The EU AI Act and scheduling software: what certification bodies should check
EU AI Act scheduling software checks for certification bodies: the AI system definition, the Annex III employment category, key dates and deployer duties.
Key takeaways
- Start by asking whether each component is an AI system; a rules-based optimiser and a language-model agent may be classified differently.
- Annex III point 4(b) covers AI used to allocate tasks based on individual behaviour or personal traits in work-related relationships.
- The Digital Omnibus on AI moved Annex III high-risk obligations to 2 December 2027; transparency duties under Article 50 apply from 2 August 2026.
- Deployers of high-risk systems must use them as instructed, assign human oversight, keep logs and inform workers.
Whether the EU AI Act applies to scheduling software depends on two questions: is the tool an AI system under Article 3(1), and does its use fall under Annex III point 4, which covers AI used to allocate tasks based on individual behaviour or personal traits. For Annex III high-risk systems, obligations now apply from 2 December 2027. Confirm your position with legal counsel.
Does the EU AI Act apply to scheduling software?
Certification bodies are asking whether EU AI Act scheduling software rules apply to the tools they use to allocate auditors. The honest answer is that it depends on how the software works and what it is used for. This article sets out the provisions we have checked against the text of Regulation (EU) 2024/1689 and its 2026 amendment. It is general information and should not be read as legal advice, so confirm your position with counsel.
The first test is the definition. The Act only regulates AI systems, and not every piece of scheduling software is one.
"A machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."
The European Commission's guidelines on this definition, published in February 2025, are not legally binding. They indicate that some systems, including certain mathematical optimisation methods, basic data processing and classical heuristics, may fall outside the definition. A deterministic constraint engine and an agent built on a large language model can therefore land in different places. Assess each component separately. Our explainer on constraint-based scheduling describes how optimisation engines work.
When do the EU AI Act rules apply?
The Act applies in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved the dates for high-risk obligations. Check the current consolidated text before relying on any date.
- 1 Aug 2024Entry into forceRegulation (EU) 2024/1689 enters into force
- 2 Feb 2025Early provisionsDefinitions, prohibited practices and AI literacy apply
- 2 Aug 2025General-purpose AIObligations for providers of general-purpose AI models apply
- 2 Aug 2026General applicationMost provisions apply, including Article 50 transparency duties
- 2 Dec 2027Annex III high-riskObligations for stand-alone high-risk systems, as amended by the Omnibus
- 2 Aug 2028Annex I high-riskObligations for high-risk AI in regulated products, as amended
Could auditor scheduling be high-risk under Annex III?
Annex III lists stand-alone uses treated as high-risk. Point 4(b) covers "AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships."
Allocating audits by documented competence, availability and location is task allocation, but whether it is based on individual behaviour or personal traits is a question of interpretation. Using AI to score auditors' performance, or to allocate work based on behaviour, would sit much closer to the text. Whether freelance and subcontracted auditors are in work-related relationships for this purpose is another point for counsel.
- 1AI system?Test each component against Article 3(1)
- 2Annex III use?Check point 4 on employment and workers
- 3Article 6(3) exemption?Narrow or preparatory task, no profiling
- 4Your role?Provider, deployer, or both
- 5Duties and datesMap obligations to 2 December 2027
Article 6(3) lets an Annex III system fall outside high-risk where it does not pose a significant risk and meets one of four conditions, such as performing a narrow procedural task or a preparatory task. A system that performs profiling of natural persons is always considered high-risk. A provider relying on Article 6(3) must document its assessment before placing the system on the market.
What would a deployer of high-risk scheduling software have to do?
If a scheduling tool you use is high-risk, most of your duties as deployer sit in Article 26. The list below paraphrases the main ones; read the article in full with counsel.
