Everyday AI in HR-Business: The High-Risk Classification Trap

Tools like Microsoft Copilot are generally regarded as low-risk AI – but using them for HR-related decisions can inadvertently turn a company into a provider of a high-risk AI system under the EU AI Act. The consequences: extensive compliance obligations and fines of up to EUR 15 million or 3% of worldwide annual turnover. However, with proper governance, this risk is manageable.

Practical and seemingly unproblematic from a regulatory perspective

Tools like Microsoft Copilot or ChatGPT have become firmly embedded in the daily work routine of many companies and their employees. They assist with summarising documents, processing data and drafting texts. The barrier to entry is low and the practical benefits are immediately apparent.

The EU AI Act (Regulation (EU) 2024/1689 – Regulation on Artificial Intelligence) also reflects this broad everyday applicability: AI systems such as Copilot are typically classified as low-risk AI systems with a general purpose (General Purpose AI, GPAI). Moderate regulatory requirements apply to these systems. In particular, they are exempt from numerous obligations that apply to particularly high-risk applications, so-called high-risk AI systems.

High-risk AI systems include, among others, applications developed by the provider for specific purposes defined in the EU AI Act. These are, for example, systems used to prepare or support HR decisions – such as recruitment, promotions or dismissals.

Why a closer look is worthwhile

From December 2, 2027, key provisions of the EU AI Act on certain high-risk AI systems will become applicable, including AI systems used for HR. At that point, an aspect that has received little attention will become practically relevant: It is not only the intended purpose specified by the provider that determines whether an AI system is a high-risk AI system and who must fulfil which obligations, but also the purpose for which an AI system is actually deployed within a company, regardless of its initial classification.

High-risk AI: A question of application

Article 25 (1) (c) of the EU AI Act provides for a change in responsibility in this context: if a company uses an AI system for a purpose that goes beyond the provider's original intended purpose and falls within the high-risk scope of the regulation, the AI system becomes a (new) high-risk AI system and the company itself is deemed to be the (new) provider of that (new) high-risk AI system. This also means that the company must fulfil the extensive obligations of a provider of a high-risk AI system. These include, in particular, the preparation of technical documentation, the performance of conformity assessments, registration in an EU database and the implementation of a comprehensive quality management system – requirements that can hardly be met without the involvement of the original provider. Failure to comply with these obligations can result in fines of up to EUR 15 million or up to 3% of total worldwide annual turnover for the preceding financial year.

A scenario closer than you might think

A straightforward example illustrates how quickly a company can transition from being the deployer of a low-risk AI system to being the provider of a high-risk AI system:

A recruiter receives several hundred applications. They know Copilot from their daily work, appreciate the time savings and ask the tool to review the documents and make a pre-selection. From their perspective, a practical solution. From the perspective of the EU AI Act, the company has at that moment used a general AI tool for a high-risk application and thereby potentially shifted the intended purpose in a legally significant manner and thereby created a high-risk AI system.

Governance as an effective response

The good news: the risk is manageable. Companies that issue clear, documented internal policies prohibiting the use of AI systems for high-risk tasks as defined by the EU AI Act, such as HR-related decisions, and support these policies through targeted training, can significantly reduce the risk of liability and are in a significantly stronger legal position, even if employees breach the policies in individual cases.

The right time is now

Until December 2, 2027, there is time for structured preparation: an inventory of deployed AI systems, a review of their purposes of use and the implementation of AI usage policies. Companies that establish this framework today can continue to deploy AI systems safely under the EU AI Act.

Please feel free to contact us if you would like to assess the use of AI systems in your organisation from a legal perspective or to introduce AI usage policies.