EU AI Act Addendum

This EU AI Act Addendum ("Exhibit D") forms part of the Data Processing Addendum ("DPA") between Takt, Inc. ("Takt") and Customer and is incorporated into the Agreement. Capitalized terms not defined here have the meaning given in the DPA. Exhibit D sets out how the parties allocate their respective obligations under the EU AI Act in respect of the artificial-intelligence capabilities of the Services, and records the design commitments Takt makes about how artificial intelligence is and is not used in the Services.

Exhibit D takes effect when it is incorporated into the Agreement (the “Effective Date of Exhibit D”).

1. Scope and Application

1(a) When Exhibit D applies

Exhibit D applies where Customer deploys the Services in, or in respect of workers located in, the European Union, or where output of the Services is used in the European Union (Article 2(1) EU AI Act). Where Customer’s use of the Services falls outside the territorial scope of the EU AI Act, Section 4 applies as a contractual commitment, subject to the feature availability and implementation status expressly stated in this Exhibit D. The remaining provisions describe the parties’ allocation of responsibilities where the EU AI Act applies and do not independently impose EU regulatory obligations on uses outside its scope.

1(b) Relationship to the DPA and the Agreement

Exhibit D is an exhibit to the DPA and is subject to Section 11 (Liability and Indemnification), Section 12 (Order of Precedence), and Section 13 (Governing Law, Forum, and Notices) of the DPA. Where an obligation under the EU AI Act cannot be varied by contract, that obligation prevails over any inconsistent term of Exhibit D, the DPA, or the Agreement.

2. Definitions

• "EU AI Act" means Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, as amended, including by Regulation (EU) 2026/1744 (the Digital Omnibus on AI).

• "AI System," "Provider," "Deployer," "High-Risk AI System," "Serious Incident," "Substantial Modification," "Intended Purpose," and "General-Purpose AI Model" have the meanings given in Article 3 EU AI Act.

• "Covered AI Feature" means each capability of the Services that is an AI System, as listed in Annex D-1.

• "Customer-Specific Model" means a machine-learning model trained, tuned, or evaluated using Customer Personal Data at Customer's election under Section 3(i) of the DPA, used solely to provide the Services to Customer.

• "Deterministic Data" means data and metrics produced by the Services from Customer-supplied data using documented, rule-based calculations that do not use an AI System, including transactions, time-clock records, labor standards, productivity and performance metrics, goals, schedules, and manager-entered observations.

• "Employee-Level AI Content" means AI-generated content that concerns an identified or identifiable worker, including employee-level summaries, AI-suggested observations, and inferred classifications of a worker's unrecorded time.

3. Roles of the Parties

3(a) Takt as Provider

Takt is the Provider of each Covered AI Feature. Takt places the Covered AI Features on the Union market under its own name and is responsible for the Provider obligations allocated to it in Section 6.

3(b) Customer as Deployer

Customer is the Deployer of each Covered AI Feature it enables or uses, and is responsible for the Deployer obligations set out in Section 7.

3(c) Changes Affecting Customer’s Role

Customer may become the Provider of a High-Risk AI System where the conditions in Article 25 EU AI Act are met, including through rebranding, a Substantial Modification, or a change of Intended Purpose that brings a system within the High-Risk classification. Customer will notify Takt before undertaking any such change involving a Covered AI Feature, and the parties will cooperate to determine their respective obligations under applicable law. Permitted export of Deterministic Data, or use of an output in another system, does not by itself establish that Customer has become the Provider of Takt’s Covered AI Feature.

3(d) General-Purpose AI Models

Certain Covered AI Features use a General-Purpose AI Model supplied by the AI provider identified in Exhibit B of the DPA. Other Covered AI Features may use models developed or configured specifically for their Intended Purpose, as described in Annex D-1. In respect of those third-party General-Purpose AI Models, Takt is not a Provider of a General-Purpose AI Model and the obligations of Chapter V EU AI Act rest with that Subprocessor. Takt will make available to Customer, on request, the information it receives from that Subprocessor under Article 53(1)(b) EU AI Act to the extent needed for Customer to meet its own obligations.

