Why is AI in recruitment high-risk under the AI Act?
The AI Act (Regulation (EU) 2024/1689) sorts AI systems by risk. Annex III lists areas where AI can seriously affect people's lives, and employment is one of them. Point 4(a) covers AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
That wording is broad. A tool that ranks sourced candidates against a vacancy evaluates candidates, even if nobody applied. A system that screens CVs filters applications. Both are likely to fall within Annex III, which is why AI recruitment vendors and their users should plan for high-risk obligations.
Is every AI feature in recruitment software high-risk?
Not automatically. Article 6(3) allows an Annex III system not to be treated as high-risk when it does not pose a significant risk, for example when it only performs a narrow procedural task or a preparatory task. There is an important exception: an Annex III system that profiles natural persons is always considered high-risk. Ranking candidates on their experience and skills is profiling, so most sourcing and matching tools will not qualify for the exception.
Features that do not evaluate people, such as a tool that fixes the grammar in a job ad, are a different matter. The assessment is per system and per intended purpose, and it has to be documented.
What is already prohibited?
Since 2 February 2025 some AI practices are banned outright. For HR the most relevant is AI that recognises emotions of people in the workplace, except for medical or safety reasons. Biometric categorisation that infers sensitive traits such as ethnicity or political opinions is also prohibited. An interview tool that scores a candidate's emotions from video is therefore not a compliance project but a stop.
When do the AI Act rules apply to recruitment?
The AI Act applies in phases. In July 2026 the Digital Omnibus on AI (Regulation (EU) 2026/1744) postponed the high-risk obligations.
Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 and the European Commission's announcement that the AI Omnibus entered into force on 27 July 2026.
What must providers of recruitment AI do?
The provider is the organisation that develops the AI system and puts it on the market under its own name. For high-risk systems, providers carry the heaviest obligations:
- A risk management system across the life cycle of the system (Article 9).
- Data governance: training and test data that are relevant, representative and checked for bias as far as possible (Article 10).
- Technical documentation and automatic logging of events (Articles 11 and 12).
- Clear instructions for use, so deployers understand capabilities and limits (Article 13).
- Design for effective human oversight (Article 14), and appropriate accuracy, robustness and cybersecurity (Article 15).
- A quality management system, a conformity assessment, CE marking and registration in the EU database before the system is placed on the market.
When does a user become a provider?
Article 25 describes when a deployer takes on provider obligations: for example when it puts its own name on a high-risk system, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk. An agency that builds its own ranking model on top of a general AI model should look at this carefully.
What must employers and agencies using recruitment AI do?
The AI Act calls the organisation that uses the system under its own authority the deployer. That is the in-house talent acquisition team, the recruitment agency or the staffing agency. Article 26 lists what deployers of high-risk systems must do:
- Use the system in line with the provider's instructions for use.
- Assign human oversight to people who have the competence, training and authority to do it.
- Where you control the input data, make sure it is relevant and sufficiently representative for the purpose.
- Monitor the system, and inform the provider and authorities about risks or serious incidents.
- Keep the automatically generated logs under your control for at least six months, unless other law requires otherwise.
- As an employer, inform workers' representatives and affected workers before putting a high-risk system into use in the workplace.
- Inform people who are subject to decisions made or assisted by the system that it is being used.
The right to an explanation
Article 86 gives people who are significantly and adversely affected by a decision based on the output of an Annex III high-risk system the right to a clear and meaningful explanation of the role the AI played and the main elements of the decision. In recruitment, that means you should be able to say why a candidate was or was not taken forward. Explainable ranking is not a nice-to-have.
How the AI Act relates to GDPR
The AI Act does not replace GDPR. You still need a lawful basis to process candidate data, must inform candidates and must respect Article 22 on automated decision-making. Deployers can use the provider's information when carrying out a data protection impact assessment. See our GDPR guide for candidate sourcing.
What does human oversight look like in practice?
Human oversight is more than a person who can press stop. The AI Act expects the people overseeing a system to understand its limits, avoid blindly trusting its output, be able to interpret results and be able to override or reverse them. In sourcing, that translates into concrete rules per action. AIcruiters is built around that principle: see human in the loop.
- Approval rules per action: search strategy, shortlist, outreach and handover.
- Every ranking comes with reasons, missing requirements and risk factors.
- Recruiters can review and correct rankings and refine the criteria before outreach.
- Uncertain cases go to a person instead of being decided automatically.
- AIcruiters does not decide who is hired.
How do you prepare your recruitment team now?
The postponement to December 2027 gives you time, but not a reason to wait. Contracts signed now will still run then, and GDPR already applies today. A practical approach:
A preparation checklist
Work through these steps with HR, legal and your privacy officer:
- Inventory. List every tool that uses AI in recruitment: sourcing, CV screening, assessments, chatbots, scheduling.
- Classify. For each tool, note whether it evaluates or filters people. If so, assume high-risk unless the provider documents otherwise.
- Ask providers. Request their AI Act roadmap, instructions for use, logging options and how human oversight is designed.
- Set oversight. Name who reviews output, what they may override and how that is recorded.
- Inform. Update candidate privacy notices and involve the works council where required before introducing a new system.
- Train. Make sure recruiters understand what the system does, where it fails and when to overrule it.
- Stop what is prohibited. Remove emotion recognition in interviews or assessments.
What should you ask an AI sourcing vendor about the AI Act?
Vendors cannot make you compliant, but they determine a large part of what you can demonstrate. Ask how they classify their system and why, which documentation and instructions for use they provide, what logs you can access and for how long, how ranking is explained per candidate, and which approval and override controls exist. Be careful with vendors who describe their product as 'AI Act compliant' today: the high-risk requirements and harmonised standards are still being implemented. Our buyer's guide to AI sourcing tools has a broader checklist, and our security page explains how privacy and hosting are handled in the technical review.