- ✓Use the system in line with the provider's instructions for use (Article 26(1))
- ✓Assign human oversight to people with the competence, training and authority to exercise it (Article 26(2))
- ✓Make sure input data you control is relevant and sufficiently representative (Article 26(4))
- ✓Monitor operation and report serious incidents as the Act requires (Article 26(5))
- ✓Keep automatically generated logs under your control for at least six months, unless other law says otherwise (Article 26(6))
- ✓Inform workers' representatives and affected workers before putting the system into service at the workplace (Article 26(7))
Planner approval of every allocation and a recorded reason for each decision support several of these duties, and are good practice whatever the classification. See our article on an audit trail for scheduling decisions.
Which EU AI Act rules apply to scheduling software whatever its risk class?
Two provisions matter for most certification bodies using AI in operations, high-risk or not.
AI literacy (Article 4). As amended by the Omnibus, providers and deployers must take measures to support the development of AI literacy among staff and others operating AI systems on their behalf. The amended text says this does not require any specific level of literacy for any individual. Training planners on what the tool does and where it can be wrong is a sensible response.
Transparency (Article 50). Providers must design AI systems intended to interact directly with people so that those people are informed they are interacting with AI, unless this is obvious from the context. This applies from 2 August 2026 and is relevant to AI agents that email clients and auditors.
What are the common misreadings of the EU AI Act?
MythAll scheduling software is high-risk AI.
RealityHigh-risk status depends on meeting the AI system definition, falling under an Annex III use and not qualifying for the Article 6(3) exemption.
MythOnly the software vendor has obligations.
RealityProviders carry most duties, but deployers of high-risk systems have their own under Article 26, and Article 4 applies to both.
MythThe Omnibus removed the high-risk rules.
RealityIt moved the dates. Annex III obligations now apply from 2 December 2027, and the substance of the high-risk requirements remains.
MythThe AI Act replaces GDPR for auditor data.
RealityGDPR continues to apply to personal data in scheduling, alongside the AI Act.
Which EU AI Act scheduling software questions should you ask vendors?
Add these questions to your scheduling software RFP or your next supplier review.
| Question | Why it matters |
|---|---|
| Which components do you consider AI systems under Article 3(1), and why? | Classification drives everything else. |
| Have you assessed the product against Annex III point 4, and is the assessment documented? | Article 6(4) requires documentation if a provider relies on the exemption. |
| Does the product profile auditors or evaluate their performance? | Profiling keeps an Annex III system high-risk. |
| Can every allocation be explained and approved by a person? | Supports human oversight whatever the classification. |
| How long are logs kept, and can we export them? | Deployers of high-risk systems must keep logs for at least six months. |
| How do AI agents identify themselves to clients? | Relevant to Article 50 transparency. |
For wider context on AI in certification, see AI in the TIC industry.
See how ScheduleAI's audit scheduling software applies these rules across a whole programme in minutes.
Checkfirst's ScheduleAI allocates auditors with a deterministic optimisation engine that explains each decision, AI agents propose changes that planners approve, and every change is logged. The platform is ISO/IEC 27001 certified, GDPR compliant and hosted in AWS Ireland (EU).
Book a demo Estimate your savingsQuestions
Is audit scheduling software high-risk under the EU AI Act?
Not automatically. It depends on whether it is an AI system, whether its use falls under Annex III point 4 and whether the Article 6(3) exemption applies. Take legal advice on your specific tools.
When do high-risk obligations apply?
Following the Digital Omnibus on AI, Regulation (EU) 2026/1744, obligations for Annex III high-risk systems apply from 2 December 2027. Check the current consolidated text.
Does the AI Act apply to UK certification bodies?
It can apply to providers and deployers outside the EU in some situations, for example where a system is placed on the EU market or its output is used in the EU. Confirm with counsel.
Do we need to tell clients when an AI agent emails them?
Article 50 requires AI systems intended to interact directly with people to inform them, unless it is obvious. It applies from 2 August 2026.
What should a certification body do now?
List the AI components you use, ask vendors for their classification, support staff AI literacy and keep a person approving every allocation. Understanding how your engine decides helps with each step.