Is Oracle HCM high-risk under the EU AI Act?

Several Oracle HCM Cloud modules that use AI are high-risk under Annex III Category 4: Oracle Recruiting AI (candidate scoring and recommendations), Dynamic Skills (AI-driven skills inference for HR decisions), and AI-assisted performance management. Oracle as provider handles technical documentation; you as deployer must add candidate disclosure, human oversight, and log retention.

What are the deployer obligations for Oracle HCM users?

As an Oracle HCM deployer using AI features, you must: inform candidates and employees that AI assists in assessments (Article 26), ensure a human reviews and can override AI recommendations, retain logs of AI-assisted decisions for at least 6 months, request Oracle's EU AI Act compliance documentation, and designate an internal compliance owner for AI governance.

Oracle HCM Cloud EU AI Act Compliance Guide 2026

Oracle HCM Cloud EU AI Act Compliance: Deployer Guide

Oracle HCM Cloud's AI features — including Recruiting AI, Dynamic Skills, and AI-assisted performance tools — trigger high-risk deployer obligations. If your HR team operates in the EU, here is what you need in place before August 2026.

Oracle HCM AI feature risk classification

Feature	Classification	Notes
Recruiting AI — candidate scoring, recommendations	HIGH RISK	Annex III Cat.4 — AI in employment decisions
Dynamic Skills — AI skills inference and matching	HIGH RISK	Infers skills to inform career and hiring decisions
AI performance management — goals, ratings assistance	HIGH RISK	AI assists decisions affecting employees' conditions
Oracle Digital Assistant — HR chatbot	HIGH RISK + Art.50	If used for employment queries: high-risk. Always: Art.50 disclosure
Payroll, absence, benefits calculations	NOT HIGH RISK	Rules-based, no AI assessment of persons
Time and labour management	NOT HIGH RISK	Scheduling and tracking, not AI-based assessment

Deployer obligations checklist

Inform candidates and employees that Oracle HCM AI features are used to assess or recommend for their role — before any assessment
Ensure recruiters and managers can review, query, and override any AI recommendation — document this process
Retain Oracle HCM audit logs for AI-assisted decisions for at least 6 months — verify your Oracle subscription tier includes log retention
Request Oracle's EU AI Act technical documentation pack for each high-risk module you use
Register high-risk AI use in the EU database when the registration portal opens (expected 2026)
Add Article 50 disclosure to Oracle Digital Assistant if deployed to EU users or employees

Ready-to-use compliance documents for Oracle HCM deployments

The HR AI Compliance Kit includes candidate disclosure templates, human oversight policy, log retention guide, and AI system register — formatted for enterprise HR teams running Oracle HCM.

Get the HR Compliance Kit — €99 →

Oracle HCM and the EU AI Act: analysis

Dynamic Skills — the underrated compliance challenge

Oracle's Dynamic Skills feature uses AI to infer employee skills from their activity data, job history, and other signals — creating a skills profile that influences recommendations for internal mobility, learning, and succession. Because this operates continuously on existing employees (not just candidates), it triggers Article 26(2) worker notification obligations: employees must be informed that AI is used to infer their skills and that these inferences affect HR decisions about them.

This is different from candidate disclosure: it applies to your entire EU workforce using Oracle HCM, not just people who apply for roles.

Oracle Digital Assistant — dual obligation

If you deploy Oracle Digital Assistant as an HR chatbot for employees, you face two separate obligations: the Article 50 chatbot disclosure (users must be told they are talking to AI) and potentially the high-risk deployer obligations (if the assistant provides information that influences employment decisions, such as explaining leave entitlements that affect pay or conditions).

Frequently asked questions

Oracle manages our HCM on a managed service basis. Who is responsible?

You are, as the deployer. The deployer is the entity in whose professional context the AI system is put into service — that is your organisation, even if Oracle hosts and manages the technical environment. Oracle's managed service role does not transfer your deployer obligations to them. You remain responsible for candidate disclosure, human oversight, and log retention.

We use Oracle HCM for a global workforce. Do EU AI Act obligations apply to non-EU employees?

EU AI Act deployer obligations apply where the output of the AI system is used in the EU. For EU-based employees and candidates for EU roles, obligations apply. For non-EU employees in locations where the AI Act has no reach, they do not. You can configure different disclosure processes for EU vs non-EU parts of your workforce, but the simplest approach is to apply consistent disclosure globally.