Question 1

What is the difference between a deployer and a provider under the EU AI Act?

Accepted Answer

A provider develops an AI system (or has it developed) and places it on the EU market or puts it into service under its own name or trademark (Art 3(3) of Regulation (EU) 2024/1689). A deployer is a natural or legal person using an AI system under its own authority in the course of a professional activity (Art 3(4)). Most EU HR-tech companies are deployers of third-party AI (Workday Recruiting, Greenhouse, HiBob, Microsoft Copilot, ChatGPT Enterprise, Bullhorn AI) and may simultaneously be providers of their own AI features.

Question 2

Are we a deployer if we simply use Workday or Greenhouse?

Accepted Answer

Yes. When you actively use an AI system in your recruiting or HR process, you are a deployer of that system regardless of who built it. You therefore have stand-alone obligations under Art 26 (high-risk deployer duties) and Art 50 (transparency) that cannot be contracted away to the provider.

Question 3

We sell HR-tech that contains an AI feature — are we a provider or a deployer?

Accepted Answer

Both at the same time, if you both develop and market the AI feature and also use it internally. As a provider you are subject to Art 16-22 (conformity assessment, CE marking, post-market monitoring, technical documentation). As a deployer toward your own customers you should still deliver instructions for use and logging output so customers can evidence their own Art 26 obligations.

Question 4

If we fine-tune or substantially modify a model, do we become a provider?

Accepted Answer

Yes, under Art 25(1). If you place your own name on a high-risk AI system already on the market, substantially modify a high-risk AI system, or modify the intended purpose of a non-high-risk system so it becomes high-risk, you are considered a new provider with full provider obligations. Ordinary configuration or prompt-tuning typically does not trigger Art 25; fine-tuning a model on your own data may.

Question 5

Does the EU AI Act apply to SMEs and start-ups?

Accepted Answer

Yes, the AI Act applies regardless of company size. A few specific easements exist: SMEs and start-ups get priority access to AI regulatory sandboxes (Art 62), and the cap on administrative fines under Art 99(6) is calculated as the LOWER of the fixed EUR amount and the percentage of turnover (the opposite of the rule for larger undertakings, where the HIGHER applies).

Question 6

When did the prohibitions on unacceptable AI practices (Art 5) start to apply?

Accepted Answer

2 February 2025. Art 5 prohibits, among other things, social scoring by public or private actors, manipulative AI that materially distorts behaviour to a person's detriment, real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow exceptions), and — particularly relevant for HR-tech — emotion recognition at the workplace and in educational settings, except for medical or safety reasons.

Question 7

When must we comply with Art 4 AI literacy?

Accepted Answer

Art 4 has applied since 2 February 2025 for both providers and deployers. The Commission's AI Office has confirmed there is no transition period for Art 4 itself. Active supervisory enforcement by national market-surveillance authorities begins 2 August 2026, but the substantive duty is in force today.

Question 8

When do Art 50 transparency obligations for deployers start to apply?

Accepted Answer

2 August 2026. Deployers that generate or manipulate image, audio or video that constitutes a deepfake must disclose that the content is artificially generated or manipulated (Art 50(4)). Deployers using emotion-recognition or biometric-categorisation systems must inform the natural persons exposed to the system (Art 50(3)). AI-generated text published to inform the public on matters of public interest must be labelled as artificially generated unless it has undergone human editorial review with editorial responsibility.

Question 9

When do the Annex III high-risk obligations start to apply?

Accepted Answer

The original deadline was 2 August 2026 (Art 113(c)). The Digital Omnibus (European Parliament endorsed 16 June 2026) defers the stand-alone Annex III high-risk obligations to 2 December 2027 (and AI embedded in Annex I regulated products to 2 August 2028). Council formal adoption and Official Journal publication are the remaining procedural steps; until then the original 2 August 2026 date stands, so treat 2 December 2027 as the proposed (not-yet-adopted) Omnibus deferral.

Question 10

What is the current status of the Digital Omnibus proposal?

Accepted Answer

Provisional political (trilogue) agreement was reached on 7 May 2026; the European Parliament formally endorsed it on 16 June 2026, deferring stand-alone Annex III high-risk obligations to 2 December 2027. Council formal adoption and Official Journal publication are the remaining procedural steps. The Omnibus does not touch Art 4 (AI literacy), Art 5 (prohibitions), Art 50 (transparency) or the General-Purpose AI obligations in Chapter V — those continue on their original timelines. Plan around the proposed Digital Omnibus deferral to 2 December 2027 for Annex III high-risk obligations (2 August 2026 remains the binding date until the Omnibus is formally adopted).

Question 11

Is recruiting AI high-risk?

Accepted Answer

Yes. Annex III point 4(a) classifies AI systems intended to be used for the recruitment or selection of natural persons as high-risk, including systems used to place targeted job advertisements, to analyse and filter applications, and to evaluate candidates. Applicant tracking systems with AI scoring, CV screening, video-interview analysis and resume parsing typically fall into this category.

Question 12

Is worker monitoring and performance evaluation high-risk?

