AI in recruitment and HR: opportunities and what the EU AI Act requires
Recruitment software with AI scoring is legally classified as high-risk AI. What that already requires from HR teams, even if you buy the tool rather than build it.
- AI tools that screen CVs, rank candidates or assess employment suitability fall under Annex III (category 4) of the EU AI Act, these are legally classified as high-risk AI.
- AI literacy (Article 4) already applies to every HR team using AI tools, including those bought from a vendor rather than built in-house. This has been in force since 2 February 2025.
- As a deployer you share responsibility for the use of high-risk AI in your recruitment process, even if the AI was built by an external supplier.
- Three steps to take now: carry out an AI inventory of your HR tools, record it in an AI register, and provide documented AI literacy training to your HR team.
AI makes recruitment smarter and more accountable
Many HR teams and recruitment agencies already use AI: software that scores CVs, ranks candidates or suggests interview questions. The benefits are clear, more speed, less routine work, more consistent selection. But the EU AI Act has a consequence many HR professionals are not yet aware of: AI that supports personnel decisions is legally classified under Annex III of the Act. That is the category of high-risk AI. This means stricter obligations than for ordinary AI tools, and those obligations apply to companies that buy in the AI from a vendor, not just those that build it themselves.
Three things you need to know
The EU AI Act draws a clear line: AI that influences employment and personnel management is legally high-risk AI. This applies to the software, and to the businesses that work with it.
Annex III: recruitment AI is high-risk AI
Annex III (category 4) of the EU AI Act explicitly names AI systems used for recruitment and selection, assessing employment suitability, promoting or dismissing employees, and monitoring performance. If your recruitment software scores CVs, ranks candidates or makes a recommendation about who to invite for an interview, that software falls into this category. This applies regardless of whether you built the tool yourself or purchased it from a supplier.
Deployers share responsibility
Under the EU AI Act, as a deployer you share responsibility for how high-risk AI is used in your organisation, even when the AI was built by an external supplier. That means you must, among other things, appoint a human overseer for AI-assisted decisions in the recruitment process, train employees adequately, and document your compliance with the high-risk AI obligations. This is in addition to the AI literacy obligation (Article 4) that has already applied since 2 February 2025.
You must inform candidates and workers
High-risk AI in recruitment carries information duties that are unique to hiring. A candidate whose outcome was (partly) determined by an AI system has a right to an explanation of the system's role and logic in the decision. In addition, workers and their representatives (works council) must be informed before you deploy a high-risk AI system in the workplace. This aligns with existing obligations under labour law and works council rules.
The GDPR applies in parallel: watch Article 22
The AI Act sits on top of the GDPR, not instead of it. Recruitment processes personal data, so you need a legal basis and usually a Data Protection Impact Assessment (DPIA). Article 22 GDPR is key: a candidate may not be subjected to a solely automated decision with legal or similarly significant effects unless a valid exception and safeguards apply. In practice this means: never let an AI reject or select on its own without a human reviewing and being able to justify the decision.
When do the stricter rules take effect?
The Annex III obligations for high-risk AI were scheduled for 2 August 2026 but have been deferred to 2 December 2027 via the 'Digital Omnibus' (formally adopted by the EU Council on 29 June 2026; entry into force upon publication in the Official Journal of the EU, expected before 2 August 2026). On 2 August 2026 the national supervisory authorities do receive their powers and obligations such as AI literacy (Article 4) and the transparency obligations (Article 50) are enforced. The AI literacy obligation already applies today. Fines for breaching most obligations can reach €15 million or 3% of worldwide annual turnover, whichever is higher; for prohibited practices up to €35 million or 7%.
How HR teams can start now
You don't have to wait to act. Three steps that already add value: (1) Carry out an AI inventory of your HR tools, which software do you use for recruitment, assessment or personnel management? Does it have AI features? (2) Record this in an AI register, per tool: what does the AI do, who uses it, what decisions does it support and is there human oversight? (3) Provide AI literacy training to your HR team, not a generic course, but tailored to the AI tools recruiters and HR managers use day to day. Document that you did this. These three steps give you a strong foundation for both the already-applicable Article 4 obligation and the stricter Annex III rules that will be enforced later.
Frequently asked questions about AI in recruitment and the EU AI Act
Does our applicant tracking system (ATS) fall under the EU AI Act?
We buy the AI from a supplier, are we still liable?
What do HR employees need to know about AI literacy?
When do the stricter high-risk rules for recruitment AI take effect?
Do we have to tell candidates we use AI in selection?
Does the AI Act apply to us if we are outside the EU but recruit in the EU?
How quickly can we become compliant?
Make your recruitment AI compliant?
Book a free intake for the AI Act Scan. We look together at your HR tools, the risk classification and what is needed, no commitment.
Book a free AI Act intake →Free and without obligation · Reply within one business day · Fixed price up front, no surprises