4. Takt's Design Commitments

Takt makes the following commitments about how artificial intelligence is and is not used in the Services. They apply to every Covered AI Feature, in every deployment region, for the term of the Agreement.

4(a) Data Sources and Grounding

Covered AI Features that generate summaries, explanations, conversational responses, or suggested observations are designed to ground those outputs in Deterministic Data available within Customer’s tenant and, where applicable, Customer’s authorized user prompts. The Services make the underlying operational data and metrics available to Customer for review. AI-generated content may contain errors or unsupported statements and must be reviewed in context before it is relied upon. Break inference operates as separately described in Section 4(b), and Customer-Specific Models operate only within their documented Intended Purpose and Customer’s election under Section 3(i) of the DPA.

4(b) AI does not assign or direct work, and does not decide employment matters

The Services do not use any AI System to assign or direct work to an individual, to allocate tasks, shifts, or breaks, to set or change an individual's labor standard, or to make, recommend, or trigger a decision regarding the hiring, discipline, promotion, compensation, or continuation of employment of any individual. Lists of workers requiring attention are produced by deterministic rules configured by Customer (for example, overdue coaching, observation due dates, or a performance threshold) and not by an AI System.

Break inference. The Services include a Covered AI Feature (not yet enabled as at 14 October 2026; it will be off by default in the European Union deployment and enabled only by Customer) that infers, from gaps in a worker's recorded activity, Customer's break configuration, and the times at which breaks are typically taken, that an unrecorded period was a break rather than idle time. It does not instruct, prompt, or schedule any worker to take a break. Each inferred break is visibly marked as inferred in the Services and may be adjusted or corrected by Customer's authorized personnel. Because an inferred break changes how a worker's time is classified, and therefore the worker's utilization and productivity metrics, Takt treats it as Employee-Level AI Content and classifies it in Annex D-1.

4(c) Human review of AI-generated content about individuals

No AI-generated narrative content concerning an identified or identifiable worker is recorded against that worker's record, or communicated to that worker, unless a member of Customer's authorized personnel has reviewed it and accepted or edited it. The Services enforce this technically. AI-inferred classifications (Section 4(b), break inference) are recorded as inferences, are visibly marked as such wherever they are displayed or used in a calculation, and may be corrected by Customer's authorized personnel at any time.

4(d) No prohibited practices

No Covered AI Feature, and no other part of the Services, (i) infers or detects the emotions or affective state of any individual; (ii) performs biometric identification or categorisation; (iii) evaluates or classifies individuals on the basis of social behaviour or personal characteristics in a way that leads to detrimental treatment unrelated to the context in which the data was collected, or that is disproportionate; (iv) infers special categories of personal data within Article 9 GDPR; or (v) uses subliminal, manipulative, or deceptive techniques. Takt will not introduce any such capability. For clarity, the "engagement signals" used in the Services are purely deterministic — performance-related measures and the time elapsed since a worker's last feedback or observation; the Services do not track emotion, images, biometrics, or health data. Gamification is optional and off by default: Customer may configure games to incentivise employees, and nothing is enabled without Customer's configuration.

4(e) No cross-customer training; Customer-Specific Models on election only

Takt does not use Customer Personal Data to train, fine-tune, evaluate, or improve any AI System or model that is made available to, or that benefits, any other customer, and does not permit its AI Subprocessor to use Customer Personal Data to train its General-Purpose AI Models. Customer-Specific Models are trained only where Customer has elected it under Section 3(i) of the DPA, are isolated to Customer's tenant, are described in Annex D-1, and are deleted with Customer Personal Data under Section 8 of the DPA.

4(f) AI inference in region

AI inference for the European Union deployment is performed on a European Union regional endpoint of Takt's AI Subprocessor. Prompts, the Deterministic Data referenced in them, and generated outputs do not leave the European Union for AI processing.

4(g) Transparency of AI-Generated Content

Takt will clearly identify AI-generated content as such when it is displayed or delivered through the Services. Where an individual interacts directly with a conversational Covered AI Feature, the Services will disclose that the individual is interacting with an AI System at the start of the interaction. Takt will implement machine-readable marking and other transparency measures to the extent required by Article 50 EU AI Act, by the applicable statutory deadlines and subject to applicable transitional provisions. Takt may select and update the technical methods used to meet those requirements, taking account of applicable standards, technical feasibility, and authoritative guidance.

