Workplace AI inventory needs a use-level EU risk classification

Classify the use, affected person, and decision

Create a separate inventory row for every workforce use, even when several uses share a model or vendor. Record the employing entity, jurisdictions, worker or candidate population, lifecycle stage, business purpose, inputs, inferred attributes, output, person affected, decision or recommendation, decision-maker, degree of influence, notice, accommodation and challenge route, source systems, integrations, and effective date. Classify the exact use against prohibited-practice, high-risk, transparency, and other applicable categories with a qualified owner and cited legal basis. A product used to draft an internal FAQ can present a different consequence from the same product ranking candidates or recommending a performance action. ^[1]

Keep prohibited and high-risk paths operationally separate

For a suspected prohibited practice, define a stop path that prevents collection, inference, display, export, and downstream reuse rather than relying on a policy label. For a high-risk employment use, map provider and deployer responsibilities to the buyer's actual process: risk assessment, representative data, logs, documentation, instructions, human oversight, accuracy, robustness, cybersecurity, incident handling, and monitoring. Preserve unknowns when the organization cannot determine whether a feature is enabled or materially influences an outcome. A human click at the end does not by itself remove the system from the decision chain; document what the person sees, can challenge, and can change. ^[1]

Test changes in purpose and influence

Run change scenarios before approval: a sourcing tool begins prioritizing applicants; a learning recommendation enters promotion review; a scheduling forecast affects shift access; a service chatbot starts inferring sentiment; or a manager dashboard adds a risk score. Each change should trigger a fresh classification, notice, data, human-oversight, accommodation, worker-consultation, monitoring, and legal review. Link the inventory to configuration and procurement records so a feature flag, model update, new integration, or local practice cannot change the use without a visible review event. Preserve earlier classifications and the facts that supported them instead of overwriting the history.

Give workers and owners a usable correction path

Tell affected people when appropriate what system is used, for which purpose, what information matters, who remains accountable, and how to request accommodation, correct data, challenge an output, or reach a person. Test the path with a missing record, inaccessible notice, disputed inference, changed jurisdiction, disabled feature, and urgent employment decision. Review inventory completeness with HR, employment counsel, privacy, labor, accessibility, security, procurement, technology, and worker representatives where applicable. The CHRO should hold deployment when the organization cannot identify the use, risk category, accountable decision-maker, or practical remedy at the point an employment consequence occurs.

Turn this source into a reviewable decision

For AI for CHROs, use this briefing as a dated decision record rather than a substitute for the source. Preserve European Commission: AI Act, the exact URL, the October 6, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Recruiting and candidate support; Performance and work allocation; People analytics and employee listening; Workplace AI governance and change. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

The European Commission is the policy source. Its current AI Act overview, checked October 6, 2026, summarizes risk categories, examples, selected obligations, and implementation timing; it is not a complete legal analysis and the regulation, amendments, delegated acts, guidance, national implementation, and facts of a specific use control. This briefing does not classify any named buyer, vendor, product, or employment practice and does not establish feature enablement, jurisdiction, material influence, compliance, fairness, accessibility, worker impact, or outcome. Verify the official legal text and current guidance, exact use and configuration, employment-decision process, data and logs, notices and challenge records, and qualified HR, employee-relations, labor, works-council, accessibility, privacy, security, regulatory, and legal review. No attributable post-cutoff material change is established.