High-Risk AI Systems Under the EU AI Act — How HR, Credit, and Education Change the Rules

Your recruiting software uses AI to screen resumes? Or a predictive model to approve loans? Then you are already inside the perimeter of the EU AI Act. It's not a question of 'if' it applies to you, but 'how exposed' you are. We at Meteora Web see it every day: companies that invested in automation without knowing those tools fall into the 'high-risk' category. And fines start at €35 million or 7% of global annual turnover. Not numbers to joke about.

In this operational guide, we focus on the three sectors most impacted by the EU AI Act: human resources, credit, and education. We explain which obligations arise, how to classify your system, and what to do right now to avoid non-compliance.

Which high-risk AI algorithms under the EU AI Act affect HR?

The EU AI Act lists in Annex III the areas where an AI system is considered high-risk. Among them: employment, worker management, and access to self-employment. Specifically:

• Recruitment and candidate selection systems (e.g., automated CV screening, skill assessment via AI).
• Tools that influence working conditions, promotion, or termination (e.g., performance review algorithms or predictive dismissal).
• Employee monitoring systems (e.g., email analysis, office movement tracking).

Why high-risk? Because they can discriminate (age, gender, ethnicity) and impact fundamental rights like privacy and equal treatment. The AI Act requires these systems to be transparent, traceable, and subject to conformity assessment.

Immediate steps for HR compliance

If you use an ATS (Applicant Tracking System) with AI, ask:

1. Does the provider have an EU AI Act declaration of conformity?
2. Is the training data representative and unbiased? (Example: a model trained only on male CVs may penalize women).
3. Have you implemented a log of automated decisions? Every system choice must be traceable and explainable.

Operational tip: Add a clause in supplier contracts requiring technical documentation per Article 11 of the AI Act.

How does credit management change under high-risk AI rules?

The financial sector is among the most impacted. The AI Act classifies as high-risk systems used to evaluate the creditworthiness of natural persons and determine their access to essential financial services (mortgages, loans, insurance). In short: your AI-based credit scoring is under scrutiny.

What changes compared to GDPR? GDPR already required explainability for automated decisions (Art. 22). The AI Act adds technical requirements: robustness, accuracy, cybersecurity, and a documented Risk Management System.

Concrete example: a fintech issuing micro-loans

We at Meteora Web worked with a client using a machine learning model to approve loans. The model was a black box: no one knew why an applicant was rejected. Under the AI Act, that's no longer enough. You must:

• Document the variables used and their weight.
• Verify no bias (e.g., penalizing residents in certain areas).
• Provide a comprehensible explanation to the customer (not just 'score was insufficient').

Immediate action: If you issue digital credit, log every decision in an auditable database. Example MySQL schema:

CREATE TABLE credit_decisions (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT,
  requested_amount DECIMAL(10,2),
  decision ENUM('approved', 'rejected'),
  confidence_score DECIMAL(5,2),
  features_used JSON,
  explanation TEXT,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

This table lets you respond to an audit in 5 minutes, not 5 days.

What obligations for educational platforms using high-risk AI?

The third sensitive sector is education and vocational training. The AI Act includes systems used for:

• Assessing students (e.g., automated exams, proctoring software).
• Determining access to educational paths (e.g., recommendation algorithms for courses).
• Monitoring student behavior in digital environments (e.g., e-learning platforms tracking attention).

Why high-risk? Because they can determine a person's educational and professional future. A bias in an assessment algorithm can exclude entire categories of students.

The case of e-learning platforms

If your LMS (Learning Management System) uses AI to personalize content, verify:

1. The model does not discriminate based on geographic origin or economic status.
2. Data collected (time on task, clicks) is proportionate and not excessive.
3. The right to explanation is guaranteed: the student can know why a course was recommended over another.

Practical tip: Add an 'AI Transparency' section to your privacy policy, describing in plain language how AI influences decisions. We did this for a client, and it sufficed to pass an informal first audit.

How to correctly identify and classify a high-risk AI system?

Not everything using AI is high-risk. The AI Act provides an exception: if the system does not pose a significant risk to health, safety, or fundamental rights, it can be exempted. But this derogation is narrow. For HR, credit, and education, the risk is almost always deemed significant.

The 3-step test:

1. Does the system fall into one of the Annex III categories? If yes, proceed.
2. Does the system make decisions affecting rights? (e.g., selecting a candidate, denying a loan, failing an exam). If yes, it's high-risk.
3. Is there a concrete possibility of harm? (e.g., discrimination, social exclusion). If yes, it's high-risk.

If you answer 'yes' to all, you must apply the full regime: conformity assessment, technical documentation, transparency register, human oversight, accuracy.

Note: The AI Act applies even if the system is developed in-house and not commercialized. If your SME creates an internal AI tool to evaluate employees, you must comply.

What to do now? Concrete actions for compliance

Don't wait for the deadline (most rules apply by 2026). Start now with these 5 actions:

1. Map your AI systems. Inventory which software uses algorithms in your business. Include HR, credit, training.
2. Classify the risk. Apply the 3-step test above. If in doubt, consult the full Annex III list (link below).
3. Document everything. Create a register for each high-risk system: purpose, data used, accuracy metrics, audit trail.
4. Review supplier contracts. Request conformity documentation. If not provided, consider alternatives.
5. Train staff. Those using these tools must know how to interpret AI decisions and when to intervene manually.

For deeper understanding, read our EU AI Act Pillar Guide for the full framework and deadlines.

Remember: Compliance is not a cost, it's an investment. A transparent and fair AI system builds trust. And trust, in digital, is worth more than any algorithm.