Your Meeting Tool's Risk Level Under the EU AI Act Isn't Set by the Vendor. It's Set by You.

The EU AI Act's four risk categories cover uses, not products. The same meeting tool can be low-risk, high-risk or banned. Plus the 2027 timeline and EN 18286.

Sandeep ZachariahCEO, Zackriya Solutions

October 24, 20265 min readPrivacy & SecurityEnglish

Under the EU AI Act, a meeting tool's risk depends on how you use it: summarizing calls is not high-risk, scoring employees is high-risk from December 2027, reading emotions at work is banned since February 2025, and EN 18286 is the first standard

TL;DR

The EU AI Act sorts AI into four risk levels: banned, high-risk, limited and minimal. It classifies how you use AI, not just the tool itself. Transcribing and summarizing meetings isn't high-risk, but using the transcripts to score employees can be. Reading people's emotions at work has been banned since February 2025, with narrow exceptions for medical and safety reasons.

The high-risk rules for workplace uses now start on 2 December 2027, but the AI literacy duty already applies. EN 18286, the first harmonized standard under the Act, came out on 14 October 2026. And the GDPR still covers your meeting recordings (our GDPR guide for meeting transcription). Keeping meetings on your own device makes some questions simpler, like transfers abroad, but it doesn't make you compliant on its own.

The key takeaway: your vendor is responsible for how the tool is built. You're responsible for how you use it.

On 14 October, the European Union cited its first harmonized standard under the AI Act(opens in new tab). It's called EN 18286, and it describes how providers of high-risk AI should run their quality management. If a provider builds its system on it, regulators will presume that part of the law is met.

Most people using AI in their meetings will never open this standard, and most don't need to. It covers one of ten areas the Commission asked for, and the rest are still being written. But I think it matters for a different reason. It is the moment the AI Act(opens in new tab) stopped being something people discuss and started becoming something people build against. And when that happens, the question every organization will eventually be asked is a simple one: what AI are you using, and what are you using it for?

For AI meeting tools, I don't think most organizations can answer that yet.

Here is what I've come to believe after a lot of conversations with European teams. The AI Act does not really classify products. It classifies uses. The same piece of software can sit in very different places depending on what you do with it, and the person who decides that is usually not the vendor. It's you.

Take a meeting assistant that transcribes a project call and writes a summary. For most purposes, that is a low-risk use. Now take the same transcript and feed it into a process that scores how employees perform in meetings, or decides who gets flagged for review. The Act lists AI used to monitor and evaluate workers' performance and behavior as high-risk(opens in new tab). Same tool, same audio, very different obligations. And if a tool tries to infer the emotions of people at work, from their tone of voice or their face on camera, that use has been prohibited in the EU since February 2025(opens in new tab), apart from narrow medical and safety cases.

How you use the meeting tool	Risk level under the EU AI Act	When the rules apply
Transcribe a project call and create a summary	Generally not high-risk (minimal or limited risk). The GDPR still applies to recordings and transcripts.	GDPR applies now
Use meeting transcripts to rate employee performance	High-risk: AI used to monitor and evaluate workers.	2 December 2027
Use AI to decide which employees get flagged for review	High-risk: AI used to make decisions about workers.	2 December 2027
Use AI to detect people's emotions at work from their voice or facial expressions	Unacceptable risk: banned, with limited exceptions for medical or safety reasons.	Since 2 February 2025

Sources: AI Act Annex III(opens in new tab) and Article 5(opens in new tab). The December 2027 date comes from the Digital Omnibus, Regulation (EU) 2026/1744(opens in new tab), in force since 27 July 2026.

That is the part I want more teams to understand. Buying a tool from a careful vendor does not settle your position under the Act. The vendor answers for how the tool is built. You answer for how it is used.

The timeline gives everyone some room. Earlier this year, the EU agreed to push the main high-risk obligations to December 2027(opens in new tab). Some people read that as a reason to wait. I'd read it as the window to get the basics right. A few duties already apply. Organizations using AI are expected to take steps to build AI literacy(opens in new tab) among their people, and that has been the case since February 2025. And nothing in the AI Act replaces the GDPR(opens in new tab). Every recording of a meeting is still personal data, with all the questions about consent, purpose and where that data lives.

Date	What applies
25 May 2018	The GDPR, which covers meeting recordings and transcripts
1 August 2024	The AI Act enters into force
2 February 2025	Banned uses, including emotion recognition at work, and the AI literacy duty
2 August 2025	Rules for general-purpose AI models
27 July 2026	The Digital Omnibus enters into force and delays the high-risk rules
14 October 2026	EN 18286, the first harmonized standard, is published
2 December 2027	High-risk rules for Annex III uses, including monitoring and evaluating workers
2 August 2028	High-risk rules for AI built into regulated products (Annex I)

Sources: AI Act, Article 113(opens in new tab), Regulation (EU) 2026/1744(opens in new tab), CEN-CENELEC(opens in new tab).

That last question is where architecture quietly does a lot of work. When we decided Meetily would process everything on the user's own device, we were thinking about privacy, not the AI Act. But it turns out the two lead to the same place. When meeting audio and transcripts never leave the device, a whole set of questions gets simpler. There is no transfer to a third country to justify. There is no vendor holding a copy that could be repurposed. There is no model somewhere being trained on your conversations. Because the models are open source and chosen by the user, a team can see exactly what is running.

