Are AI Meeting Notetakers 'High-Risk' Under the EU AI Act? The August 2, 2026 Deadline Explained

Yes — most AI meeting notetakers used in the workplace now qualify as high-risk AI systems under Annex III of the EU AI Act, and the full compliance regime applies from August 2, 2026. If your notetaker layers sentiment analytics, performance scoring, coaching feedback, or productivity metrics on top of raw transcription — as Otter, Fireflies, Zoom AI Companion, and most cloud competitors do — you're inside Annex III point 4(b). That triggers documentation, human-oversight, worker-consultation, and post-market monitoring duties, with fines up to €30 million or 6% of global turnover.

What the EU AI Act Actually Says About Workplace AI

The EU AI Act — formally Regulation (EU) 2024/1689 — is the world's first comprehensive AI regulation, and it uses a risk-based structure. Systems fall into four tiers: prohibited, high-risk, limited-risk (transparency obligations), and minimal-risk. The rules that matter for meeting notetakers are concentrated in two places: Article 5 (prohibitions) and Annex III (the high-risk list).

The Act entered into force on August 1, 2024, with obligations phasing in over three years. The prohibitions in Article 5 have been enforceable since February 2, 2025. GPAI model rules began applying on August 2, 2025. And the full high-risk regime for Annex III systems is scheduled to apply from August 2, 2026 — the deadline that has EU HR teams and cloud AI vendors scrambling.

Annex III point 4: Employment and Workers' Management

The relevant clause is short but sweeping. According to the European Commission's AI Act Service Desk, Annex III point 4 designates as high-risk any AI system "intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships."

That last clause — "monitor and evaluate the performance and behaviour" — is what catches modern AI notetakers. A pure dictation tool that produces a verbatim transcript might arguably squeeze into the narrow Article 6(3) exemption for "preparatory" tasks. But the moment a notetaker generates a performance summary, ranks meeting participation, extracts "coaching moments," or attributes sentiment to individual speakers, it crosses into evaluation territory — and Annex III classification.

Why 'Emotion Recognition' Notetakers Are Already Illegal in the EU

Before employers even reach the August 2026 high-risk deadline, there's a category of AI notetaker functionality that has been outright banned since February 2, 2025. Under Article 5 of the AI Act, AI systems that infer emotions in workplaces or educational institutions are prohibited, except for medical or safety reasons.

As PeopleGrip's 2026 HR compliance guide puts it, if your organization uses any tool that assesses employee "engagement," "mood," or "sentiment" through voice tonality or biometric indicators, that functionality is illegal in the EU — and HR teams must audit existing tools immediately to confirm no such features are active, even as optional modules.

This is not hypothetical. As detailed in a January 2026 Social Europe analysis of Otter.ai, Otter advertises "sentiment analytics" and other productivity features that in a workplace setting would presumably fall within the high-risk category — and the emotion-inference portions arguably already violate the Article 5 prohibition. We covered how these voiceprint features are also triggering BIPA lawsuits in the United States.

The Digital Omnibus Twist: Is August 2, 2026 Still Real?

Here's where 2026 got complicated. On November 19, 2025, the European Commission published its "Digital Omnibus on AI" — a legislative proposal to defer the high-risk compliance deadline from August 2, 2026 to December 2, 2027. According to DLA Piper's tracker of the Omnibus, the second political trilogue between the European Parliament, the Council of the EU, and the European Commission on April 28, 2026 ended without agreement, and if the Omnibus is not formally adopted before August 2, 2026, the original Act's provisions apply from that date as written.

A provisional agreement was later reached, and on June 16, 2026 the European Parliament formally endorsed it. On June 29, 2026, the Council of the EU gave its final green light to the AI Act simplification package. But the exact wording of the deferral — and whether it applies uniformly to all Annex III systems or is conditional on the availability of harmonized technical standards — remained the subject of last-minute drafting.

For meeting-notetaker deployers, the practical guidance is unambiguous. As Crowell & Moring's 2026 legal overview emphasizes, Article 26(7) of the AI Act and applicable national legislation already require employers to inform and consult employee representative bodies prior to deploying high-risk AI systems, regardless of any timeline postponement. Treating a possible delay as a reason to postpone preparation would be a strategic error.

