AI-Driven Dispatch and the EU AI Act: What Your System Allocates on Decides its Risk Class

AI-driven dispatch assigns orders to vehicles and drivers against live constraints and learns from what happened. Whether such a system is a high-risk AI system under the EU AI Act is not settled by the fact that it uses AI, or by the fact that it affects drivers. Annex III, point 4(b) captures systems intended to be used, in the words of the regulation, “to allocate tasks based on individual behaviour or personal traits or characteristics.” The classification therefore turns on the allocation basis. A system assigning work on load attributes, vehicle capacity, service areas, time windows and licence class is arguably outside that wording. A system assigning work on driver performance scores, acceptance rates or behavioural telematics is plausibly inside it. Same category of software, different risk class, decided by a design choice most procurement teams never write down.

Two facts make this worth resolving now. The obligations for a high-risk system split between provider and deployer, and the deployer’s share cannot be contracted away to the vendor. And although the compliance date moved, it did not move past the life of the contract you are about to sign.

Why AI Act classification is a dispatch design question in Europe

The instinct in most logistics organisations is to treat AI regulation as a vendor problem. The vendor builds the model, so the vendor carries the paperwork. For dispatch systems in Europe that instinct is wrong in a specific and expensive way.

Annex III of the AI Act lists the use cases that make a standalone system high-risk. Point 4 covers employment and worker management and has three limbs: recruitment and selection; decisions on terms, promotion and termination together with task allocation and performance monitoring; and monitoring of emotional or behavioural states. Dispatch has nothing to do with recruitment, which is why the category is usually skipped. The exposure is in the middle limb.

The obligations that follow are split. Providers carry conformity assessment, technical documentation and a quality management system. Deployers carry a separate list. Under Article 26, a deployer must assign human oversight to natural persons with “the necessary competence, training and authority, as well as the necessary support,” must retain automatically generated logs for “at least six months,” and, before putting a high-risk system into service at work, must “inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system.” None of that is discharged by buying from a conformant provider.

The financial exposure is not theoretical. Article 99 sets three fine tiers, and Article 26 sits in the middle one: up to 15 million euros or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For a group with 4 billion euros of turnover the percentage governs, putting the ceiling at 120 million euros. Prohibited practices under Article 5 carry a higher tier that does not apply here.

The timetable changed in July 2026 and much of the published guidance still reflects the old dates. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026, six days before the original high-risk deadline, and deferred the Annex III obligations.

The deferral was granted because harmonised standards and conformity-assessment capacity were not ready, not because the classification questions were resolved. And the deferral is shorter than a procurement cycle. A three-year platform contract signed in September 2026 runs to September 2029, which places 21 of its 36 months, 58% of the term, after 2 December 2027. On a five-year term it is 45 of 60 months, or 75%. The system you select this quarter is the system that has to satisfy the obligation, so the classification question belongs in the evaluation rather than in a later remediation project.

How to classify an AI-driven dispatch system under Annex III

This is a legal assessment and the steps below are a structured way to prepare for one, not a substitute for counsel. Classification is fact-specific and depends on your deployment, your workforce model and your national implementation.

1. Establish whether you are the provider, the deployer or both

Buying a dispatch platform and running it makes you a deployer. Building your own allocation engine, or putting your own name on a system you place into service, can make you a provider with the full conformity obligations attached, and so can using a purchased system outside its stated intended purpose. Most transport operations are deployers, some are unknowingly both, and the answer decides which obligation list applies.

2. Test the allocation basis against the Annex III wording

Write down every input the engine uses to decide which driver gets which work, then sort those inputs into four groups. Load-derived: weight, volume, destination, time window, temperature class, required vehicle type. Asset-derived: vehicle capacity, current location, range, tail-lift. Qualification-derived: licence class, hazardous goods certification, contracted hours, shift availability, language. Behaviour-derived: historical service time per stop, productivity ranking, job acceptance rate, telematics safety score, customer rating.

The first three groups describe the work and the means of doing it. The fourth describes the person. Point 4(b) refers to allocation “based on individual behaviour or personal traits or characteristics,” and it is the fourth group that engages that wording. A qualification is arguably a contractual fact rather than a personal trait, which is why a licence class sits differently from a performance ranking, but that is exactly the kind of distinction on which counsel should form the view.

3. Test the monitoring limb separately

Point 4(b) also captures systems used “to monitor and evaluate the performance and behaviour of persons” in work-related relationships. This is an independent trigger. A dispatch system can allocate purely on load, asset and qualification attributes and still fall inside point 4 because it produces driver scorecards, ranks depots by individual compliance, or feeds a performance review. Closing the allocation door does not close the monitoring door. Operations assuming a constraint-based engine is out of scope frequently miss this, because the scorecard was built by another team for another reason and is not thought of as part of the dispatch system.