4(h) Customer control of Employee-Level AI Content

Customer may request that Takt disable Employee-Level AI Content for Customer’s tenant by written notice to privacy@takt.io. Takt will implement the request without undue delay and confirm completion to Customer. Where the Services provide an administrator control for a Covered AI Feature, Customer may also enable or disable that feature through that control. Annex D-1 identifies each feature’s current availability, default state, and available controls. New Covered AI Features released after the Effective Date of Exhibit D will be disabled by default in the European Union deployment and enabled only on Customer’s documented instruction.

5. Classification of Covered AI Features

5(a) Takt's position

Takt classifies each Covered AI Feature that generates content concerning an identified or identifiable worker as a High-Risk AI System within Annex III, point 4(b) EU AI Act (AI systems intended to be used to monitor and evaluate the performance and behaviour of persons in work-related relationships). Takt does not rely on the exemption in Article 6(3) for those features. Covered AI Features that generate content only at facility, shift, area, or team level, and Customer-Specific Models that do not evaluate or predict the performance or behaviour of individuals, are classified individually in Annex D-1.

5(b) Timing

The Annex III High-Risk obligations of Chapter III EU AI Act apply from 2 December 2027 (Article 113 as amended by Regulation (EU) 2026/1744). The obligations in Article 4 (AI literacy), Article 5 (prohibited practices), and Article 50 (transparency) already apply. The contractual design commitments in Section 4 apply as stated there. Regulatory obligations apply to each party from the dates on which they become applicable to that party and the relevant Covered AI Feature, taking account of applicable transitional provisions. This Exhibit D does not represent that future High-Risk conformity requirements have already been completed.

5(c) Changes to classification

Takt will notify Customer in writing if it changes the classification of a Covered AI Feature, if the European Commission amends Annex III in a way that affects the Services, or if harmonised standards or Commission guidelines are published that Takt will rely on for conformity.

6. Takt's Obligations as Provider

6(a) Obligations in force

Takt will, from the Effective Date of Exhibit D:

1. Not place on the market or put into service any capability that engages a prohibited practice under Article 5 (Section 4(d)).

2. Meet the transparency obligations applicable to each Covered AI Feature under Article 50 EU AI Act, in accordance with Section 4(g), including applicable statutory deadlines and transitional provisions.

3. Take measures to support the development of AI literacy among Takt personnel and other persons who develop, operate, or support the Covered AI Features on Takt’s behalf, taking account of their roles, experience, and the context of use (Article 4).

4. Maintain a register of Covered AI Features (Annex D-1) and make it available to Customer through the Takt Trust Center.

6(b) High-Risk readiness commitments

For each Covered AI Feature subject to High-Risk Provider requirements, Takt will implement the following measures to the extent required by the EU AI Act, by the applicable statutory deadlines and subject to applicable transitional provisions.

1. Risk management (Article 9). Establish and maintain a documented risk-management system for the Covered AI Features, covering the fundamental-rights risks to workers that place the features in Annex III point 4(b).

2. Data governance (Article 10). Document the data used to develop, evaluate, and operate the Covered AI Features and the Customer-Specific Models, and carry out and document appropriate bias assessment and testing as required by applicable law. Where bias testing requires processing of special categories of personal data under Article 10(5), Takt will do so only on the conditions in that Article and with Customer's written agreement under Section 10(d) of the DPA.

3. Technical documentation (Article 11; Annex IV). Maintain technical documentation for each Covered AI Feature.

4. Logging (Article 12 and 19). Takt will implement automatic logging appropriate to each applicable High-Risk Covered AI Feature to support traceability, monitoring, and human oversight. Takt will retain logs under its control for the period required by applicable law and make relevant logs available to Customer through the Services or on request, subject to appropriate access controls. Logging will follow data-minimization principles and the retention provisions of the DPA.

5. Instructions for use (Article 13). Provide Customer with instructions for use for each Covered AI Feature — its Intended Purpose, its inputs, its known limitations and foreseeable misuse, its accuracy and robustness characteristics, the human-oversight measures built into it, and the logging it performs — and keep them current. Customer may use that information for its DPIA under Article 35 GDPR and Article 26(9) EU AI Act.

