AI use

Ready for 2 December 2027 (3)

Requirements for high-risk AI, e.g. in recruitment. They apply from 2 December 2027, but you can start on them now.

• Assessment of applicants for controller: Use the system according to the provider's instructions for use and monitor its operation. (Art. 26(1) and (5) AI Act)
• Assessment of applicants for controller: Tell the people the decisions concern that AI is involved. (Art. 26(11) AI Act) · Use the template
• Assessment of applicants for controller: Inform employee representatives and the employees affected before the system is put into use. (Art. 26(7) AI Act) · Use the template

What GoalCube does for you (4)

• Assessment of applicants for controller: Human oversight by a competent person with authority, who genuinely assesses the AI's result. GoalCube People decisions: a person decides each case
• Assessment of applicants for controller: Keep logs for at least 6 months. GoalCube's tamper-evident log
• Assessment of applicants for controller: Explain the decision if the person asks for it. The reason is saved with each decision
• Assessment of applicants for controller: Decisions with a significant effect on people must not be made solely by automated means. The person has the right to human intervention and to contest the decision. GoalCube People decisions: a person decides each case and gives a reason

Deadlines

• 25/5/2018GDPR applies, including Art. 22 on automated decisions and Art. 35 on DPIAs. (GDPR), applies now
• 2/2/2025The rules on prohibited AI practices and AI literacy apply. (Art. 4 and 5 AI Act), applies now
• 2/8/2026Transparency duties for chatbots and AI-generated content apply. (Art. 50 AI Act), applies now
• 2/12/2027Requirements for the use of high-risk AI (e.g. recruitment and HR cases) apply. (Art. 26 and Annex III AI Act (Digital Omnibus)), coming

What is at stake

The maximum fines under the AI Act and GDPR. For small and medium-sized businesses, the lower of the two amounts in the AI Act applies. The fine depends on how serious the infringement is and what the company has done to avoid it. What you do in GoalCube shows your efforts.

• €35 million or 7% of global turnoverProhibited use of AI (Art. 99(3) AI Act)
• €15 million or 3%Other AI Act requirements, e.g. human oversight, logs and transparency (Art. 99(4) AI Act)
• €20 million or 4%Automated decisions, data subjects' rights and transfers outside the EU (Art. 83(5) GDPR)
• €10 million or 2%E.g. a missing DPIA or data protection by design (Art. 83(4) GDPR)

GoalCube rule set 2026.3

When the rules change, the entries that need to be confirmed again are added to the task list.

• 9/10/2026Deadlines: high-risk requirements from 2 December 2027 under the Digital Omnibus; the transparency duty (Art. 50) applies from 2 August 2026.
• 8/10/2026Art. 22 GDPR requires a human decision, even outside Annex III of the AI Act. A DPIA is required for decisions about people and for profiling.
• 7/10/2026First set of rules: prohibited use (Art. 5), high-risk (Art. 6 and Annex III), transparency duty (Art. 50) and AI literacy (Art. 4).