As this is an EU regulation, rather than a directive, the rules apply directly in all Member States and do not need to be transposed into national law first.
Key terms in the Regulation
The AI Regulation uses a number of terms that employers need to be familiar with. An AI system is a machine-based system that operates with varying levels of autonomy and derives from inputs how it generates outputs, such as predictions, content, recommendations or decisions that may affect physical or virtual environments. This includes most modern software that makes or suggests decisions based on data, such as screening CVs, monitoring employee productivity or recommending work schedules. For a more detailed explanation of the definition of an AI system, see our previous News Update: AI literacy and the definition of AI systems.
A provider is the organisation that develops an AI system or commissions its development and markets it or puts it into use under its own name or brand, such as a software supplier or technology company. A controller is the organisation that uses an AI system professionally and under its own responsibility within its own organisation; this role applies to most employers. Please note: an employer may also be classified as a provider, for example if they use an AI application under their own name or deploy a chatbot – originally developed to handle customer enquiries – for HR purposes. In such cases, the more stringent obligations applicable to providers apply.
The distinction made by the Regulation as to whether an AI system stands alone or is embedded in a physical product makes no difference to the obligations of employers as controllers: human oversight, transparency, providing information to employees and keeping logs apply in both cases. The distinction is primarily relevant to providers.
What are the risk categories and what do they cover?
The AI Regulation classifies AI systems into four risk categories, based on the potential risks to people’s safety, rights or freedoms: prohibited AI practices, high-risk AI systems, AI subject to transparency obligations, and low-risk AI.
Prohibited AI practices
Some applications are completely prohibited. For employers, the ban on emotion recognition in the workplace is particularly relevant – for example, by analysing facial expressions or voice tones; this is only permitted for medical or safety reasons. Other prohibited practices include social scoring, manipulative AI techniques, the exploitation of vulnerabilities and, for law enforcement purposes, real-time remote biometric identification in public spaces.
High-risk AI systems
The use of high-risk AI systems is permitted, but only if they meet strict requirements. For employers, the ‘employment and workforce management’ category is particularly relevant. This includes AI systems for recruitment and selection, such as targeted job advertisements, the filtering of applications and the assessment of candidates. It also covers systems used to make decisions on promotion or dismissal, to allocate tasks based on personal characteristics, or to monitor and assess performance, such as an AI system that tracks the performance of warehouse staff. Tools that determine how an employee is feeling based on their voice or facial expressions fall under the aforementioned ban on emotion recognition. Tools that analyse only the tone or sentiment of written messages or emails do not process biometric data and are therefore not covered by that ban; however, they may qualify as high-risk AI systems if they are used to monitor or assess employees’ performance or behaviour. Other high-risk areas include education, credit scoring, critical infrastructure, biometrics and access to essential services.
Transparency obligations
Some AI systems pose a limited risk and are only required to comply with transparency obligations. A key example is AI chatbots: people must be informed that they are communicating with AI, unless this is already evident. This also applies to AI systems that generate or edit content, such as images, audio or video. These transparency obligations have applied since 2 August 2026; for providers of generative AI systems that were already on the market before that date, the labelling obligation applies from 2 December 2026. For more on the transparency obligations under the AI Act, see our previous News Update: Transparency obligations and the AI Omnibus Regulation.
Incidentally, the transparency obligations under Article 50 of the AI Regulation apply regardless of whether an AI system has been classified as high-risk. If an employer (to the extent permitted, i.e. for medical or safety reasons) deploys a system for emotion recognition or biometric categorisation, they must inform the employees concerned. A breach of Article 50 may result in fines of up to € 15 million or 3% of global annual turnover.
AI with minimal risk
Most everyday AI applications, such as spam filters, AI-powered spell-checkers and stock management software, pose a minimal risk. General legislation continues to apply in these cases, but the AI Regulation does not impose any specific requirements.
The higher the risk, the more onerous the obligations. What does the AI Regulation mean in practical terms for employers?
An employer using a high-risk AI system in the workplace must, amongst other things:
- use the system in accordance with the provider’s instructions;
- ensure human supervision by a qualified person who can intervene and, if necessary, over-ride or stop the system;
- monitor the system’s operation and report serious incidents to the provider and the compe-tent authority; and
- retain automatically generated logs, insofar as they are under the employer’s control, for at least six months, unless applicable law prescribes a longer retention period.
Before an employer puts a high-risk AI system into use in the workplace, they must inform the employees concerned and, where applicable, the works council. For a scheme concerning the processing of personal data or a system for the supervision or monitoring of employees, additional consent from the works council is required under Article 27(1)(k) and (l) of the WOR. In the case of a significant technological provision, a right to be consulted may also apply under Article 25 of the WOR; a decision taken without the required consent is null and void (Article 27(5) of the WOR). The information obligations under the GDPR also remain applicable.
Regardless of the risk level – including in the case of an AI system with minimal risk – the employer must take measures to support the AI literacy of its staff and other persons working with AI systems on its behalf (Article 4 of the AI Regulation). Since the Omnibus AI (Regulation (EU) 2026/1744, adopted on 8 July 2026 and published in the Official Journal on 24 July 2026), this obligation has been relaxed: the employer is not required to guarantee a specific level of AI literacy among individual employees, and the European Commission and the Member States must support employers in this regard. For more on AI literacy, see our previous News Update: AI literacy and the definition of AI systems.
Phased entry into force
The Regulation has come into force in phases. The prohibited AI practices and the obligation regarding AI literacy have been in force since 2 February 2025; the governance and penalty rules have been in force since 2 August 2025. For more on the penalty rules, see our previous News Update Obligations for GPAI model providers and penalties.
The Omnibus AI also introduces new prohibited practices (including AI that generates non-consensual sexual or intimate images), which will apply from 2 December 2026. The Omnibus AI has postponed the application dates for high-risk AI and has also introduced a number of targeted substantive changes (such as the relaxation of the AI literacy requirement). The core obligations for high-risk AI, such as human oversight and conformity assessment, have not been substantially altered. The transparency obligations are explained in more detail in our News Update on Transparency Obligations and the AI Omnibus Regulation.
For high-risk AI systems, such as those used for recruitment, selection and human resources management, the obligations will only apply from 2 December 2027. For AI systems in products covered by the European harmonisation legislation listed in Annex I, the date is 2 August 2028. An AI system that has already been placed on the market or put into service before that date (for example, a tool that the employer has had developed in-house and uses internally) will only need to comply with the new requirements if its design is substantially altered. The decisive factor here is whether the type and model of the system were first placed on the market or put into service before that date. For employers, this postponement does not mean they can sit back and wait: the ban on emotion recognition in the workplace, the transparency obligations and the (watered-down) obligation regarding AI literacy already apply, and the GDPR and the works council’s right of consent under the WOR also apply in full.
Preparing for the AI Regulation
The AI Regulation is not a piece of employment law, but it does impose a permanent compliance obligation on employers who use AI in the workplace. Employers would be well advised to assess their role and obligations: the higher the risk posed by the system, the stricter the requirements. Practical guidance can be found in our previous updates: Get ready for the AI Act and AI on the board agenda: best practices.