6. Human oversight (Article 14). Design each Covered AI Feature so that Customer's personnel can understand, monitor, override, disregard, or reverse its output (Section 4(c)).

7. Accuracy, robustness, cybersecurity (Article 15). Define and measure accuracy metrics for each Covered AI Feature and maintain the security measures in Exhibit A of the DPA.

8. Quality management system (Article 17). Maintain a quality management system covering the Covered AI Features, integrated with Takt's existing information security program.

9. Conformity assessment, declaration, and CE marking (Articles 43, 47, 48). Carry out the conformity assessment procedure based on internal control (Annex VI), draw up the EU declaration of conformity, and affix the CE marking as applicable to software.

10. Registration (Article 49). As required by applicable law, register each Covered AI Feature that is a High-Risk AI System in the EU database before placing it on the market or putting it into service after the statutory date.

11. Authorised representative (Article 22). Appoint, by written mandate, an authorised representative established in the Union and record its details in Annex D-2. The Article 27 GDPR representatives identified in the DPA do not act as Takt's authorised representative under the EU AI Act unless so recorded.

12. Post-market monitoring (Article 72). Operate a post-market monitoring system for the Covered AI Features.

13. Corrective action (Article 20). Where Takt considers that a Covered AI Feature is not in conformity, take corrective action, withdraw or disable it, and inform Customer and, where required, the market surveillance authority.

6(c) Readiness Information

Takt will make available to Customer on reasonable request an accurate summary of its implementation status and readiness measures relevant to the Covered AI Features Customer uses. Planned capabilities and target dates do not represent currently available functionality or binding release commitments unless expressly agreed in the Agreement. Nothing in this Section postpones an obligation already applicable under law or another express commitment in this Exhibit D.

7. Customer's Obligations as Deployer

Customer will use the Covered AI Features in accordance with their documented Intended Purpose, maintain meaningful human review of Employee-Level AI Content, and comply with applicable worker-notification, consultation, and data-protection requirements. The statutory Deployer obligations below apply to the extent, and from the dates, required by applicable law for the relevant Covered AI Feature.

1. Use per instructions (Article 26(1)). Use the Covered AI Features in accordance with Takt's instructions for use and the Intended Purpose stated in Annex D-1.

2. Human oversight (Article 26(2)). Assign oversight of the Covered AI Features to natural persons who have the competence, training, and authority to review, override, and disregard AI-generated content, and ensure that AI-generated content about a worker is reviewed before any action is taken on it.

3. Input data (Article 26(4)). Ensure that the data Customer supplies to the Services is relevant and sufficiently representative for the Intended Purpose, and configure labor standards, goals, and thresholds responsibly.

4. Monitoring and incidents (Article 26(5)). Monitor the operation of the Covered AI Features on the basis of the instructions for use, and inform Takt without undue delay, and in any event within forty-eight (48) hours, where Customer has reason to consider that use of a Covered AI Feature may present a risk to health, safety, or fundamental rights, or has identified a Serious Incident. Customer will suspend use of the affected feature where required by Article 26(5). Any shorter notification or immediate-action requirement under applicable law remains applicable.

5. Logs (Article 26(6)). Retain the logs made available under Section 6(b)(4) for at least six (6) months, or such longer period as applicable law requires.

6. Information to workers (Article 26(7)). Before putting a Covered AI Feature into service at a workplace, inform workers' representatives and the affected workers that they will be subject to the use of a High-Risk AI System, in accordance with Union and national law and practice on the information of workers, and meet any consultation or co-determination requirement that applies.

7. Information to affected persons (Article 26(11)). Inform workers that a Covered AI Feature is used in respect of them, including where AI-generated content informs coaching, observation, or performance discussions.

8. Right to explanation (Article 86). Respond to requests from workers for a clear and meaningful explanation of the role of a Covered AI Feature in a decision meeting the conditions of Article 86 EU AI Act. Takt will provide reasonable assistance under Section 3(f) of the DPA.

9. Data protection impact assessment (Article 26(9)). Use the information provided under Section 6(b)(5) in carrying out its assessment under Article 35 GDPR.

