In this article (9 sections)
- Why can scheduling and dispatch be high-risk?
- Can “we only use it to support scheduling” qualify for the exception?
- Who is the provider and who is the deployer?
- What must a deployer do when using high-risk AI in the workplace?
- Beyond the AI Act, what other rules apply?
- ZC practice notes: where workplace AI is most often underestimated
- FAQ
- Next in the series
- Legal sources and references
Many Taiwanese equipment makers have after-sales service teams in Europe: engineers spread across several countries who go to customer sites every day to install, maintain and repair equipment based on service tickets. As ticket volumes grow, using a system to schedule and dispatch automatically is a natural step. A step further, the system takes into account each engineer’s certifications, location, past repair times and customer ratings, and decides automatically who takes which job.
Under the AI Act, a system like this may be high-risk AI. This article explains the key points of the assessment, why “we only use it to support scheduling” does not necessarily qualify for the exception, and what to watch before 2 December 2027.
The after-sales scheduling scenario in this article is a typical illustrative example for Taiwanese companies, not a specific client case.
Key takeaways
- Point 4(b) of Annex III: AI systems used to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of persons at work, are high-risk.
- The exceptions in Article 6(3) (narrow procedural task, supporting human assessment and so on) have one hard limit: a system that performs profiling of natural persons is always high-risk.
- The high-risk rules apply from 2 December 2027; systems placed on the market before then are also covered if their design is significantly changed afterwards (Article 111(2)).
- The same system must also be checked against automated decision-making under GDPR Article 22, and against Article 26(7): before use in the workplace, workers’ representatives and affected workers must be informed.
Why can scheduling and dispatch be high-risk?
Point 4 of Annex III, “Employment, workers’ management and access to self-employment”, has two points:
| Point | Use |
|---|---|
| (a) | Recruitment or selection: placing targeted job advertisements, analysing and filtering job applications, evaluating candidates |
| (b) | Decisions affecting terms of work-related relationships, promotion or termination; allocating tasks based on individual behaviour or personal traits or characteristics; monitoring and evaluating the performance and behaviour of persons in such relationships |
Point (b) refers to “work-related contractual relationships”, which is not limited to formal employment. An after-sales dispatch system deserves a close look if it does any of the following:
- decides who takes which job based on engineers’ past performance (repair time, first-time fix rate, customer ratings);
- adjusts dispatch based on engineers’ behavioural data (location history, response speed, job acceptance records);
- produces scores or statistics that are used to evaluate engineers’ performance or that affect bonuses or contract renewal.
By contrast, a system that only matches jobs mechanically on the basis of the ticket content, required certifications and the shift roster, without assessing individual performance or behaviour, may lead to a different conclusion.
Can “we only use it to support scheduling” qualify for the exception?
Article 6(3) allows an Annex III system not to be considered high-risk where it does not pose a significant risk, subject to conditions including: performing a narrow procedural task, improving the result of a previously completed human activity, detecting deviations from decision-making patterns, or performing only a preparatory task to an assessment.
But the last subparagraph of the same paragraph is clear: an Annex III AI system is always considered high-risk where it performs profiling of natural persons. Profiling follows the definition in GDPR Article 4(4): automated processing of personal data to evaluate certain aspects of a person, in particular to analyse or predict their performance at work, reliability, behaviour, location or movements.
Dispatching on the basis of engineers’ past performance and location data is hard to describe as anything other than profiling. This is where dispatch systems are most often misjudged: the system appears only to “recommend”, but its assessment of people is itself what defeats the exception. The conditions for the exception and the evidence to keep are covered in Part 9.
What data does your dispatch system use?
- Engineers' past repair times, customer ratings, first-time fix rates
- Real-time location or movement tracks
- System scores that show up in performance reviews or bonus calculations
If any of these applies, it is worth reviewing how the system should be classified before 2 December 2027.
Who is the provider and who is the deployer?
| Scenario | Provider | Deployer |
|---|---|---|
| A dispatch system bought from a software vendor and used by the European subsidiary | Software vendor | European subsidiary |
| Developed in-house by the Taiwanese headquarters and provided to the European subsidiary | Taiwanese headquarters (puts the system into service under its own name) | European subsidiary |
| A general-purpose scheduling tool with performance scoring added, used for dispatch | May become a provider by modifying the intended purpose (Article 25(1)(c)) | European subsidiary |
Role determination is explained in full in Part 3. Pay particular attention where the group develops the system in-house: if headquarters is also the provider, it carries the full set of Article 16 obligations, including a quality management system, technical documentation, conformity assessment and registration.
What must a deployer do when using high-risk AI in the workplace?