4. Check whether human review changes the classification

It usually does not. A dispatcher approving a machine-generated plan is human oversight, which is an obligation for high-risk systems rather than an exemption from them. If the intended use is listed in Annex III, a review step does not remove it from the list. Human oversight is how you comply, not how you avoid the classification, and treating an approval click as a scope exclusion is the most common error in this area.

5. Map the deployer obligations you cannot delegate

Article 26 duties belong to you. Assign human oversight to named people with the competence and authority to override a plan, and be able to show the training. Retain logs for at least six months. Where you control input data, be able to evidence its relevance and representativeness. Inform workers and their representatives before the system goes live. Inform individuals that they are subject to it where the system makes or assists decisions about them. Then check what your national law adds, because works councils in several member states hold co-determination rights over performance-monitoring technology on a shorter timetable than the AI Act.

6. Date the obligation against your contract term and your works council calendar

Set the compliance date against the contract, as above, then set the notification duty against the industrial relations calendar. Informing worker representatives before go-live is a sequencing requirement rather than a document, and in a co-determination jurisdiction that consultation can add months to a deployment. Discovering it after signature turns a legal question into a delivery delay.

Behaviour-scored and constraint-based allocation compared

The right-hand column is not illegitimate. Behaviour-based allocation can be lawful and operated compliantly. The point is that it carries a regulatory consequence and is usually chosen by default rather than deliberately, because the data was available and adding it improved a metric.

Five criteria for evaluating AI-driven dispatch in Europe

Declared allocation inputs. Ask the vendor to enumerate every field the allocation engine can read, and which are enabled in your configuration. If the answer is a category rather than a list, you cannot classify the system and neither can your counsel.

Separability of behavioural signals. Establish whether performance scoring can be switched off in allocation while remaining available for coaching. A system that hard-wires behavioural inputs into the optimiser removes your ability to change risk class later without replacing it.

Decision logging depth. Article 26 requires log retention, but a timestamp is not a record of a decision. Ask what is retained per assignment: the trigger, the constraints in force, the alternatives, the reasoning and the outcome.

Human oversight design. Check that oversight is a configurable boundary rather than a blanket approval queue. The obligation is meaningful override by competent people, which is not a dispatcher clicking accept on 400 plans a day.

Documentation you can hand to a regulator. Ask for the intended purpose statement, the instructions for use and the technical documentation, then read them against your actual deployment. A mismatch between stated purpose and real use is how a deployer becomes a provider.

What this looks like in enterprise deployments

A global lottery operator running field service dispatch and scheduling across more than 25 US states allocates technicians against per-jurisdiction contracts, labour laws, SLA windows and technician skills. The allocation basis is qualification and contract, not behaviour: the constraint that selects a technician is what they are certified to do and what the jurisdiction permits. The deployment delivered 20% lower SLA penalty risk, 18% lower fuel spend and 15% less drive distance and time. The lesson transfers to Europe directly: the design that handles 25 sets of labour rules is the design that handles 27 member states, and it delivers service performance without a behavioural input.

A Fortune 50 parcel operation running centralised dispatch across a 120-country network moves more than a million freight shipments a year across 51 sites with a 4,500-strong driver pool split between captive and third-party. That split matters for AI Act purposes, because the Article 26 notification duty attaches to workers and their representatives, and a mixed pool of employed drivers and contracted providers has no single answer to who must be informed. The deployment lifted weekly execution adherence from 75% to 92% and surfaced more than 14 million dollars of unused capacity, including 565,000 dollars at a single site, all of it found in constraint fidelity and plan adherence rather than in ranking drivers.

Four mistakes European operators make on AI Act scope

Treating classification as the vendor’s answer. The provider classifies its product against its stated intended purpose. You deploy it against your workforce, in your jurisdiction, with your configuration. Those can differ, and Article 26 liability is yours either way.

Assuming the deferral is a reprieve. The date moved to 2 December 2027 while the standards that will define conformity are still being written, so requirements will firm up late with your contract already signed. That argues for optionality in the system, not delay in the decision.

Adding a performance score because it was available. Behavioural inputs arrive quietly, usually as a tie-breaker in the optimiser or a fairness rule in shift allocation. Each is defensible individually and together they change the risk class of the system. Whoever owns the allocation configuration needs to know that.

Confusing Article 50 with Annex III. Transparency duties for AI interaction stayed on the original 2 August 2026 timeline and are already live. High-risk obligations moved. Operations that read the deferral headline and stood down their whole AI programme have missed duties that did not move.

How Locus approaches allocation basis and governance

Locus, the world’s first Decision-Intelligent, Agentic TMS, allocates work against more than 250 real-world operating constraints drawn from load, asset and qualification attributes: capacity, vehicle type, service area, time window, temperature class, licence and certification. Because the route planning system produces dispatch-ready plans in roughly two minutes and re-optimises continuously, plan quality comes from constraint fidelity and re-planning speed rather than from ranking individuals, which is the design position that matters for an Annex III conversation.

The governance layer is built around the same evidence a deployer obligation requires. Explainability and Traceability record the trigger, context, reasoning, action and outcome for each decision, which is a decision record rather than an event log. Autonomy Levels run per agent and per domain, so human review can be placed on the decision classes that need a competent person and lifted from the ones that do not, which is closer to what Article 26 oversight actually asks for than a universal approval queue. Evaluation, Execution Sandbox and Human Review complete a six-mechanism framework built so enterprise operations can show why an automated decision was taken.

Two boundaries are worth stating plainly. Locus does not provide legal advice, and nothing here classifies your deployment. Whether a given configuration falls inside Annex III point 4 depends on the inputs you enable, the workforce you deploy against and your national implementation, and that determination belongs to your counsel. Second, Locus does not decide your allocation policy for you. If your operation wants performance-weighted allocation, that is a configuration you can ask for, and the consequence is a different classification conversation rather than a refusal. What the platform provides is the ability to make that choice explicitly and to evidence it afterwards.

Locus supports more than 360 enterprise customers across 30-plus countries, with over 1.5 billion deliveries optimised, more than 320 million dollars in documented client logistics savings and 99.99% uptime. It has been recognised by Gartner for seven consecutive years, featured in the 2026 Hype Cycle for Supply Chain Execution and Logistics Technologies, named a Leader in TMS by QKS Group (SPARK Matrix), and ranked #1 in Route Planning on G2’s 2026 Best Software Awards.

In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Locus continues to operate independently.

So is AI-driven dispatch a high-risk AI system under the EU AI Act? It depends on what the system allocates on, and that is a design choice rather than a property of the category. Annex III point 4(b) captures task allocation based on individual behaviour or personal traits, and it separately captures monitoring and evaluating worker performance, so an engine allocating on load, asset and qualification attributes reads differently from one allocating on driver scores, and either can be pulled in by a scorecard built alongside it. The obligations that follow are split, and the deployer’s share under Article 26, competent human oversight, six months of logs and informing workers before go-live, cannot be contracted to the vendor while sitting in the fine tier of up to 15 million euros or 3% of worldwide turnover. The Digital Omnibus moved the deadline to 2 December 2027, which is 21 months inside a three-year contract signed today. Locus allocates against more than 250 constraints derived from loads, assets and qualifications rather than from individual behaviour, records the trigger, reasoning, action and outcome of each decision through Explainability and Traceability, and places human review per decision class through Autonomy Levels, so the allocation basis is a documented choice you can put in front of counsel. Request a Locus dispatch assessment to review your own allocation inputs.

Frequently Asked Questions

Is AI-driven dispatch a high-risk AI system under the EU AI Act? Not automatically. Annex III point 4(b) captures task allocation “based on individual behaviour or personal traits or characteristics.” Allocation on load attributes, vehicle capacity, time windows and licence class is arguably outside that wording, while allocation on driver performance scores or behavioural telematics is plausibly inside it. Classification is fact-specific and belongs to your legal counsel.

When do the high-risk obligations actually apply? Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved Annex III standalone high-risk obligations from 2 August 2026 to 2 December 2027. Annex I systems embedded in regulated products moved to 2 August 2028. Article 50 transparency duties stayed on the original 2 August 2026 timeline.

Can we rely on the vendor’s compliance? No. Provider and deployer obligations are separate. Article 26 places competent human oversight, log retention of at least six months, input data relevance where you control the data, and worker notification before go-live on the deployer. Buying a conformant system does not discharge them.

Does adding a dispatcher approval step remove the system from scope? No. Human oversight is an obligation for high-risk systems rather than an exemption from the classification. If the intended use falls within Annex III, a review step is part of how you comply. Treating an approval click as a scope exclusion is a common and expensive misreading.

What if our dispatch system allocates on constraints but also scores drivers? Point 4(b) has two independent triggers, and the second covers systems used to monitor and evaluate the performance and behaviour of workers. A constraint-based allocation engine that also produces driver scorecards can fall inside point 4 on the monitoring limb alone, even though the allocation limb is not engaged.

What are the penalties for a deployer breach? Article 26 breaches sit in the middle fine tier under Article 99: up to 15 million euros or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. Prohibited practices carry the higher 35 million euro or 7% tier, and supplying incorrect or misleading information carries 7.5 million euros or 1%.

Do works councils matter separately from the AI Act? Yes, and often sooner. Several member states give worker representatives co-determination rights over performance-monitoring technology, which can apply before the AI Act deadline and can add months to a deployment. The Article 26 duty to inform representatives before go-live sits alongside those national rights rather than replacing them.