Accepted Answer

Yes, when it goes beyond neutral time tracking. Annex III point 4(b) covers AI intended to be used to make or materially influence decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, the allocation of tasks based on individual behaviour or personal traits, and the monitoring and evaluation of the performance and behaviour of persons in such relationships. Workforce-analytics scoring, productivity-scoring and behaviour-based dashboards are typically caught.

Question 13

Are employee-facing chatbots (HR helpdesks, policy bots) high-risk?

Accepted Answer

Usually no, not on their own. A pure information chatbot primarily triggers the Art 50(1) transparency duty (the user must know they are interacting with an AI). However, if the chatbot makes or materially supports decisions on terms of employment, performance or access — for example automatically approving leave requests, escalating grievances or scoring employee feedback — it can shift into Annex III point 4 high-risk territory.

Question 14

Our AI feature is a small part of a larger product — is it still high-risk?

Accepted Answer

Feature size does not decide the question. What matters is whether the AI system is intended for a high-risk use case under Annex III and whether it has a significant influence on the outcome of the decision-making process (Art 6(3)). The Art 6(3) carve-out for narrow procedural tasks (pattern detection, preparatory tasks, improvement of completed human activity without material influence) must be documented in writing and registered in the EU database before placing on the market — it is not an automatic exemption.

Question 15

What are the main Art 26 deployer obligations for high-risk AI?

Accepted Answer

The principal duties: (a) take technical and organisational measures to ensure the system is used in accordance with the instructions for use, (b) assign human oversight to natural persons with the necessary competence, training and authority to intervene, (c) ensure that input data is relevant and sufficiently representative for the intended purpose where the deployer controls the input, (d) monitor the operation of the system and report serious incidents to the provider and the relevant national market-surveillance authority, (e) keep automatically generated logs for at least 6 months, (f) inform affected workers and their representatives before the system is put into service at the workplace, (g) coordinate with GDPR data protection impact assessments where relevant, and — for public bodies and certain private deployers — carry out a Fundamental Rights Impact Assessment under Art 27.

Question 16

What transparency obligations do we owe to our own employees?

Accepted Answer

Art 26(7) requires deployers of high-risk AI at the workplace to inform workers' representatives and the affected workers — before the system is put into service — that they will be subject to the use of a high-risk AI system. This duty is independent of the GDPR Art 13/14 information duties and any national co-determination / works-council rules. The information must be understandable (not just a legal-technical notice) and documented.

Question 17

What is a Fundamental Rights Impact Assessment (FRIA)?

Accepted Answer

Art 27 requires deployers that are bodies governed by public law, private operators providing public services, and deployers of specific high-risk AI listed in Annex III points 5(b) and 5(c) (creditworthiness and life or health insurance risk assessment) to carry out a FRIA before putting the system into service. The FRIA describes the deployer's processes in which the system will be used, the period and frequency of use, the categories of affected natural persons, the specific risks of harm and the human-oversight measures. The result must be notified to the national market-surveillance authority. A FRIA is not the same as a GDPR DPIA, but the two can be coordinated.

Question 18

What does Art 50 transparency look like in practice for deployers?

Accepted Answer

Three practical things: (1) chatbots and conversational AI: end-users must be informed they are interacting with an AI system unless that is obvious to a reasonably well-informed person (Art 50(1) applies to providers, but deployer-side disclosure is best practice). (2) AI-generated or manipulated image, audio or video that constitutes a deepfake: the DEPLOYER must disclose that the content has been artificially generated or manipulated (Art 50(4)). (3) AI-generated text published to inform the public on matters of public interest: must be labelled as artificially generated unless the content has undergone human editorial review and a natural or legal person holds editorial responsibility (Art 50(4)). Disclosure must be clear, distinguishable and provided no later than at the time of the first interaction or exposure.

Question 19

What does Art 4 AI literacy mean in practice, and what should a register contain?

Accepted Answer

Art 4 requires providers and deployers to take measures to ensure a 'sufficient level' of AI literacy for staff and other persons operating or using AI systems on their behalf, taking into account their technical knowledge, experience, education, training and the context of use. A useful register typically contains: a list of roles with AI exposure, competency requirements per role, completed training activities (date, content, attendee list), evaluation method, and documentation of ongoing follow-up. The required level is contextual — an HR administrator using Copilot for candidate communication needs a different level than a data scientist training your own models.

Question 20

How large can fines under the EU AI Act be?

Accepted Answer

Three tiers under Art 99: (1) Art 99(3) — breach of Art 5 (prohibited practices): up to 35 million EUR or 7% of total worldwide annual turnover, whichever is higher. (2) Art 99(4) — breach of other obligations including Art 16-29 (provider and deployer duties), Art 50 transparency and obligations on notified bodies: up to 15 million EUR or 3%. (3) Art 99(5) — supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request: up to 7.5 million EUR or 1%. For SMEs and start-ups, the LOWER of the two amounts applies (Art 99(6)).

Question 21

Who enforces the EU AI Act in each Member State?

