A multinational firm plans to deploy an AI system in the European Union that will screen job applicants. The compliance lead must determine which obligations under the EU AI Act apply to the firm. How should the analysis begin?
Select an answer to reveal the explanation.
Short Explanation
Think of it like vehicle licensing: a bicycle, a car and a fuel tanker face very different rules. The EU AI Act sorts systems by risk first, and the tier decides your obligations. The trap is assuming that because you bought the model, the rules only bind whoever built it.
Full Explanation
The EU AI Act takes a risk-based approach. It prohibits certain AI practices outright, imposes extensive obligations on high-risk systems, sets transparency duties for some systems that interact with people or generate content, and leaves minimal-risk systems largely to voluntary codes. The starting point of any compliance analysis is therefore classifying the system by its intended purpose. AI used in employment, such as screening or evaluating job applicants, is among the use cases the Act lists as high-risk, which brings requirements around risk management, data governance, documentation, human oversight, accuracy and logging. Applying only GDPR ignores that the AI Act is a separate regulation; GDPR still applies to the personal data involved, but it does not replace the AI Act's system-level obligations. Applying identical obligations to every system contradicts the Act's tiered structure. Concluding that obligations fall only on the developer is wrong because the Act assigns duties to deployers as well as providers, including human oversight and use according to instructions. Exam caveat: the 2026 outline lists regulatory requirements under AI and ML; exam items test the risk-based concept rather than article numbers or deadlines. Operational check: document the system's intended purpose, its risk classification and the resulting deployer obligations, and assign an owner for each obligation.