Glossary
EU AI Act
Regulation (EU) 2024/1689 establishes risk-based rules for AI systems in the EU market. AI systems are classified as prohibited, high-risk, limited-risk, or minimal-risk. AI for whistleblower triage is not high-risk by default but could fall under Annex III employment use cases if it materially influences employment decisions. Confidly keeps AI advisory with human review.
Full definition
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 with phased application; prohibitions and AI-literacy obligations apply from 2 February 2025, general-purpose AI obligations from 2 August 2025, high-risk system obligations from 2 August 2026, and full application from 2 August 2027. It classifies AI systems into prohibited (e.g., social scoring by public authorities, manipulative AI), high-risk (e.g., AI used in employment, education, law enforcement, critical infrastructure), limited-risk (transparency obligations), and minimal-risk. Use of AI to assist in whistleblower-case triage is not categorised as high-risk by default, but where the AI materially influences employment decisions of the data subject (e.g., automated screening of a reporter's allegations against a hiring decision) it could fall under Annex III's employment use case and trigger conformity assessment, risk-management system, data-quality, technical documentation, human-oversight, and post-market monitoring obligations. Confidly's AI features are advisory: a human compliance officer reviews every AI suggestion before any action, which keeps the feature outside the high-risk classification while preserving the practical productivity benefits.
Related terms
- GDPR Regulation (EU) 2016/679, the General Data Protection Regulation, governs processing of personal data of EU residents. Whistleblowing channels process personal data of the reporter, the person reported on, and third parties named in the report. Key articles: Art. 6 (legal basis), Art. 5 (minimisation), Art. 9 (special categories), Art. 17 (erasure), and Art. 30 (records).
- DPIA A Data Protection Impact Assessment is a GDPR-mandated risk analysis for high-risk data processing, required by Article 35. Whistleblowing typically triggers a DPIA because it involves systematic employee monitoring and special-category data such as allegations of criminal conduct. The DPIA documents purposes, data categories, risks, mitigation measures, and the DPO's opinion.