Performance management is a high-risk use of AI.
Under the EU AI Act (Regulation (EU) 2024/1689), AI used for employment and the management of workers sits in the high-risk category. That is the category our product operates in, so this page sets out what the regulation asks of a provider and of you as a deployer, and how our design answers it.
Discuss your AI governance requirementsFour risk levels, and we are not in the low one.
The European Commission’s regulatory framework for AI sets out four levels of risk, unacceptable, high, limited, and minimal or none, and places AI tools for employment, the management of workers and access to self-employment in the high-risk tier, with CV-sorting software given as the example.
High-risk systems carry obligations that include risk assessment and mitigation, data quality, activity logging for traceability, technical documentation, clear information for the deployer, appropriate human oversight, and robustness, accuracy and cybersecurity. Duties are split: providers build and monitor the system, deployers operate it and maintain human oversight, and national authorities supervise the market.
The application timetable has been revised since the regulation was adopted, so we deliberately do not print dates here that may move again. Check the current dates on the Commission page linked above, and confirm your own obligations with your legal advisers.
The system prepares; a person decides.
Our AI assistance sits inside the process rather than replacing it. It can pull together the context a manager needs to prepare a review, reflect on a goal or plan a feedback conversation. The person responsible for the conversation checks the evidence and decides what to say and what to record. No outcome, a rating, a promotion, a decision about someone’s employment, is produced by the system on its own.
That design is the point rather than a disclaimer. Human oversight is one of the obligations the regulation places on high-risk systems, and a process where a named person makes and records the decision is easier to evidence than one where a score appears and nobody can explain it. Our AI performance management page describes where the assistance applies, and our AI literacy guide covers training the people who use it.
Bring the questions your auditor will ask you.
Ask which features involve AI and which do not; what the assistance is generated from; where that processing happens; what is logged and for how long; what a manager sees before they decide; what information you would receive as a deployer to meet your own oversight duty; and how a person can contest or correct something recorded about them. Ask for the answers in writing and attach them to your assessment.
Article 22 of the GDPR restricts decisions based solely on automated processing, which is the same ground from a data protection angle; our GDPR page sets out that position and the controller and processor split around it.
This page is general information about the regulation and our design position, not legal advice. Obligations differ by role and by market, and compliance wording for your organisation should be settled with your own counsel.
Your questions, answered.
Is performance management high-risk under the EU AI Act?
AI used for employment and worker management is placed in the high-risk category by the regulation, with CV-sorting software given as an example. Confirm how the classification applies to your specific use with your legal advisers.
Does the AI make decisions about people?
No. It prepares context for the person responsible for the conversation, who checks the evidence and decides. Ratings, promotions and employment decisions are made and recorded by a person.
Are you the provider or are we the deployer?
Both roles exist and carry different duties. We build and monitor the system; the organisation running a review cycle operates it and holds the oversight duties of a deployer. Agree the split in writing during evaluation.
When do the high-risk obligations apply?
The timetable has been revised since adoption, so check the current dates on the European Commission's regulatory framework page rather than relying on a date quoted elsewhere.
Do you infer emotions from what people write?
Bring this question to the evaluation and ask for the answer in writing, along with the list of features that involve AI and what each is generated from.
Can we get this in writing for our assessment?
Yes. Ask for written answers on AI features, processing locations, logging, retention, human oversight and the deployer information you need. Written answers are what an assessment can rely on.
See where the assistance applies.
Explore the review experience, then bring your AI governance and oversight requirements to a conversation with our team.
Try the interactive preview