10. AI literacy (Article 4). Take measures to support the development of AI literacy among its personnel who use the Covered AI Features.

11. Fundamental-rights impact assessment (Article 27). Customer is responsible for determining whether Article 27 requires a fundamental-rights impact assessment for its deployment and for completing any assessment required by applicable law.

8. Incidents, Changes, and Cooperation

8(a) Serious Incidents

Where Takt becomes aware of a Serious Incident involving a Covered AI Feature, Takt will notify Customer within forty-eight (48) hours of becoming aware, using the notice contacts specified in Section 13(b) of the DPA, and will make any report required under Article 73 to the market surveillance authority of the Member State where the incident occurred. A Serious Incident that also constitutes a Security Incident is handled under both this Section and Section 5 of the DPA. Nothing in this Section postpones any earlier report or action required by applicable law.

8(b) Substantial Modifications and New Features

Takt will give Customer at least thirty (30) days’ advance written notice before making a Substantial Modification to a Covered AI Feature that Customer has enabled or changing that feature’s Intended Purpose. Where an urgent change is reasonably necessary to address a security, safety, legal-compliance, or material operational risk, Takt may implement the change sooner and will notify Customer as soon as reasonably practicable. Takt will update Annex D-1 and the applicable instructions for use to reflect the change. This notice exception does not waive any assessment, conformity, or other requirement that applicable law requires before the change is implemented.

New Covered AI Features released after the Effective Date of Exhibit D will be disabled by default in the European Union deployment and enabled only on Customer’s documented instruction, in accordance with Section 4(h).

Takt will assess whether changes to a Covered AI Feature, including changes to its underlying model or model version, constitute a Substantial Modification under the EU AI Act and will document that assessment. A model-version change is not automatically treated as either a Substantial Modification or exempt from that classification.

8(c) Cooperation with authorities (Article 21)

Each party will cooperate with a competent national authority or the AI Office in relation to the Covered AI Features, and will promptly inform the other of any request from such an authority concerning the Services, unless legally prohibited.

8(d) Assistance

Takt will provide reasonable assistance to Customer, at Customer's expense where the assistance exceeds the documentation and features described in Exhibit D, in meeting Customer's obligations under Section 7.

9. Review

Takt will review Exhibit D at least annually and following material changes to applicable law, authoritative regulatory guidance, or the functionality, Intended Purpose, or classification of a Covered AI Feature. Takt will update relevant feature information and contact details as appropriate. Any amendment to the parties’ contractual obligations remains subject to the amendment provisions of the Agreement.

Annex D-1 — Register of Covered AI Features

Non-AI Functionality — Needs-Attention List

The needs-attention list identifies workers with overdue coaching, observations due, or performance below Customer-configured thresholds using deterministic rules. It is not a Covered AI Feature. This description applies to the deterministic list-generation functionality; AI-generated content presented alongside the list remains subject to the applicable provisions of Exhibit D.

Annex D-2 — Contacts

• Takt AI compliance and privacy contact: privacy@takt.io

• Data Protection Officer: Where required by applicable Data Protection Laws, Takt will designate a Data Protection Officer and publish the applicable contact details. Privacy inquiries may be directed to privacy@takt.io.

• Authorised representative in the European Union: Where required under Article 22 EU AI Act, Takt will appoint an authorised representative established in the European Union by written mandate before placing the relevant High-Risk AI System on the Union market or putting it into service. Takt will make the representative’s identity and contact details available to Customer. Appointment as a representative under Article 27 GDPR does not, by itself, constitute appointment under the EU AI Act.

• AI service provider: Google Cloud Vertex AI (Gemini), as identified in Exhibit B of the DPA. AI inference for the European Union deployment is performed on a European Union regional endpoint in accordance with Section 4(f).

Annex D-3 — Regulatory Timeline

Reference date: 20 October 2026

This annex summarises relevant statutory application dates. Applicability to a particular party, model, or Covered AI Feature remains subject to the EU AI Act, including its scope, exceptions, transitional provisions, and subsequent amendments.

This annex does not certify Takt’s implementation status or create additional product-release deadlines. Takt’s contractual commitments are set out in the substantive provisions of Exhibit D.