The AI Act in your business: what to do if you use AI in HR or customer service

The AI Act – EU Regulation 2024/1689 on artificial intelligence – is the world’s first comprehensive regulation of AI systems. It has applied since 1 August 2024, but the individual groups of obligations come into force gradually until 2027. The bans on AI practices apply from 2 February 2025 (Article 113(a) of the regulation), and the obligations for high-risk systems are, according to the regulation, due to start on 2 August 2026.

This article explains which obligations fall on an ordinary company that uses AI in HR, marketing, customer service or risk analysis. It is not an article for providers of LLMs (large language models). It is for you if your company has introduced a company AI assistant or an AI tool for CVs.

The structure of the AI Act – 4 risk categories

The AI Act classifies AI systems by the risk they pose to the fundamental rights of EU citizens:

| Category | Description | Status | |-----------|------|--------| | Prohibited | Practices under Article 5 | From 2 February 2025 | | High risk | Annex III (HR, education, health, etc.) | From 2 August 2026 | | Limited risk | Chatbots, deepfakes – transparency obligations | From 2 August 2026 | | Minimal risk | Spam filters, game engines | No additional requirements |

A company can have systems from different categories. A recruitment tool is “high risk”, while a chatbot on a website is “limited risk”. Each category has its own obligations.

Category 1 – prohibited practices (from 2 February 2025)

Article 5 of the AI Act lists practices that no company in the EU may use – on pain of a fine of up to EUR 35 million. The list includes:

1. Subliminal manipulation – systems that influence behaviour without the user’s conscious consent
2. Exploiting vulnerabilities – AI aimed at older people, children or people with disabilities
3. Social scoring – by public authorities (as in China)
4. Predictive policing based on personal characteristics
5. Emotion recognition at work and in schools – except for medical or safety reasons
6. Untargeted scraping of facial images from the internet to build biometric databases
7. Biometric categorisation based on sensitive data (race, religion, orientation)

For an ordinary Polish company, points 5 and 7 matter most. If you use AI to analyse employees’ emotions (for example, a system that monitors team “satisfaction”) or to classify customers on the basis of protected characteristics, you must switch these functions off.

Category 2 – high-risk systems (from 2 August 2026)

Annex III of the AI Act lists 8 areas of high-risk systems:

1. Biometrics – identifying people, biometric categorisation
2. Critical infrastructure – managing traffic and energy networks
3. Education – assessing candidates, examining, allocating pupils to classes
4. Employment – recruitment, CV screening, assessment, promotion, dismissals
5. Access to services – credit scoring, health insurance risk assessment, assessing eligibility for public benefits
6. Law enforcement – risk assessment, analysis of evidence, profiling
7. Migration and borders – visa applications, risk assessment
8. Administration of justice – support for court decisions, democratic processes

For business, areas 4 (employment) and 5 (services) matter most. If your company:

• Uses AI to filter CVs or score candidates
• Uses AI to assess employees (performance, promotions)
• Has introduced customer scoring for credit decisions
• Has AI tools for insurance risk assessment

then you are probably in the high-risk category and from August 2026 you have specific obligations.

Obligations of the deployer of a high-risk system

As a deployer (not a provider) of a high-risk AI system you must:

| Obligation | What to do in practice | |-----------|----------------------| | Use the system according to the provider’s instructions | Technical documentation, usage recommendations | | Ensure human oversight | A qualified person monitors the AI’s decisions | | Monitor operation | Log of events, anomalies and incidents | | Keep logs of activity | At least 6 months, often longer | | Inform people affected by AI decisions | A recruitment candidate, a customer in a credit assessment | | Report incidents | To the provider and to the supervisory authority |

A fundamental rights impact assessment (FRIA) must be carried out by public-law bodies and by private entities providing public services, as well as by deployers of systems for assessing creditworthiness and for pricing life and health insurance.

Category 3 – limited-risk systems

Chatbots, deepfakes and generative systems (AI assistants that write texts and generate images) fall into the limited-risk category. The obligations are lighter, but specific:

• Informing the user – that they are talking to an AI, not a human
• Labelling content – photos, videos and audio generated by AI must be labelled (“made by AI”)
• GPAI provider obligations – general-purpose AI models (foundation models) on which AI assistants run have separate provider obligations

For your company this means that a chatbot on your website must display a message such as “You are speaking with an AI assistant”. AI content generators (for example, texts and images created by AI) used in B2C marketing should be labelled so that the customer knows.

AI in HR – special attention

The most common uses of AI in Polish companies are in HR: CV screening, recruitment chatbots, candidate scoring. All of this falls into the high-risk category and requires:

1. Compliance documentation from the provider (received and approved)
2. Informing candidates – that AI assesses their CV, and their right to appeal
3. Human oversight – the recruiter approves the AI’s decisions, not just accepts them
4. Logging – every AI decision with its reasoning
5. Regular bias audits – whether the system discriminates against certain groups

What to do now

If your company does not yet have a plan for implementing the AI Act:

1. Inventory of AI systems – which tools use AI and what risk categories they fall into
2. Check for prohibitions – make sure you do not use practices prohibited since February 2025
3. Check your providers – their compliance with the AI Act and their technical documentation
4. Update your GDPR policy – include processing by AI
5. Train your staff – people who make AI-assisted decisions must know how to intervene

Summary

The AI Act has entered the phase of real obligations: bans from February 2025, high risk from August 2026 (according to the regulation; check the current deadlines). Companies that do nothing expose themselves to fines of up to EUR 35 million for prohibited practices and EUR 15 million for improper deployment of high-risk systems. See also the article on NIS2, which covers digital obligations being introduced in parallel.

A company that has an AI tool for assessing CVs sometimes thinks it is just an add-on to the recruitment system. From the AI Act’s point of view, it is a full high-risk system with its own obligations. It is enough for the provider not to have the right documentation – and the company using the system bears the consequences.

Sources: digital-strategy.ec.europa.eu/ai-act, EU Regulation 2024/1689, Annex III of the AI Act.