Cloud vs. On-Device: How the Architecture Changes Your Exposure

The AI Act doesn't explicitly favor on-device processing — it's technology-neutral. But the way it stacks with GDPR, biometric statutes, and the Schrems II ruling means that where the audio gets processed determines the size of the compliance blast radius. Here's how the two architectures compare for a typical EU workplace deployment:

The Four Concrete Obligations Every Employer Faces on August 2, 2026

Assuming your notetaker lands in Annex III (as most cloud tools do), the deployer — that's the employer using the tool, not just the vendor selling it — takes on four operational duties from day one:

1. Worker Notification and Consultation (Article 26(7))

Before putting a high-risk AI system into service at the workplace, Article 26 of the AI Act requires deployers who are employers to inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system. This has to happen in accordance with Union and national law on information of workers and their representatives. In practice, if you're rolling out an AI notetaker to a European sales team without works-council consultation, you're non-compliant from the moment you flip the switch.

2. Human Oversight With Real Authority

Human oversight cannot be a rubber stamp. According to Ogletree Deakins' analysis for US employers, oversight must be established by individuals with appropriate competence, training, authority, and support, and must be meaningful — with the ability to intervene and override outputs where necessary. That means someone with the power to reject an AI-generated performance summary before it goes into a personnel file.

3. Six-Month Minimum Log Retention

The AI Act requires that logs automatically generated by a high-risk AI system be maintained for at least six months. Ironically, this creates a discovery time-bomb: those preserved transcripts and summaries become discoverable in litigation, adding to the risks flagged in Duane Morris LLP's February 2026 analysis, which warned that AI-transcribed conversations may become discoverable when retained as business records.

4. Continuous Monitoring and Discrimination Detection

Monitoring is required to detect issues such as discrimination or adverse impacts, with prompt suspension of use and notification obligations when issues arise. For a notetaker with speaker diarization, this means auditing whether the speech-recognition model performs equivalently across accents, genders, and languages — because a system that transcribes non-native English speakers more poorly and feeds those transcripts into performance reviews is producing discriminatory outcomes.

Why the AI Act Reaches US Companies Using Otter, Fireflies, or Zoom

US HR teams tend to assume the AI Act is a European problem. It isn't. As Salt Security's compliance breakdown makes clear, the AI Act applies to any organization that places AI systems on the EU market, operates high-risk AI systems within the EU, or whose AI outputs are used in the EU — including non-EU companies. If a US firm runs a Zoom call with an EU-based employee and Otter transcribes and scores it, both the vendor and the deploying employer can be in scope.

That extraterritorial reach stacks on top of existing GDPR exposure. As Social Europe's January 2026 analysis notes, all Otter.ai data is transmitted to the United States, and following the Court of Justice's ruling in Schrems II (C-311/18), such transfers are permissible only under the EU–US Data Privacy Framework or with supplementary safeguards. Given the sensitivity of workplace discussions, reliance on standard contractual clauses alone may prove insufficient.

Meanwhile, the underlying vendor privacy policies aren't reassuring EU legal teams. Otter.ai's privacy policy and Fireflies' privacy policy both grant broad rights to process and, in Otter's case, use content to improve services — the exact patterns triggering the class action described in EPIC's January 2026 risk memo on Brewer v. Otter.ai, Inc.

The Enforcement Vector Nobody Is Talking About: The Whistleblower Tool

In November 2025, the EU AI Office launched a dedicated AI Act Whistleblower Tool, enabling employees, contractors, and external stakeholders to anonymously report breaches of the AI Act in the workplace. As PeopleGrip's guide highlights, this introduces a new enforcement vector: non-compliance can now be flagged directly by the workforce, not only by regulators.

For meeting notetakers, this changes the risk calculus dramatically. The people most likely to notice a compliance problem are the same people the tool is monitoring. An employee who realizes their Zoom calls are being scored for "engagement" by an AI has a direct anonymous channel to Brussels. That's a much shorter distance between shadow-AI deployment and regulatory scrutiny than most compliance teams have modeled.

