Is the AI in our CRM or HR system covered by the EU AI Act?

Which CRM and HR uses are high-risk?

• The ones point 4 of Annex III lists, whatever system they run in.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 4 of Annex III: AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates, and AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.
• Point 5(b) of Annex III: AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score are high-risk, with the exception of AI systems used for the purpose of detecting financial fraud.

What does the deployer owe for a high-risk HR feature?

The duties of Article 26, among them these three. Every paragraph, with its exceptions: what a deployer owes under Article 26.

• Article 26(1) and (2): take appropriate technical and organisational measures to use the system in accordance with its instructions for use, and assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
• Article 26(7): before putting into service or using a high-risk AI system at the workplace, a deployer that is an employer informs the workers’ representatives and the affected workers that they will be subject to it, where applicable under the rules and procedures of Union and national law and practice on informing workers.
• Article 26(11): a deployer of an Annex III system that makes or assists in making decisions related to natural persons informs them that they are subject to its use, without prejudice to Article 50. For high-risk systems used for law enforcement purposes, Article 13 of Directive (EU) 2016/680 applies.

What applies to every AI feature?

• Article 4 on AI literacy, and the prohibitions, including emotion inference at the workplace.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).

• Article 4(1), as replaced by Regulation (EU) 2026/1744: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use, and considering the persons or groups of persons on whom the systems are to be used. The obligation does not require them to guarantee any specific level of AI literacy of any individual.
• Article 5(1), first subparagraph, point (f): placing on the market, putting into service for this specific purpose or using AI systems to infer the emotions of a natural person in the areas of workplace and education institutions is prohibited, except where the use is intended to be put in place or into the market for medical or safety reasons.