Example halden ai intake

Reviewer's notes (2026-09-24)

• AI-004, "Unverified" delay note (~line 165): the model treated the push-back of the Annex III high-risk deadline as a pending "digital omnibus" proposal. It is not pending: Regulation (EU) 2026/1744 (the Digital Omnibus on AI), adopted 8 July 2026 and in force from 27 July 2026, amends Regulation (EU) 2024/1689 and confirmed on EUR-Lex (https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) that the Annex III high-risk obligations now apply from 2 December 2027, not 2 August 2026 as originally set. Treat the date below as superseded by this confirmed, adopted change.
• AI-004, Art. 50(1) transparency duty (~lines 213, 237): the model attributes this duty to whoever operates the chatbot. Article 50(1) of the AI Act binds the provider of the AI system, not the deployer. Halden, running a vendor chatbot in its own website chat, is the deployer here, not the provider — the disclosure duty still needs to be met, but the model named the wrong legally-bound party.
• AI-004, log retention citation (~line 173): the model cites "Art. 26" for the six-month log-retention point. The specific paragraph is Art. 26(6), not Article 26 as a whole.

I've run intake for all six systems in Ai systems (example data). The legal content behind this skill was last reviewed in 2026-09, so treat the EU AI Act points below as a starting point. Legal review is required for AI-004, which is tiered high-risk.

Summary

Common gaps in the input: The CSV gives only an id, an owner and one line of description. It doesn't give the supplier, the model provider, the data fields used, where the data came from, or who reviews the outputs beyond what the description says. Each record marks these gaps. Some systems may match vendors in apps.csv, but those links are guesses and are marked Unverified:.

Controls every system needs (baseline):

• XW-021 (ISO/IEC 42001 6.1.4 and Annex A.5; COBIT APO12): a risk and impact assessment before deployment.
• XW-022 (ISO/IEC 19770-1 8.3; COBIT BAI09.01): an entry in the AI inventory.
• XW-023 (ISO/IEC 42001 A.10; ISO/IEC 27001 A.5.19; COBIT APO10): supplier and model-provider oversight.
• XW-024 (ISO/IEC 42001 6.1.2 and 6.1.3; COBIT APO12): an entry in the risk register with an owner.
• XW-028 (ISO/IEC 42001 A.7; ISO/IEC 27001 A.5.12 and A.5.13): data classification and handling.
• XW-020 (ISO/IEC 42001 7.5; ISO/IEC 27001 A.5.33): keep the evidence of approval.

In NIST AI RMF terms: Govern covers ownership and approval, Map covers the restatement and tiering, Measure covers the assessment and accuracy monitoring, and Manage covers the risk-register treatment and re-review. The tier-specific controls below are added on top of this baseline.

AI-001: Email spam and phishing classifier

What it does: It sorts inbound email into spam, phishing or legitimate, and quarantines emails automatically.

• Who it affects: Staff receiving email and external senders.
• Decisions: It makes the quarantine decision itself. No one reviews each output before it acts; quarantined mail can presumably be released, but Unverified: that a release process exists.
• Data: Email content, headers and sender addresses. This is personal data. It flows from Halden's mail stream. Unverified: whether the vendor also trains on Halden's email.

Tier: Minimal-risk.

• Prohibited practices: none apply. The system doesn't manipulate people, score them socially, use biometrics or read emotions.
• High-risk areas: it isn't used for employment, essential services, education, law enforcement or critical infrastructure. Screening email for security reasons doesn't decide anything about a person's rights or opportunities.
• Transparency duty: none, because it doesn't talk to people or generate content.
• Remaining risks are operational: legitimate mail being quarantined by mistake, and the vendor's handling of mail content.

Controls beyond the baseline:

• XW-028: confirm how email content is classified, and whether the vendor keeps it or trains on it.
• XW-023: get the vendor to disclose its subprocessors.
• Measure: track the false-positive rate and how often quarantined mail is released.
• Manage: have a documented release process for quarantined mail.

AI-002: Supplier invoice extraction

What it does: It reads supplier invoices and extracts the totals, dates and PO numbers.

• Who it affects: Suppliers and Finance staff.
• Decisions: It supports payment processing. A person reviews each extraction ("for review").
• Data: Supplier invoices. Personal data: likely a little. Invoices can include named contacts, and sole traders' names and bank details. Unverified.
• Where the data comes from: invoices sent in by suppliers.

Tier: Minimal-risk.

• It pulls fields out of documents and a person checks them before anything happens.
• It's not in any listed high-risk area, and it doesn't talk to people.
• The risk is financial: a wrong figure or a duplicate payment. That belongs under finance controls, not AI Act controls.

Controls beyond the baseline:

• XW-028: decide how financial data is classified and handled.
• Measure: track extraction accuracy against the corrections people make.
• Manage: make sure a person still signs off before payment.
• XW-023: confirm whether invoices go to an outside OCR or model provider.

AI-003: Delivery route suggestions

What it does: It suggests delivery routes, and a dispatcher approves each plan.

• Who it affects: Dispatchers, drivers, and customers indirectly.
• Decisions: It supports route planning. A person reviews every plan.
• Data: Delivery addresses, orders and possibly vehicle or driver data. Personal data: likely yes. Customer addresses count, and driver location data may too. Unverified.
• Where the data comes from: Halden's order and transport data.

Tier: Minimal-risk.

• Critical infrastructure: I considered it, because the Act's list includes safety parts of road-traffic management. This system plans Halden's own delivery routes and doesn't manage road traffic, and a dispatcher approves every plan. So it doesn't meet that test.
• Worker management: if the routes were used to allocate work to drivers or to monitor and judge their performance, the system would move into the employment and worker-management high-risk area.

