Lesson 2 of 6
Where SAP AI use cases fall
8 min
Listen to this lesson
Most AI in SAP systems is not high-risk. Summarizing an incident, drafting a requirement, suggesting a G/L account or answering "where is my order?" doesn't make decisions about people's rights or safety. But a few SAP process areas sit right on top of Annex III, and HR is the obvious one. This lesson gives you a method to classify each use case and works through examples from HR, finance, procurement and customer service.
The Annex III areas that touch SAP processes
| Annex III area | What it covers (simplified) | SAP process areas to check |
|---|---|---|
| 4. Employment and workers management | Recruitment and selection (targeted job ads, filtering applications, evaluating candidates); decisions on promotion, termination and task allocation based on behavior or traits; monitoring and evaluating performance and behavior | Recruiting, talent and performance management, workforce scheduling, shop-floor task allocation |
| 5(b). Creditworthiness of natural persons | Evaluating credit scores or creditworthiness of individuals (fraud detection excluded) | Consumer credit decisions in financial services; usually not B2B credit management |
| 5(c). Life and health insurance | Risk assessment and pricing for natural persons | Insurance industry solutions |
| 5(a). Public benefits and services | Eligibility for public assistance, granting or revoking benefits | Public sector solutions |
| 3. Education and vocational training | Admission, evaluating learning outcomes, monitoring tests | Learning platforms used for certification decisions |
Annex III areas most likely to intersect with SAP processes.
A classification method
- Is it a prohibited practice under Article 5?Yes → stop; it can't be used · No → continue.
- Is it an AI system at all, or rule-based logic?Fixed rules (a release strategy over $10,000) aren't AI systems → out of scope · AI → continue.
- Does the use fall under an Annex III area?No → check transparency (Article 50), then minimal risk · Yes → continue.
- Does an Article 6(3) exception apply (narrow procedural task, improving a finished human activity, detecting patterns without replacing human review, preparatory task)?Yes, and no profiling of individuals → not high-risk, but the provider documents the assessment · No, or it profiles people → high-risk.
The Article 6(3) exceptions deserve attention because they decide many borderline cases. A system listed in Annex III is not high-risk if it doesn't pose a significant risk of harm and only performs a narrow procedural task, improves the result of a previously completed human activity, detects patterns or deviations without replacing or influencing a human assessment without proper review, or performs a preparatory task. Profiling of natural persons always stays high-risk. The provider who relies on an exception must document its assessment.
Worked examples
| Use case | Likely class | Why |
|---|---|---|
| AI ranks job applicants for Detroit assembly roles | High-risk (Annex III point 4) | Evaluating and filtering candidates; profiles individuals |
| AI drafts a job description from a template | Minimal risk; transparency if published as AI text to inform the public | Doesn't evaluate people |
| AI suggests shift assignments from workers' past performance | Likely high-risk (Annex III point 4) | Task allocation based on individual behavior or traits |
| Agent proposes G/L accounts for supplier invoices | Minimal risk | No decision about natural persons' rights |
| AI sets credit limits for business customers such as Great Lakes Fleet Services | Usually not Annex III | Annex III 5(b) covers natural persons; check sole traders and local law |
| Joule answers employees' HR policy questions | Transparency duty (Article 50(1)) | People must know they are interacting with AI, unless obvious |
| Agent drafts purchase requisitions for CMC-RTR-200 | Minimal risk | Procurement decision about goods, with human release |
| Emotion recognition on call-center agents | Prohibited in the workplace (Article 5), with narrow medical or safety exceptions | Banned practice, not a high-risk one |
Classifying SAP-adjacent AI use cases (illustrative; confirm with counsel).
What would you do?
Kenji's team wants to use an AI feature that flags unusual overtime patterns per employee and sends them to supervisors, who then decide on follow-up. They argue it's "only detecting patterns." How should Nadia classify it?
- Most SAP AI is minimal risk; HR use cases that evaluate, rank, allocate or monitor workers are the main high-risk area.
- Credit scoring of natural persons and life or health insurance pricing are Annex III; B2B credit limits usually aren't.
- Article 6(3) exceptions can take a listed use out of high-risk, but never when it profiles individuals.
- Chat assistants and published AI text carry Article 50 transparency duties.
Check your understanding · not graded
Lesson check
1. Which SAP use case is most likely high-risk under Annex III?
2. When does an Article 6(3) exception never apply?
3. An AI tool sets credit limits for business customers such as fleet operators. How is it usually classified?
4. Which practice is prohibited rather than high-risk?