Does the EU AI Act Apply to AI-Assisted Business Decisions?

The Act regulates AI by use case, not by how important the decision feels.

The AI Act, Regulation (EU) 2024/1689 sorts AI uses into prohibited practices, high-risk uses, transparency duties and everything else. A board-level decision about entering a new market or acquiring a competitor can be existential for your company and still fall into "everything else", because the high-risk list targets uses that affect individuals' rights: credit scoring, education, access to essential services and employment. As a "deployer", the Act's term for a company using an AI system under its own authority, your duties depend on which category each use case falls into. This article is general information, not legal advice; for a specific use case, check with qualified counsel.

Two things already apply today: AI literacy and the prohibitions.

Since 2 February 2025, Article 4 has required providers and deployers to act on AI literacy, and certain practices, such as emotion recognition in the workplace, are banned. The Digital Omnibus on AI, published as Regulation (EU) 2026/1744 in July 2026, softened the literacy duty: companies must now take measures "to support the development of AI literacy" rather than ensure a sufficient level for every person. In practice, a short written policy on which tools staff may use, for what and with which data, plus basic training for anyone who relies on AI output, is a sensible baseline.

People decisions are the line not to cross casually.

Annex III, point 4 of the Act lists AI used for recruitment and selection, including filtering applications and evaluating candidates, and AI used to make decisions on promotion or termination, to allocate tasks based on personal traits or behavior, or to monitor and evaluate staff. For these uses, deployer obligations apply from 2 December 2027; the Digital Omnibus moved the date from August 2026 (Future of Privacy Forum summary). They include using the system according to its instructions, assigning human oversight to people with the competence and authority to intervene, keeping logs, and informing workers' representatives and affected employees before deploying it at the workplace. The delay buys time; it does not change the direction. Restructuring and key-hire decisions are exactly where leaders are tempted to "just ask the AI", so this is the boundary to draw first.

The uncertainty itself has a cost.

In the same Destatis survey, among companies that had considered AI but did not use it, 58% named unclear legal consequences and 53% named data protection concerns as reasons (multiple answers allowed). At the other extreme, a Gartner survey of 699 executives in the US, Germany and the UK, conducted in late 2021 and reported in 2022, found that 80% believed automation could be applied to any business decision, an enthusiasm the law does not share for decisions about people. Both groups lose: one leaves useful analysis on the table, the other drifts into high-risk territory without the controls. The fix is not a large compliance program but a clear map of your own use cases.

A five-step check before you use AI in a high-stakes decision.

1) Classify: does the decision concern specific individuals, such as candidates, employees or a customer's access to credit or essential services? If yes, treat it as potentially high-risk and get advice. 2) Separate analysis from judgment: let AI structure options, risks and assumptions, but keep the decision and its rationale with named people. 3) Control data: do not feed personal data or HR files into a tool without a data processing agreement and a clear purpose; the GDPR applies regardless of the AI Act. 4) Document: record what the AI produced, what you accepted or rejected, and who approved it. 5) Train: make sure the people using the output understand its limits, which is also your evidence for Article 4.

Hypothetical example.

A 120-person software company has to cut costs by 15% after a delayed funding round. The CEO uses AI to compare three scenarios: closing an office, pausing a product line or reducing headcount across teams. Analyzing the scenarios, their cash impact and second-order risks is ordinary decision support. The moment the team asks the tool to rank individual employees for redundancy based on performance data, the use moves into Annex III territory. A defensible approach keeps AI at the scenario level, leaves any individual selection to HR and legal under existing labour law and works council rules, and documents where the line was drawn.

This is the logic built into our council: up to 16 AI advisors debate the business decision, an independent Mandate & Boundary Auditor checks the result against the constraints you set, for example "no individual-level people decisions", and nothing moves to execution without human approval. If a restructuring, hiring or market decision is on your table, you can try it free without an account or use a Decision Sprint to get a documented, decision-ready brief.