Among the deployer obligations in Article 26, the following are especially important in a workplace setting:
- Human oversight: assign oversight to persons who have the necessary competence, training and authority (paragraph 2);
- Input data: to the extent the deployer controls it, ensure input data is relevant and sufficiently representative in view of the intended purpose (paragraph 4);
- Record-keeping: keep automatically generated logs, to the extent they are under the deployer’s control, for at least six months (paragraph 6);
- Informing workers: before use in the workplace, inform workers’ representatives and the affected workers (paragraph 7), following the information and consultation procedures of national labour law;
- Link to the DPIA: use the information provided by the provider under Article 13 to carry out the data protection impact assessment under GDPR Article 35 (paragraph 9).
Beyond the AI Act, what other rules apply?
- GDPR Article 22: decisions based solely on automated processing that produce legal effects or similarly significant effects for a person are restricted in principle, and the exceptions also require safeguards such as human intervention.
- Article 5 prohibited practices: using AI to infer employees’ emotions in the workplace (except for medical or safety reasons) has been prohibited since 2 February 2025.
- Platform Work Directive: if you dispatch jobs to contractors through a digital labour platform, Directive (EU) 2024/2831 has separate rules on algorithmic management, and Member States must transpose it by 2 December 2026.
- National labour law: the information and consultation rights of workers’ representatives and the limits on workplace monitoring differ from country to country.
Change the system, or change the process?
The same dispatch goals can be met with different system designs and management approaches, and the high-risk classification and scope of obligations change with them. Which functions to adjust and which processes to add depends on what data the system uses and how its results are used.
Annex III high-risk: applies from 2 December 2027.
ZC practice notes: where workplace AI is most often underestimated
These are patterns ZC sees repeatedly when helping companies review workplace AI. They do not refer to any specific client.
- Assuming the assessment starts with the code. AI Act classification depends on the purpose and the effect on people. The first question is how the system is used in the business process, who receives its output and who makes decisions based on it. Technical details are for checking specific questions, not the starting point.
- A blurred line between “recommend” and “decide”. If the system formally only makes recommendations but supervisors follow them almost every time, it is in practice influencing the outcome, and the Article 6(3) exception becomes hard to rely on.
- The specification and the live system differ. Parameters tuned after go-live, added exception rules and how often people override the system are often not reflected in the documentation, while authorities look at how the system works now.
- Data use quietly expands. Location or working-time data collected for scheduling is later used to review performance or calculate bonuses. The intended purpose has then changed, and the roles and obligations may change with it.
FAQ
Is AI scheduling always high-risk?
Not necessarily. Point 4(b) of Annex III targets “allocating tasks based on individual behaviour or traits” and “monitoring and evaluating performance and behaviour”. A system that only matches on job content, certifications and rosters may be assessed differently; but as soon as it profiles people, Article 6(3) cannot be used to exclude it.
The engineers we dispatch are contractors, not employees. Does it still count?
Point 4 of Annex III refers to “work-related contractual relationships” and “access to self-employment”, and is not limited to employment relationships. Where jobs are dispatched through a digital platform, the Platform Work Directive also needs to be considered.
Our system went live before 2027. Does it have to comply?
Article 111(2): systems placed on the market or put into service before the date the high-risk rules apply are covered only if their design is significantly changed after that date (with a separate deadline of 2 August 2030 for public authority deployers). For a system that is constantly updated, it is hard to keep claiming there has been “no significant change”.
Do we always need a fundamental rights impact assessment (FRIA) to use high-risk AI?
The FRIA in Article 27 applies to bodies governed by public law, private entities providing public services, and deployers of systems under points 5(b) and (c) of Annex III (credit scoring, and pricing of life and health insurance). Ordinary companies’ internal dispatch is usually outside the scope of the FRIA, but a GDPR DPIA may still be needed.
Next in the series
Part 8: Your European subsidiary uses AI to screen CVs: deployer obligations
Previous: Part 6: Your European customer wants AI documents. What should a supplier provide?
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help companies confirm how workplace AI is classified under the AI Act, and connect this with GDPR and the requirements for informing workers.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 5, 6, 25, 26, 27 and 111, Annex III: EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
- Regulation (EU) 2016/679 (GDPR), Articles 4, 22 and 35: EUR-Lex
- Directive (EU) 2024/2831 on improving working conditions in platform work: EUR-Lex
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · AI Act consolidated text (27 July 2026) · Regulation (EU) 2016/679 (General Data Protection Regulation) · Directive (EU) 2024/2831 on improving working conditions in platform work. This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI ActAnnex IIIhigh-risk AIdispatchschedulingalgorithmic managementGDPR Article 22after-sales service
