EU AI Act

How the EU AI Act treats recruitment AI

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. It sorts AI systems into four tiers: prohibited practices, high-risk systems, systems with transparency duties (such as chatbots) and everything else.

Employment sits in Annex III, the list of high-risk uses. Point 4 covers AI systems intended to be used:

• for recruitment or selection, in particular to place targeted job ads, analyze and filter applications, and evaluate candidates; and
• to make decisions affecting work relationships, such as promotion or termination, to allocate tasks based on behavior or personal traits, or to monitor and evaluate performance and behavior.

That captures most of the modern recruiting stack: CV ranking and matching, AI-scored assessments, video interview scoring, chatbots that screen out candidates, and programmatic ad tools that decide who sees a posting. A system that only performs a narrow procedural task, such as converting CVs into a standard format or scheduling interviews, may fall outside the high-risk category under Article 6(3), but the provider has to document that assessment.

The Act applies to providers that place systems on the EU market and to deployers using them in the EU, and it reaches non-EU companies when the output of their AI is used in the EU.

Banned practices and dates already in force

Two sets of rules have applied since 2 February 2025.

Prohibited practices. Article 5 bans, among other things, AI that infers the emotions of people in the workplace, except for medical or safety reasons, and biometric categorization that infers race, political opinions, union membership, religious beliefs or sexual orientation. Any interview tool that claims to read enthusiasm, honesty or stress from facial expressions or voice is now off the table for EU candidates and employees.

AI literacy. Article 4 requires providers and deployers to take measures so that staff who operate AI systems have sufficient AI literacy. For TA teams, that means recruiters and hiring managers understand what the tool does, where it can be wrong and when to override it.

The high-risk obligations for Annex III systems, including recruitment tools, were scheduled to apply from 2 August 2026. In late 2025 the European Commission proposed, through its Digital Omnibus package, to push that deadline back for Annex III systems to as late as December 2027. Check the current position before you set internal deadlines, and do not treat a delay as a reason to stop preparing.

What employers must do as deployers

Most employers are deployers: they use a high-risk system built by someone else. Article 26 sets out their main duties:

1. Use the system according to the provider's instructions, and only for the purpose it was designed for.
2. Assign human oversight to people with the competence, training and authority to understand the output and override it. A recruiter who rubber-stamps every AI rejection is not oversight.
3. Control input data. Where you supply data, such as job requirements or historical hiring decisions, make sure it is relevant and sufficiently representative.
4. Monitor the system and tell the provider, and in serious cases the authorities, about risks or serious incidents. Suspend use if you believe it presents a risk.
5. Keep logs generated by the system for at least six months, unless other law says otherwise.
6. Inform workers' representatives and affected workers before putting a high-risk system into use in the workplace.
7. Tell candidates and employees that they are subject to a high-risk AI system when it is used to make or assist decisions about them.

Under Article 86, people affected by a decision based on a high-risk system's output can ask for a clear explanation of the AI's role in it. Deployers also keep their GDPR duties, including data protection impact assessments and the Article 22 limits on fully automated decisions. See our page on GDPR in recruitment for that side.

If you substantially modify a high-risk tool, or put your own name on it, you can become the provider and inherit the much heavier provider obligations.

What vendors must provide

Providers of high-risk recruitment AI must run a risk management system, apply data governance to training data (including examining it for possible biases), produce technical documentation, design for logging and human oversight, meet accuracy and cybersecurity requirements, pass a conformity assessment, apply CE marking and register the system in the EU database.

For buyers, this changes vendor due diligence. Ask for the instructions for use, the intended purpose statement, the conformity status, how bias was tested, what logs the system keeps and how you export them. A vendor who cannot answer these questions clearly is a risk you will carry.

Worked example: a multinational BPO

A BPO with centers in Romania, the Philippines and the US uses an AI tool to rank applicants and score recorded voice assessments for its EU sites. The EU hiring decisions bring the tool into scope.

The head of TA, Laura, inventories every AI tool in the funnel and finds three high-risk uses: ranking, voice scoring and an ad platform that targets job ads. She removes a 'sentiment' feature from the voice tool because it infers emotion. She designates two senior recruiters as oversight owners, trains them on the vendor's documentation, and sets a rule that no candidate is rejected on AI score alone. Logs are kept for 12 months. Candidates see a short notice in the application flow, and the works council is briefed before launch. She also runs a quarterly bias audit on pass rates by sex and age band for each site.

Penalties and common mistakes

Fines for prohibited practices can reach 35 million euros or 7% of worldwide annual turnover. Breaches of most other obligations, including deployer duties, can reach 15 million euros or 3%.

Common mistakes: assuming the vendor carries all the compliance, keeping emotion or personality inference features switched on, treating a 'human in the loop' who never overrides as oversight, failing to brief works councils, and having no inventory of where AI touches hiring decisions. The fix for most of these is a standing AI governance process with a named owner, a tool inventory and a review cadence. National implementation and enforcement vary by member state, so confirm local requirements.