This illustrative scenario examines how a mid-sized German technology company navigated the process of classifying its AI-powered HR screening tool under the EU AI Act – a question that has become pressing for many businesses now that core obligations are taking effect in stages. The Digital Omnibus on AI (Regulation (EU) 2026/1744) shifted the deadline for Annex III high-risk obligations from 2 August 2026 to 2 December 2027, but Article 50 transparency requirements and AI Office enforcement powers applied as scheduled on 2 August 2026. Understanding precisely which obligations apply when – and in which order – is therefore a matter of immediate commercial importance.
Client Profile and Challenge
The company in this scenario is a GmbH registered in the Handelsregister operating a human-resources platform used by corporate clients across Germany and several other EU member states. Its flagship product included an AI-powered module that ranked job applicants by scoring CVs, cross-referencing publicly available professional data and generating a shortlist for human recruiters. The module had been developed incrementally over several years and was marketed to clients as an efficiency tool rather than a decision-making system.
When the original AI Act (Regulation (EU) 2024/1689) entered into force, the company's legal team had begun a preliminary internal review, but the timeline pressure sharpened considerably when the Digital Omnibus on AI reached political agreement on 7 May 2026, was voted through by the European Parliament on 16 June 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The amended regulation preserved the 2 August 2026 application date for Article 50 transparency obligations and AI Office enforcement powers, meaning that obligations around disclosing AI-generated outputs to individuals were already live. Whether the screening tool also fell within Annex III – which would trigger the full high-risk AI systems compliance regime – had not been conclusively determined internally.
The central challenge was classification: was this tool a high-risk AI system under Annex III (employment and workers management), a system subject only to Article 50 transparency obligations, or a general-purpose AI model wrapped into a downstream product? Each classification carried materially different compliance burdens, timelines and accountability structures.
Strategy and Rationale
The company engaged outside counsel to conduct a structured classification analysis, working through the following layers in sequence:
- Intended purpose and technical architecture: The module did not merely generate summaries; it assigned ranked scores that directly influenced which candidates were presented to hiring managers. Counsel's preliminary view was that this placed the tool within Annex III's scope covering systems used in recruitment and selection of natural persons.
- Provider versus deployer analysis: Because the GmbH supplied the system to third-party HR departments under white-label licensing arrangements, it met the definition of a provider under the AI Act rather than a deployer, attracting the fuller set of provider obligations.
- General-purpose AI component review: The underlying language model used to parse CVs was licensed from a third-party foundation model provider. Counsel assessed whether the GmbH's application layer constituted sufficient fine-tuning and integration to shift classification responsibility, or whether the general-purpose AI compliance obligations remained primarily with the upstream provider. This required review of the applicable contractual documentation and the AI Office's published guidance on general-purpose AI models.
- Revised timeline mapping: Once provisional classification as a high-risk system appeared likely, the team mapped obligations against the amended deadlines. The shift of Annex III obligations to 2 December 2027 provided meaningful runway, but Article 50 transparency obligations were already applicable as of 2 August 2026, requiring immediate action on user-facing disclosures.
The strategic choice not to seek a more favourable classification on thin grounds was deliberate. The AI Office's enforcement powers – now active – and the penalty regime under the regulation meant that a misclassification discovered during a supervisory review could expose the company to significant regulatory and reputational consequences. Algorithmic transparency and correct self-classification were treated as non-negotiable starting points.
If you are uncertain how to classify an AI system deployed or sold in Germany, the team at Ferraz & Whitmore can help you work through the applicable framework. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Milestones
The engagement proceeded through the following phases:
- Phase 1 – Classification opinion: Counsel delivered a written classification memorandum setting out the basis for treating the tool as a high-risk AI system under Annex III, noting that while the full Annex III obligations did not apply until 2 December 2027, the classification itself needed to be determined before compliant product development decisions could be made.
- Phase 2 – Immediate Article 50 compliance: Given the 2 August 2026 application date, the company updated its candidate-facing documentation and recruiter interface to satisfy Article 50 transparency obligations. This included clear disclosure to applicants that their materials were being processed by an AI system and ensuring that human oversight was documented at the shortlisting stage.
- Phase 3 – Provider obligations roadmap: Counsel drafted a detailed high-risk AI compliance roadmap covering technical documentation, conformity assessment procedures, registration requirements and post-market monitoring obligations, all calibrated to the 2 December 2027 deadline. This included reviewing how the company's existing quality management processes, which had been designed for ISO certification purposes, could be mapped onto the AI Act's requirements.
- Phase 4 – Employment law interface: The German employment law dimension required separate attention. Works council information and consultation obligations under German law interact with the introduction and material modification of technical monitoring and selection systems. Counsel coordinated with specialists in employment law in Germany to ensure that the AI Act compliance project did not inadvertently create separate labour law exposure by modifying the system without appropriate works council engagement.
