Article 16 where the platform builds the engine), and tests the use against Article 5 before Annex III — so an emotion-inference feature is flagged as prohibited, not scoped as high-risk. For point 4(b) systems it surfaces the deployer checklist, including the Article 26(7) duty to inform workers' representatives and the Article 14 oversight requirement, and notes the parallel Platform Work Directive track. The engine is deterministic and rule-based, each finding cited to the rule that fired.

Related guides

• Worker-management AI under Annex III point 4(b)
• Employee-monitoring AI and the EU AI Act
• Employment-decision AI under Annex III
• Emotion recognition in the workplace is prohibited
• Deployer obligations under Article 26
• Provider vs deployer: which are you?