I want to be careful here, because this is exactly where marketing tends to overreach. Local processing does not make anyone compliant with the AI Act. No architecture can decide how you use a tool. If someone takes a transcript produced on their own laptop and uses it to rate their colleagues, the obligations follow them, wherever the data sits. What good architecture does is remove the questions that shouldn't exist, so you can spend your attention on the ones that should.

So if you use AI in your meetings, here is where I'd start. Write down what your meeting tools actually do, including the features nobody has switched on yet. Decide, as an organization, what they must never be used for, and make that a policy rather than an assumption. And find out where the recordings and transcripts physically go. If the answer is "a server we've never seen, in a country we didn't choose," that is worth knowing before 2027, not after.

EN 18286 is the first of many standards. More will follow, and the expectations will only get more concrete. I'd rather teams meet them with clarity than with surprise.

We built Meetily on one belief. We want to bring the power of technology to our customers, but not their data to us. The AI Act doesn't change that belief. If anything, it is starting to explain why it matters.

Frequently Asked Questions

There are four risk levels, also called risk categories. Unacceptable risk is banned outright, for example social scoring or reading people's emotions at work. High risk is allowed with strict duties, for example AI used in hiring or to evaluate workers. Limited risk carries light transparency duties, for example telling people they're talking to a chatbot or labeling AI-generated content. Minimal risk, like a spam filter, has no new duties. An AI meeting tool that transcribes and summarizes is usually minimal or limited risk. The same tool used to score staff is high risk.

Not by itself. The AI Act looks at what a tool is used for, not at the product. Recording a call, writing a transcript and producing a summary isn't on the Act's high-risk list. It becomes high-risk when the output is used to monitor or evaluate workers, or to make decisions about their promotion, dismissal or tasks. Those uses are listed in Annex III, point 4.

Under the AI Act, using AI to monitor or evaluate workers' performance and behavior is a high-risk use. From 2 December 2027, an employer doing this must follow the vendor's instructions, keep a human in charge of the decisions, and tell workers' representatives and the affected workers before using it (Article 26). The GDPR and national employment law already apply today, even to a small pilot. In Germany, for example, the works council must agree before an employer introduces technical tools that can monitor staff behavior or performance (Section 87(1) no. 6 of the Works Constitution Act).

The vendor, called the provider, has to manage risks, use good-quality data, keep technical documentation and logs, design the system for human oversight, meet accuracy and security standards, run a quality management system (the part EN 18286 covers), pass a conformity assessment and register the system. The company using it, called the deployer, has to use it as instructed, give oversight to trained people, keep the logs it produces for at least six months, inform workers before using it at work, and run a data protection impact assessment where the GDPR requires one. For workplace uses, these duties start on 2 December 2027.

Yes. The GDPR says people must be told when their personal data is collected and why, and a meeting recording or transcript is personal data. If the output is used for a high-risk purpose at work, such as evaluating staff, the AI Act adds its own duty from December 2027 to inform workers and their representatives first. Some countries go further. In Germany, for example, secretly recording someone's spoken words can be a criminal offense under Section 201 of the Criminal Code. We cover how to tell people in compliant meeting notes without a bot.

Yes. Since 2 February 2025, Article 5 of the AI Act bans AI that infers the emotions of people at work or in education from biometric data, such as their tone of voice or their face on camera. The only exceptions are medical or safety reasons. It's one of a short list of banned uses, alongside social scoring and manipulative AI. According to the Commission's guidelines, inferring emotions from written text alone, such as the words in a transcript, isn't covered by the ban (Future of Privacy Forum summary).

Partly, and the delay is now law. The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the main rules for high-risk AI listed in Annex III, which includes workplace uses, to 2 December 2027. High-risk AI built into regulated products moves to 2 August 2028. The bans in Article 5 and the AI literacy duty weren't delayed. Both have applied since 2 February 2025.

EN 18286 is the first harmonized standard under the EU AI Act. It sets out how providers of high-risk AI should run a quality management system, the requirement in Article 17. It was published in the Official Journal of the EU on 14 October 2026, through Commission Implementing Decision (EU) 2026/2274. A provider that follows it is presumed to meet that part of the law. Using it's voluntary, and standards for other areas, such as risk management and cybersecurity, are still being written.

Both, for different things. The vendor, which the Act calls the provider, answers for how the tool is built. The company using it, which the Act calls the deployer, answers for how it's used. Buying from a careful vendor doesn't cover you if you use the tool's output for a high-risk purpose, such as rating employees.

Anyone who builds, sells or uses AI in a professional setting in the EU. That covers providers, which build the system or put it on the market, and deployers, which use it at work, plus importers and distributors. It also reaches companies outside the EU when their AI is sold in the EU or its output is used there (Article 2). So a US company with staff or customers in Europe should assume it applies. Purely personal, non-professional use is out of scope.

Article 4 asks companies that use AI to take steps so their people understand the tools they use, including what the tools can get wrong and what they must not be used for. Since the Digital Omnibus, the duty is about making the effort, not reaching a fixed level for each person. A short internal record of the training you have done is a sensible way to show it.

No. Where the data sits doesn't decide how the tool is used, so local processing can't make anyone compliant on its own. What it does is remove some questions. With Meetily, transcription runs on your device by default, so there is no audio transfer to another country and no vendor copy of the recording. For summaries, you pick a local model or your own API key with a provider you choose. If you use your own key, the transcript text goes to that provider under your account.

Yes. Nothing in the AI Act replaces the GDPR. A recording of people who can be identified is personal data. So the usual questions still apply: your legal basis, such as consent, the purpose, how long you keep it, and where it's stored. Our GDPR guide for meeting transcription walks through each one.

Get started