Decision needed: Operations must confirm the route output is not used to assign tasks to individual drivers or to monitor or judge their performance. If it is, re-run intake as a possible high-risk system.

Controls beyond the baseline:

• XW-028: handling of customer address and driver location data.
• Map: record the worker-management limit above in the intake record.
• Measure: track how often dispatchers override or reject plans.

AI-004: CV ranking and applicant shortlisting ⚠ HIGH-RISK

What it does: It ranks job applicants' CVs and shortlists candidates for interview.

• Who it affects: Job applicants, meaning external people plus any internal candidates, and HR recruiters.
• Decisions: It directly shapes who gets an interview. Candidates it doesn't shortlist may never be seen by a person. The description doesn't say whether a person reviews every ranking; Unverified:.
• Data: CVs and application data. This is personal data, and it may include special-category data (health, ethnicity) or stand-ins for protected characteristics (age, gender, address).
• Where the data comes from: applicants. Unverified: what data the model was trained on.

Prohibited practices: none apply on this description. The ban on emotion recognition in the workplace would apply if the tool analyzed video or voice interviews for emotion, and the ban on biometric categorization would apply if it inferred protected traits from photos.

Decision needed: Legal must confirm that neither of these features exists in the product.

Tier: High-risk.

• The Act lists employment uses as high-risk, specifically recruiting and selecting people, and filtering or evaluating job applications (Annex III, point 4(a)). This system does exactly that.
• There's an exception for tools doing only a "narrow procedural task" (Art. 6(3)), but it doesn't apply. Ranking applicants is profiling of people, and profiling always stays high-risk.
• It's also a hiring decision with a real effect on people, which brings in GDPR automated decision-making rules (Art. 22) and a data protection impact assessment (DPIA, Art. 35).

Unverified: The Annex III high-risk obligations were due to apply from 2 August 2026, but EU "digital omnibus" proposals would push that date back. Legal should confirm the current date. Either way, implement the controls now.

Required controls (on top of the baseline):

• Legal review before approval (XW-021): confirm the tier, and whether Halden is only a deployer or also a provider. Halden becomes a provider if it built the system, substantially modified it, or put its own name on it.
• Human oversight (Govern / Manage): trained recruiters review the rankings, can override them, and see candidates the tool didn't shortlist. No one is rejected on the tool's output alone.
• Informing people: tell applicants that an AI system is used in assessing them. Tell workers' representatives and affected staff before it's put in use at work.
• Input data quality (Map / XW-028): make sure the data fed in is relevant and representative for the purpose. Don't feed in special-category data.
• Bias and accuracy monitoring (Measure / XW-025): compare selection rates across protected groups and track how accurate the rankings are.
• Logs: keep the system's automatic logs for at least six months (per Art. 26), and link them to the XW-020 evidence records.
• Supplier (XW-023, ISO/IEC 42001 A.10):
  • Get the provider's EU declaration of conformity, CE marking, instructions for use, and registration in the EU database.
  • Get disclosure of training data sources and subprocessors.
  • Add AI clauses to the contract covering model updates and incident reporting.
• DPIA (XW-028): complete one, run by Data protection.
• Risk register (XW-024): log the risks of discrimination, wrongful exclusion and non-compliance, owned by the Head of HR.
• Incidents: report serious incidents to the provider and the regulator, and be able to suspend use.

AI-005: Shipment-status chatbot

What it does: It answers customers' shipment-status questions in the website chat.

• Who it affects: Customers and members of the public.
• Decisions: It gives information only; it doesn't decide anything. The customer reads the answer directly, and there's no review of each reply.
• Data: Tracking numbers, shipment status, and possibly customer names and addresses. Personal data: yes, likely.
• Where the data comes from: Halden's shipment systems, plus whatever customers type in.

Tier: Limited-risk.

• It's not prohibited and not in a listed area. Shipment tracking is not an "essential service" in the Act's sense.
• It does talk directly to people, so the transparency duty for chatbots (Art. 50(1)) applies: customers must be told clearly that they are chatting with AI, unless that's obvious. That duty applies from 2 August 2026.
• Other risks: it could share someone's shipment details with the wrong person if identity isn't checked, and it could give wrong answers.

Controls beyond the baseline:

• AI disclosure: tell users they're talking to AI at the start of the chat.
• Handover: offer a route to a person.
• XW-028: check identity or match the tracking number before showing shipment details, and set rules for keeping chat logs.
• XW-023: confirm whether chats go to a third-party model provider, and whether that provider keeps or trains on them.
• Measure: track answer accuracy and how often chats are escalated to a person.

AI-006: Weekly warehouse volume forecast

What it does: It forecasts weekly warehouse volume from past shipments.

• Who it affects: Planning staff directly; warehouse staffing indirectly.
• Decisions: It supports capacity planning. Planners presumably use the forecast rather than acting on it automatically. Unverified.
• Data: Past shipment volumes. Personal data: likely no if the data is aggregated. Unverified.
• Where the data comes from: Halden's shipment history.

Tier: Minimal-risk.

• It forecasts total volumes and makes no decisions about any person.
• It's not in a listed area and doesn't talk to people.
• If the forecasts were later used to schedule or judge individual workers, re-run intake under the worker-management area.

Controls beyond the baseline:

• Measure: track forecast accuracy against actual volumes.
• XW-028: confirm the input is aggregated.

Decisions needed, in summary:

1. Legal review for AI-004 before anything else: confirm the tier, confirm whether Halden is a deployer or provider, confirm there's no emotion-recognition or biometric feature, and confirm when the obligations apply.
2. AI-003: Operations to confirm routes aren't used to manage drivers.
3. All systems: approve each one and name the approver.
4. Suppliers: each system's owner to confirm its supplier and model provider, which feeds the XW-023 assessment.

``findings [{"type": "high_risk_ai", "id": "AI-004"}] ``