- Phase 5 – Contractual cascade: The company's licensing agreements with corporate clients required amendment to clearly allocate deployer obligations and to introduce contractual representations regarding the system's intended purpose, ensuring that clients using the tool did not inadvertently expand its scope in ways that could alter its risk profile.
Complications Encountered
Several complications arose that are likely to recur in similar matters:
Definitional ambiguity at the Annex III boundary. The AI Act's language on employment-related high-risk AI systems requires that the system be used to make or materially influence decisions in the context of recruitment or selection. The company argued internally that because a human recruiter always made the final decision, the system should not be classified as high-risk. Counsel's analysis rejected this framing: a ranked shortlist that structurally limited the pool of candidates considered by the recruiter was a material influence on the decision, regardless of the nominal human in the loop. This remains an area where national supervisory guidance – and potentially Bundesgerichtshof jurisprudence in later years as the regulation beds in – will be important to monitor.
General-purpose AI uncertainty. The interaction between the general-purpose AI model obligations and the downstream application classification was not fully resolved by the text of the regulation or by AI Office guidance available at the time. Counsel's approach was conservative: treat the GmbH as a provider of a high-risk system and engage with the upstream foundation model provider to obtain the documentation and cooperation that the AI Act's transparency chain requires. This required renegotiating provisions in the technology licensing agreement, which the upstream provider was not initially prepared to accommodate without amendment.
National implementation gaps. Certain aspects of the AI Act require member states to designate national competent authorities and establish procedural rules. In Germany, as at the time of this scenario, certain national implementation details remained pending or subject to ongoing regulatory development. This created uncertainty about which authority would serve as the primary point of contact for conformity assessments and market surveillance. Counsel advised proceeding on the basis of the directly applicable regulation while monitoring national legislative developments closely.
BaFin intersection. Two of the company's corporate clients were financial institutions subject to BaFin oversight. Where those clients deployed the screening tool in connection with regulated activities, there was a potential interface between AI Act obligations and BaFin's own supervisory expectations around model governance and algorithmic risk. Counsel flagged this as a cross-regulatory issue requiring separate analysis in those specific client relationships.
Outcome Category
This scenario falls within the category of proactive classification and compliance architecture matters – situations where no enforcement action had been taken but where a company identified material regulatory exposure and addressed it ahead of the relevant deadline. The company concluded the classification analysis with a defensible written opinion, achieved Article 50 compliance before the 2 August 2026 application date, and established a structured roadmap to full Annex III compliance by 2 December 2027. The works council engagement process was initiated in parallel with the technical compliance work, and the licensing agreements were updated to reflect the regulatory allocation of obligations.
No claim is made here about the commercial outcome or the absence of future regulatory scrutiny. The value of the work described lies in the structured reduction of an unquantified and growing risk, not in any guarantee of a particular result.
For businesses operating AI systems in employment contexts – whether as providers or deployers – the combination of live transparency obligations and approaching high-risk deadlines makes early legal analysis a priority. The AI Act compliance services offered by Ferraz & Whitmore are designed to support exactly this kind of structured classification and roadmap work. Reach out to us at info@ferrazwhitmore.com.
Three Transferable Lessons
Lesson 1: Classification drives everything else. The compliance obligations, timelines, documentation requirements and third-party agreements that a company needs to put in place all depend on how the system is classified. Attempting to design compliance processes before classification is settled wastes resources and risks building a programme calibrated to the wrong set of requirements. A written, legally reasoned classification opinion – revisited when the product or the regulatory framework changes – is the essential foundation.
Lesson 2: The amended timelines do not mean the work can wait. The Digital Omnibus on AI moved Annex III obligations to 2 December 2027, which appears to provide comfortable runway. In practice, the Article 50 transparency obligations that applied from 2 August 2026 require immediate product changes and legal disclosures for systems already on the market. Furthermore, the technical documentation, conformity assessment and quality management obligations that apply from 2 December 2027 require process design, supplier negotiations and organisational investment that cannot be compressed into the final months before the deadline. Companies that begin this work in 2026 and 2027 will be better positioned than those that treat the 2027 date as a distant planning horizon. A structured view of the path ahead is available at our high-risk AI roadmap analysis for Germany.
Lesson 3: AI Act compliance in employment contexts cannot be treated as a standalone workstream. German labour law, works council rights and the broader European data protection framework all interact with the obligations imposed by the AI Act. A company that achieves technical AI Act compliance while overlooking its obligation to engage with its works council before modifying a people-related IT system creates a separate category of legal risk. Conversely, a company that manages the labour law process without addressing the AI Act classification and transparency requirements faces regulatory exposure from a different direction. Integrated advice across both frameworks is not a luxury – it is a basic requirement for a defensible compliance posture.
If your business operates or plans to deploy AI systems in Germany – whether in HR, financial services or any other sector – and you would like to discuss how the current regulatory framework applies to your specific situation, we would welcome the opportunity to assist. Please contact Ferraz & Whitmore at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.