The Penalty Structure: Why This Isn't Just a Compliance Checkbox

Article 99 of the AI Act creates a tiered penalty regime. Serious breaches can incur fines up to €30 million or 6% of global turnover, orders to withdraw or disable the system, and reputational and liability risks under national enforcement. Prohibited-practice violations — like using an AI notetaker with workplace emotion recognition — carry even higher penalties: up to €35 million or 7% of global annual turnover.

And crucially, a provider that misclassifies an Annex III system as not high-risk under Article 6 faces the full penalty exposure if the system is later found to require conformity assessment. As AgentLiability's Article 6 guide spells out, that's up to €30 million or 6% of global annual turnover for the misclassification alone. For a vendor with $100M ARR, a single misclassification decision could exceed annual revenue.

What About Granola, Notion, and the "Bot-Free" Category?

The Act doesn't care about bots. It cares about what the AI system does with worker data. Granola, for example, markets itself as bot-free — audio is captured locally and then sent to Deepgram, AssemblyAI, OpenAI, and Anthropic for processing. That still involves international data transfer, third-party subprocessing, and cloud-resident transcripts. We compared these architectures in depth in our Granola vs Basil AI architecture breakdown and our broader Notion AI Meeting Notes privacy analysis.

Bot-free reduces the consent-and-visibility problem — which matters under wiretapping and GDPR Article 13 transparency law — but it doesn't move the AI Act needle much. If the tool still generates performance-relevant summaries and sends audio abroad, you're still looking at Annex III + Schrems II. The only architecture that materially collapses the compliance surface is one where audio never leaves the device.

How Basil AI Solves This: On-Device by Architecture, Not by Marketing

Basil AI runs on Apple's on-device Speech Recognition API, processing every second of audio locally on the iPhone, iPad, or Mac's Neural Engine. There's no cloud upload, no third-party subprocessor, no US server, and no vendor-side transcript. That has three concrete effects on EU AI Act exposure:

First, no Schrems II problem. Because audio never crosses a border, there's nothing to transfer, no SCCs to negotiate, and no need for supplementary safeguards. The Chapter V transfer restrictions under GDPR don't attach to data that never leaves the data subject's own device.

Second, no sentiment analytics means no Article 5 exposure. Basil AI produces transcripts and summaries — not "engagement scores," not "mood analysis," not voice-inferred emotional profiles. That keeps the tool outside the workplace emotion-recognition prohibition that's been enforceable since February 2, 2025.

Third, the Annex III classification becomes contestable. A pure transcription tool with no performance-scoring layer can credibly argue it performs the narrow preparatory task described in Article 6(3): indexing and translating source material before a human makes a decision. That doesn't automatically exempt every deployment — an employer who uses transcripts to build performance reviews is still doing worker evaluation — but it moves the compliance burden back onto the deployer's use case, not the tool's architecture.

For a deeper look at the underlying technology, see our breakdown of how Apple's Neural Engine powers on-device transcription, and our full comparison guide covering the competitive landscape.

A Practical Compliance Checklist for August 2, 2026

If you're an EU-based deployer — or a US company with EU employees or clients — here's the minimum viable prep:

• Inventory every AI notetaker currently in use, including shadow-AI installations by individual employees.
• Disable any sentiment, mood, or engagement scoring features immediately. These are already prohibited under Article 5 as of February 2, 2025.
• Confirm your vendor's Annex III classification in writing. Under Article 6, misclassification carries provider-side penalties, so vendors have a strong incentive to answer honestly.
• Inform and consult worker representatives before deployment. This is required by Article 26(7) regardless of any Omnibus deferral.
• Review Schrems II transfer mechanisms for any tool that ships audio outside the EU/EEA.
• Set up six-month log retention and continuous monitoring for discrimination.
• Evaluate on-device alternatives for meetings where the AI Act calculus is unfavorable — attorney-client calls, HR discussions, cross-border sales calls with EU counterparties.

The August 2, 2026 deadline isn't going away, and even if the Digital Omnibus deferral survives final drafting, the enforcement infrastructure — including the whistleblower tool and national supervisory authorities — is already active. Waiting is not a plan.

Take Compliance Off the Cloud

Basil AI records and transcribes meetings 100% on-device. No audio leaves your iPhone, iPad, or Mac. No Schrems II problem. No third-party subprocessor. No sentiment analytics.