Accepted Answer

Each Member State must designate one or more national competent authorities, including at least one notifying authority and one market-surveillance authority, and notify them to the Commission by 2 August 2025 (Art 70). Enforcement is national; cross-border coordination runs through the AI Office at the Commission and the AI Board. The European Data Protection Supervisor (EDPS) acts as the market-surveillance authority for EU institutions, bodies, offices and agencies. Always verify the current designation in the Member State where you are established or where the AI system is used.

Question 22

Do the fines apply equally to SMEs and start-ups?

Accepted Answer

Yes, but the calculation is different. For SMEs (including start-ups), the fine is the LOWER of the fixed EUR amount and the percentage of turnover, per Art 99(6). This means a start-up with 500,000 EUR in turnover that breaches Art 5 can be fined up to 35,000 EUR (7% of turnover), not 35 million EUR. The supervisory authority must also take into account the SME's interests and economic viability when setting the fine.

Question 23

Who can complain or trigger an investigation?

Accepted Answer

Art 85 gives any natural or legal person the right to submit a complaint to the relevant national market-surveillance authority where they have grounds to consider that there has been an infringement of the AI Act. Affected workers, candidates, civil-society organisations and competitors can all submit complaints, which the authority must handle in line with its own procedures and inform the complainant of progress and outcome.

Question 24

What is the difference between NIS2 and the EU AI Act?

Accepted Answer

NIS2 (Directive (EU) 2022/2555) is a cybersecurity regime requiring risk management, incident handling, supply-chain security and reporting from essential and important entities in 18 listed sectors. The AI Act regulates AI systems specifically — risk classification, transparency, human oversight, bias and quality of training data. An HR-tech company can be subject to both: NIS2 if it falls within a listed sector and meets the size thresholds, the AI Act independently whenever it provides or deploys AI systems in the Union.

Question 25

Is HR-tech caught by NIS2?

Accepted Answer

It depends on three factors: (1) sector — Annex I and II to NIS2 list digital infrastructure, cloud computing service providers, data-centre service providers, managed service providers and managed security service providers, which can cover the underlying infrastructure that HR-tech runs on, (2) size — at least medium-sized (50+ headcount OR more than 10 million EUR annual turnover) for most sectors, with smaller-entity carve-outs for criticality, (3) the concrete service offered. Pure HR-SaaS sitting on top of cloud is typically not caught directly by NIS2 unless it qualifies as a digital service provider or critical service in its Member State; the underlying cloud, hosting and SOC providers usually are. Always check the registration regime in the Member State of establishment.

Question 26

What is the NIS2 transposition status across the EU?

Accepted Answer

The transposition deadline was 17 October 2024 (Art 41). By May 2026, 22 of the 27 Member States had transposing legislation in force; France, Ireland, Luxembourg, the Netherlands and Spain were still in the legislative procedure per the ECSO transposition tracker. This means an EU-wide HR-tech vendor must work Member State by Member State to identify which national NIS2 law applies, the local supervisory authority, registration cut-off and incident-reporting workflow.

Question 27

What incident-reporting timelines apply under NIS2?

Accepted Answer

Art 23 NIS2 imposes a layered notification regime to the CSIRT or competent authority: an EARLY WARNING within 24 hours of becoming aware of a significant incident (with an indication of whether the incident is suspected to be of malicious origin), an INCIDENT NOTIFICATION within 72 hours with an initial assessment of severity and impact, and a FINAL REPORT no later than one month after the incident notification (or a progress report if the incident is ongoing). National laws may add sector-specific obligations on top.

Question 28

Is PowerQuant a law firm?

Accepted Answer

No. PowerQuant ApS (Danish CVR 46274067) is a technical documentation and evidence vendor. We cite EU regulation text verbatim and deliver compiled compliance evidence (AI inventory, Art 4 register, Art 50 disclosure pack, Annex III scope assessment, FRIA templates, Art 26 deployer-control gap analysis). For binding legal interpretation of specific cases, liability questions or litigation, please engage a specialised AI/IT law firm in your jurisdiction.

Question 29

How long does Module 1 take, and what do I receive?

Accepted Answer

Five business days from booking. You receive an AI inventory of your in-use AI systems, an Art 4 AI-literacy register, a role-based controls memo, an Art 50 disclosure pack (copy-ready text for chatbots, generative AI, deepfakes where relevant) and a gap analysis against the Art 26 deployer obligations. Deliverables are PDF (PDF/A-4), JSON and Markdown — all Ed25519-signed and source-cited to the regulation. Fixed price per the .eu pricing page; the underlying Module 1 reference price on the Danish site is 10,999 DKK ex. VAT per AI system.

Question 30

Where is data processed?

Accepted Answer

Within the EU. PowerQuant uses EU-hosted infrastructure and processes customer-uploaded compliance evidence inside the EU. Sub-processors and the data-residency table are listed at /en/trust/sub-processors. We act as your processor under GDPR Art 28 and sign a data processing agreement before any personal data is shared.

Frequently asked questions

1. Who does the law apply to? (Roles)