How does the AI Act reach machinery and AI systems used at work?

Who is the deployer in a workplace?

A deployer is defined in Article 3 as a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the system is used in the course of a personal non professional activity. An employer that uses an AI system to recruit, allocate work, monitor performance, manage safety or operate machinery is therefore a deployer in relation to that use, even where the system was supplied by another organisation. The deployer role is distinct from the provider role. The provider develops the system and places it on the market or puts it into service under its own name. The deployer uses it. The same organisation can be a provider for one system and a deployer for another, and the duties for each role must be kept distinct in the records. A workplace that customises a supplied system, changes its intended purpose or substantially modifies it can also become a provider under Article 25, which is dealt with in the substantial modification guide. The workplace record should name the deployer for each system, the person responsible for its use, and the authority under which it is used, so that accountability is visible rather than assumed.

What workplace uses can be high risk under Annex III?

Annex III lists AI systems intended to be used for recruitment and selection, for making decisions affecting the terms of work related relationships, for allocating tasks based on behaviour or personal traits, and for monitoring and evaluating performance and behaviour of persons in work related relationships. Those uses are classified as high risk under Article 6(2), subject to the filter in Article 6(3) for narrow procedural tasks and the profiling exception, which must be checked in the consolidated text and guidance rather than assumed. The Annex III route is separate from the Annex I product route. A workplace system can be high risk under Annex III even where it is not a product and is not a safety component, and a machinery safety system can be high risk under Annex I even where it is not an employment system. A system that both manages workers and controls machinery must be assessed under both routes. The application date for Annex III high risk rules is 2 December 2027 under Article 113 as amended. That date does not remove workplace safety duties that apply earlier, and it does not remove the need to inventory workplace systems now. The inventory should record each system, its use, the Annex III category considered and the reasoning, with borderline cases marked for confirmation.

For the broader regulatory framework, see products, machinery and vehicles overview.

How do workplace safety duties interact with the AI Act?

Workplace safety law requires employers to assess risks, to provide safe systems of work, to inform and train workers, to consult workers or their representatives where required, and to maintain equipment. Those duties apply whether or not an AI system is involved, and they apply to machinery, to work organisation and to the working environment. The AI Act adds deployer duties for high risk systems, including use in accordance with instructions, human oversight, monitoring, record keeping and information to workers where required. The two sets of duties overlap in practice: a risk assessment for a machine with an AI safety function, a human oversight arrangement for an AI scheduling system, and a training record for workers who use an AI tool all serve both frameworks. The records should be coordinated so that the same risk assessment can be used for both purposes where it genuinely covers both, and so that gaps are not hidden by duplication. Where national workplace law prescribes consultation, information or agreement procedures, those procedures must be followed in their own right. A general AI Act guide cannot describe national workplace procedures, and this guide does not attempt to do so.

What about monitoring, surveillance and worker privacy?

AI systems used at work often process personal data about workers, including location, productivity, communications, biometric data and health related data. Data protection law, employment law and, where applicable, collective agreements govern that processing, with principles of lawfulness, fairness, transparency, purpose limitation, data minimisation and worker rights. The AI Act adds specific provisions, including the prohibition screen in Article 5, the transparency duties in Article 50, and the high risk requirements for Annex III employment systems. A workplace that monitors workers should record the purpose of the monitoring, the data collected, the legal basis, the information given to workers, the retention period, the access controls and the review arrangements. Covert monitoring, monitoring outside working hours, and monitoring of private communications raise distinct legal questions that need specific advice. The record should also address the effect of monitoring on workers, including stress, trust and the risk of discriminatory outcomes, and should show how those effects were considered. A system that is technically accurate can still be unlawful or unfair in its workplace use, and accuracy alone is not a sufficient answer.

What should a workplace AI inventory contain?

A workplace AI inventory should list every AI system used under the employer's authority, including systems supplied by vendors, systems embedded in machinery, systems used by contractors under the employer's direction, and shadow systems adopted informally by teams. For each system, the inventory should record the supplier, the version, the intended purpose, the workers affected, the data used, the decisions or actions it supports, the human oversight arrangement, the risk assessment, the Annex I and Annex III screening, the Article 5 screen, the transparency information given, the training provided and the review date. The inventory should be kept up to date as systems are added, updated or retired, and should be accessible to the people who need it for safety, data protection and worker consultation purposes. An inventory that lists only the systems the IT department knows about will miss the systems that present the greatest workplace risk, because informal adoption often happens where the work pressure is highest. The inventory exercise should therefore involve line managers, worker representatives and safety representatives, and should ask what tools teams actually use, not only what tools were formally procured.

Continue with machinery and safety components.

What does this guide not decide?

This guide does not decide whether any workplace system is high risk, does not describe national workplace, employment or data protection law, and does not replace a workplace risk assessment. It does not state what an employer must do for a specific workforce, a specific machine or a specific monitoring system. Workplace cases turn on national law, collective agreements, the facts of the workplace and the design of the system. An employer with a specific workplace system should confirm the AI Act screening, the workplace safety assessment and the data protection position with a competent authority or legal adviser, and should consult workers or their representatives through the procedures that apply. This guide explains the questions and the records, not the answers for a named workplace.

Frequently asked questions

Continue through this AI Act cluster

• products, machinery and vehicles overview
• machinery and safety components
• substantial modification of products
• product conformity timelines
• deployers
• high risk AI systems