AI Employee Monitoring as High-Risk AI Under the EU AI Act

What the regulation treats as high-risk in the workplace

Recital 57 states that AI systems used in employment and worker management should be classified as high-risk. The functions it names include recruitment and selection, decisions affecting the terms of the work-related relationship, promotion and termination, allocating tasks on the basis of individual behaviour, personal traits or characteristics, and monitoring or evaluating persons in work-related contractual relationships. The stated reason is the appreciable impact on future career prospects, livelihoods and workers' rights.

Recital 52 adds the logic that governs classification: a stand-alone AI system is high-risk in light of its intended purpose, where it poses a high risk of harm to health, safety or fundamental rights and is used in one of the pre-defined areas in the Regulation. Classification therefore follows what a system is for and what it does to individuals, not the technology underneath.

In practice, two tools with similar analytics can land in different places. A dashboard that aggregates team throughput for capacity planning is a different proposition from a tool that scores each worker and feeds the score into task allocation or review. The first question for any use case is which of the recital 57 functions it performs, if any.

The Article 6 derogation and the profiling limit

Article 6 provides that an AI system is considered high-risk where both of its listed conditions are fulfilled. It then provides a derogation from Article 6(2): an Annex III system is not considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.

Two consequences follow for compliance teams. First, the derogation turns on influence over decisions. A record of how system outputs feed into decisions about individual workers is the evidence that any "not high-risk" conclusion depends on. If a manager routinely accepts a ranking without independent review, the claim that the output does not materially influence the decision becomes difficult to defend.

Second, the derogation has a hard limit. An Annex III system is always considered high-risk where it performs profiling of natural persons. Any tool that ranks, scores or predicts individual employee behaviour needs a profiling analysis before anyone reaches a derogation conclusion. Legal classification, including whether a capability is prohibited outright, is a determination for the deployer's counsel and compliance function.

Where enforcement in the execution path fits

Runtime evidence answers one specific question: what was this system permitted to do at the moment it acted, and what did it do. That is the question a regulator or auditor asks once a use case is in scope. It does not establish classification, intended-purpose documentation, or anything on the provider side.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Each individual interaction or tool call can be allowed, redacted, blocked, rate limited, or escalated for human approval. Enforcement generates audit-ready evidence mapped to the EU AI Act and other frameworks. Deployment is self-managed in the customer cloud, with configurable retention and data residency.

The limits matter. Trussed does not determine legal classification. It does not replace conformity assessment, provider obligations, or worker-notification processes. It does not provide model or dataset provenance, transaction-level governance, or end-to-end tracing of agentic workflows. Its scope is individual interactions and tool calls, and its evidence supports the oversight and record-keeping parts of a compliance programme without standing in for the rest.