Is Worker-Management AI High-Risk Under the EU AI Act?
AI deciding promotions, terminations, task allocation or performance scoring is high-risk (Annex III pt 4(b)); emotion recognition at work is prohibited.
Yes. AI used to make or support decisions about an existing worker's terms of employment — promotion, termination, task allocation, or the monitoring and evaluation of performance and behaviour — is high-risk under Annex III point 4(b) of the EU AI Act. The obligations apply from 2 December 2027. And one feature is banned outright: an emotion-recognition tool at work is prohibited under Article 5(1)(f), not high-risk.
If you run a performance-scoring tool, an algorithmic task-assignment system, or a workforce-analytics product, this page tells you exactly where you stand — and where point 4(b) ends and the recruitment rule in point 4(a) begins.
What Annex III point 4(b) covers
Annex III point 4 splits employment AI into two limbs. Point 4(a) is recruitment — AI for placing job ads, screening applications, and evaluating candidates before they are hired. Point 4(b) is everything that happens to people who already work for you. It designates as high-risk AI intended to be used:
- to make decisions affecting the terms of work-related relationships;
- to decide on promotion or termination;
- to allocate tasks based on individual behaviour, personal traits or characteristics;
- to monitor and evaluate the performance and behaviour of people in such relationships.
The reach is broad. A tool that ranks employees for a promotion round, software that scores customer-service agents on call quality, an algorithm that assigns gig or warehouse tasks by individual productivity, and a "people analytics" engine that flags underperformers all fall inside point 4(b). It does not matter whether a human makes the final call — if the AI is intended to support these decisions, it is high-risk.
The Article 6(3) narrowing filter applies in theory: a system doing only a narrow procedural task or preparatory work might fall out. But any system that profiles a worker is always high-risk, and most performance-and-behaviour tools profile by design. Treat point 4(b) systems as high-risk unless you can document a clean 6(3) exemption, and register under Article 49 regardless.
The line you cannot cross: emotion recognition at work is prohibited
The single most important boundary for workforce AI: Article 5(1)(f) prohibits AI to infer the emotions of a natural person in the workplace. This is not a high-risk use you can document and run — it is banned, in force since 2 February 2025, with a narrow exception only for medical or safety reasons.
So a tool that scores a sales rep's "enthusiasm" from voice tone on calls, reads "engagement" or "stress" from a webcam during meetings, or rates "attitude" from facial affect is a prohibited practice carrying the top penalty — up to €35 million or 7% of total worldwide annual turnover (Article 99(3)). Monitoring what a worker does (keystrokes, output, call-handling time) can be lawful high-risk performance monitoring under point 4(b); inferring what a worker feels is prohibited. Keep the two apart.
| Workplace AI feature | Classification | Legal basis |
|---|---|---|
| Performance scoring / productivity monitoring | High-risk | Annex III pt 4(b) |
| Promotion or termination decision support | High-risk | Annex III pt 4(b) |
| Algorithmic task allocation by individual behaviour | High-risk | Annex III pt 4(b) |
| CV screening of external applicants | High-risk | Annex III pt 4(a) |
| Inferring worker emotion/affect (stress, enthusiasm) | Prohibited | Art 5(1)(f) |
Deployer duties under Article 26 — and the duty to inform workers' representatives
Most companies using workforce AI are deployers, not providers: they buy the tool and apply it to their own staff. The deployer duties sit in Article 26: use the system per the provider's instructions, assign competent human oversight (Article 14), monitor operation and keep the automatically generated logs, and feed serious issues back up the chain.
One duty is specific to employment and easy to miss. Article 26(7) requires that, before putting a high-risk system into use in the workplace, deployers who are employers inform the workers' representatives and the affected workers that they will be subject to it. This is an information duty owed in advance — separate from, and additional to, any consultation rights under national labour law or the GDPR. Run the notification before go-live, not after.
Where the deployer is a public body or public-service provider, an Article 27 FRIA is also required. A private employer deploying a performance tool generally does not owe a FRIA — but it always owes the Article 26 duties, including the 26(7) information of workers' representatives.
Worked example: NordWarehouse OÜ
NordWarehouse OÜ is an Estonian logistics operator, ~400 employees, ~€55M turnover. It buys three AI features from a vendor. (1) A shift-allocation engine that assigns picking tasks by each worker's measured speed and error rate — high-risk under point 4(b); NordWarehouse is the deployer and must run Article 14 oversight and inform the workers' council under Article 26(7) before switching it on. (2) A performance dashboard that ranks pickers and feeds the annual review — also point 4(b) high-risk. (3) A vendor add-on that reads facial "fatigue and mood" from line cameras to flag disengaged staff — this is prohibited under Article 5(1)(f). NordWarehouse must refuse the feature; deploying it would expose it to the 7% tier.
Because NordWarehouse is a private employer, it does not owe an Article 27 FRIA. Its binding obligations are the Article 26 deployer duties plus the advance information of workers' representatives.
How Confir helps
Confir registers each workforce AI use, derives the role (deployer under Article 26 in most cases, provider under Article 16 if you build the tool), and tests the use against Article 5 before Annex III — so an emotion-recognition feature is flagged as prohibited rather than scoped as high-risk. For point 4(b) systems it surfaces the deployer checklist, including the Article 26(7) duty to inform workers' representatives, and the Article 14 oversight requirement. The engine is deterministic and rule-based, with each finding cited to the Article or Annex point that fired.
Related guides
- Employment decision AI under Annex III
- Employee monitoring AI and the EU AI Act
- Recruitment screening AI (Annex III point 4(a))
- Emotion recognition in the workplace is prohibited
- Deployer obligations under Article 26
- Human oversight under Article 14
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →