A mid-sized wholesale distributor uses more AI today than it realises: demand forecasting, route optimisation, dynamic pricing, a CRM that scores opportunities, an order-taking chatbot. When the AI Act enters the conversation, the first reaction is usually alarm — "we use AI in everything, this is going to land on us." The reality, once properly classified, is calmer and more interesting: the core operations of distribution are minimal risk. High risk, when it appears, enters through a door almost nobody is watching.
The core: minimal risk, light obligations
Let's run through the typical stack with the classification it actually carries:
Demand forecasting (RELEX, Blue Yonder, SAP IBP and similar tools): prediction by SKU and point of sale, procurement planning. With no bearing on specific individuals, this is a minimal-risk system. No impact assessment, no high-risk obligations; it does still count for the inventory and for the training of the staff who use it.
Route optimisation and delivery: assigning orders to vehicles, sizing the fleet. In its pure logistics use, minimal risk. The fine print appears if the system moves from optimising routes to monitoring and evaluating the driver within a work-related relationship: monitoring and evaluating the performance and behaviour of persons is Annex III, point 4(b), the same door as the performance evaluation covered next.
B2B dynamic pricing: price adjustment between businesses based on demand, margins and segment. In pure B2B, minimal risk from an AI governance standpoint. The caveat: extending it to end consumers with differentiation by personal characteristics changes the analysis entirely and calls for re-assessment before taking that step.
AI-powered CRM (Salesforce Einstein, HubSpot AI, Dynamics): lead scoring, churn prediction, assisted drafting. Minimal risk; remember that B2B contacts are personal data — the GDPR applies in full — and that if the CRM carries out a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based, a data protection impact assessment is required (Article 35(3)(a) GDPR); outside that case, it depends on the Article 35(1) risk analysis and on the Spanish supervisory authority's list.
Customer service chatbot: as in any sector, this triggers transparency towards the customer under Article 50(1) — the notice that the customer is talking to an AI, unless this is obvious to a reasonably well-informed, observant and circumspect person. That obligation belongs to the provider, who must design the system that way; what makes sense on your side is to verify and document that the system builds it in.
The pattern is clear: the distributor's technological core calls for order — inventory, training, transparency, supplier verification — but it doesn't carry high-risk obligations. If someone tells you otherwise, ask them to point to the Annex III point each system falls under.
The door high risk actually walks through: people
Annex III of the AI Act doesn't classify sectors; it classifies uses. And there's one cross-cutting use that can make a system high-risk in any company, in any sector: employment (Annex III, point 4). In a distributor, that shows up as two very common systems:
The AI-powered ATS — screening and scoring applications for warehouse, delivery and office roles. As we covered in detail before, a system intended to analyse and filter job applications and to evaluate candidates falls under Annex III, point 4(a) — the Article 6(3) derogation never applies if it performs profiling of natural persons — and it also triggers GDPR obligations that are already in force today: a data protection impact assessment is required where there is a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person; and candidates have the right not to be subject to a decision based solely on automated processing with those effects, save for the exceptions in Article 22(2) — contract, law or explicit consent — and, in the contract and consent cases, with the Article 22(3) safeguards: at least human intervention, expressing their point of view and contesting the decision.
AI-assisted performance evaluation — HR modules that analyse KPIs, flag "high performers" or recommend promotions. Same door — Annex III, point 4(b), which covers monitoring and evaluating the performance and behaviour of persons in work-related relationships — same regime, with two added layers that matter in distribution: if the applicable collective agreement sets out evaluation procedures, it binds the company and the AI cannot bypass them; and, under Spanish law, the works council — and staff delegates, who have the same powers — has the right to be informed of the parameters, rules and instructions on which the algorithms or AI systems affecting decisions that may bear on working conditions, access to and retention of employment, including profiling, are based (Workers' Statute, Article 64(4)(d)).
The asymmetry is the sector's key commercial and risk insight: most of your stack calls for order; the HR slice calls for rigour. Mixing up the two levels in either direction gets expensive — through excess (paralysis and spend where none is needed) or through neglect (an ATS that profiles candidates to decide on them and has no data protection impact assessment has a GDPR obligation outstanding that is already enforceable today).
What to do, in order
- Take stock of everything, including the AI that arrived bundled inside the ERP and the CRM without a formal purchase decision.
- Classify by splitting the two doors: operations (minimal risk, order) and people (high risk, rigour). What decides is each system's actual purpose, not its product name.
- Close today what's due today: the ATS's impact assessment where the Article 35 GDPR case arises, Article 22 safeguards if there are decisions based solely on automated processing, checking that the chatbot builds in the Article 50(1) notice, and Article 4 AI literacy measures, with a record the article doesn't require but which is how you demonstrate them.
- Schedule what's due tomorrow: the high-risk obligations arrive on the timeline set by the Digital Omnibus — Chapter III, Sections 1, 2 and 3, from 2 December 2027 for Annex III systems — room to build the file properly, not an excuse to leave it unstarted. Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
A distributor that keeps those two waters separate turns the AI Act into what it should be: an exercise in order with one specific point of rigour. No more, no less.
Content in line with Annex III and Articles 4, 6, 26, 50 and 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026), Articles 22 and 35 of Regulation (EU) 2016/679 and Articles 64 and 82 of the Spanish Workers' Statute.
Product mentions are descriptive of the market and do not imply any business relationship. This article is for informational purposes only and does not constitute legal advice.