Last updated:
EU AI Act and Recruitment: What Hiring Teams Must Do
Applicant Tracking System
The Recruitify Team
The EU AI Act classifies AI used for recruitment and selection as high-risk, and it applies to US agencies and employers whenever the output of a tool is used in the EU or affects candidates there. After the Digital Omnibus amendment, the main high-risk obligations for these tools now apply from 2 December 2027, not August 2026. That gives hiring teams a window of roughly 13 months from today (20 October 2026) to inventory their tools, set up human oversight and prepare candidate notices. Some duties, such as AI literacy and the ban on certain practices, already apply.
This guide explains which hiring tools are covered, who carries which obligations, what changed in the timeline, and how to prepare without freezing your recruitment process.
Key takeaways
AI that screens, filters, ranks or evaluates candidates, and AI that targets job ads, is listed as high-risk in Annex III of the AI Act.
High-risk obligations for these systems now apply from 2 December 2027, but the ban on emotion recognition at work and the AI literacy duty already apply.
Most agencies and HR teams are deployers: they need human oversight, logging, candidate information and, where applicable, a fundamental rights impact assessment.
The Act reaches non-EU companies when a system’s output is used in the EU, so a US-based agency placing candidates in Europe is in scope.
A tool that supports a recruiter’s judgment and leaves an audit trail is far easier to defend than one that makes decisions on its own.
Table of Contents
The fundamental rights impact assessment and bias monitoring
Our perspective: AI that supports recruiters, not replaces them
Why recruitment AI is treated as high-risk
The Act sorts AI systems by the harm they can cause. Hiring sits in the high-risk tier because decisions about who gets a job shape livelihoods, and because, as the European Commission’s AI Act Service Desk puts it, AI can perpetuate historical patterns of discrimination across the recruitment process.
Annex III, point 4, names two groups of employment uses. The first covers systems intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyze and filter applications and to evaluate candidates. The second covers systems used to make decisions affecting the terms of work relationships, promotion or termination, to allocate tasks based on behavior or personal traits, or to monitor and evaluate performance.
In practice, the following tools are likely to fall into scope:
CV screening and ranking engines, including keyword and semantic matching that produces a ranked shortlist.
AI candidate scoring that assigns a match percentage or grade.
Targeted job advertising tools that decide who sees a vacancy.
Video interview analysis and automated assessments of skills or competencies.
Performance and productivity monitoring used for staff decisions.
Tools that only perform narrow, preparatory tasks may fall outside the high-risk category, but the Act sets conditions for that exemption, and a system that profiles individuals is always treated as high-risk. If a tool touches candidate evaluation, plan as if it is covered, and ask your vendor and your counsel for a written classification.
What is already banned or required today
Not everything waits until 2027. According to the high-level summary of the Act, prohibited practices include emotion recognition in the workplace, except for medical or safety reasons, and biometric categorization used to infer sensitive attributes such as race, political opinions or sexual orientation. A video-interview tool that claims to read candidates’ emotions is therefore not a gray area.
The AI literacy duty is also live. Since February 2025, providers and deployers must take reasonable measures so that staff using AI systems have a sufficient understanding of them, as Eversheds Sutherland explains. For a recruitment team, that means recruiters should know what a match score represents, what data feeds it, where it can be wrong, and when to override it. Keep a record of the training you deliver.
The timeline after the Digital Omnibus
The original date for high-risk obligations was 2 August 2026. The Digital AI Omnibus, now Regulation (EU) 2026/1744, changed that. According to Usercentrics’ summary, it has been in force since 27 July 2026, moves the Annex III deadline to 2 December 2027 and the Annex I deadline to 2 August 2028. The Future of Privacy Forum gives the same dates in its overview of the revised timeline.
Some older articles still quote the 2026 date, so check the publication date of anything you read. Here is how the timeline looks for a hiring team:
Milestone | What it means for recruitment |
|---|---|
August 2024 | The Act entered into force |
February 2025 | Prohibited practices and the AI literacy duty apply |
2 December 2027 | Annex III high-risk obligations apply, including recruitment and selection tools |
2 August 2028 | Obligations for AI embedded in products under Annex I |
The delay is a grace period for preparation, not a reason to stop. Contracts you sign now will still be running in December 2027, and the data you collect today will be what your future audits examine.
Provider or deployer: where your agency sits
The Act splits responsibility between providers, who develop or place a system on the market, and deployers, who use it under their own authority. Staffing and recruitment firms are usually deployers, as the AI Act resource on staffing businesses explains.
That matters because the duties differ. Providers carry the heavy load: risk management, technical documentation, conformity assessment. Deployers carry duties tied to how the tool is used.
Deployer duties
According to Eversheds Sutherland’s practical guide, deployers of high-risk employment systems must:
Put technical and organizational measures in place so the system is used according to the provider’s instructions.
Assign human oversight to trained, competent people.
Monitor the system’s operation and report serious incidents or risks.
Keep the automatically generated logs for a period appropriate to the purpose, at least six months.
Inform affected individuals, and workers’ representatives where relevant, before the system is put into use.
Carry out a fundamental rights impact assessment (FRIA) where the Act requires one.
Human oversight is the point most hiring teams underestimate. The same sources stress that an AI tool cannot be left to make final hiring decisions without meaningful human involvement. A recruiter who clicks “accept” on every shortlist within seconds is unlikely to count as meaningful oversight.
When a deployer becomes a provider
Many agencies assume that buying an off-the-shelf tool keeps them on the deployer side permanently. The Eversheds guidance warns otherwise: a substantial modification, such as retraining a model on your own proprietary database or changing the algorithm to score candidates on criteria the original developer did not include, can make you the provider, with the conformity assessment liabilities that follow. Before you customize any scoring logic, ask the vendor in writing what configuration is within the intended use and what is not.
Does the EU AI Act apply to US companies?
Yes, in many cases. The Act applies to providers and deployers outside the EU when the output of the AI system is used in the Union. For recruitment, the staffing resource notes that this catches non-EU firms that screen EU-based candidates or place people with EU clients. Moving data processing offshore does not remove the obligation.
A few concrete situations show how this works:
A US agency sources developers in Poland or Germany for a client in Austin and uses AI scoring on their profiles. The tool’s output affects EU residents, so the Act is relevant.
A US employer hires remote workers across several EU countries and uses an AI screening tool on all applicants. The EU applicants are covered.
A US agency that recruits only for US roles from US candidates is generally outside the Act, although US state and city rules on automated hiring tools may apply, and those deserve their own legal review.
The practical first step is to audit your candidate database and sourcing workflows and mark which records and which searches involve EU residents or EU roles.
The fundamental rights impact assessment and bias monitoring
A FRIA is a structured document describing how and why you use the system, which groups it affects, what risks to their rights it creates, how humans oversee it and what you do if harm occurs. It is not a one-time form. Because a model can reproduce historical discrimination when fed unrepresentative hiring data, the monitoring continues for as long as the tool is in use.
A workable FRIA for a recruitment team usually covers:
The purpose of the tool (for example, ranking applicants for IT contract roles) and the roles and countries involved.
The data it uses, and where that data comes from.
The categories of candidates affected, including groups likely to be disadvantaged by gaps in data, such as career breaks or non-linear paths.
The oversight process: who reviews outputs, how they can override them, and what authority they have.
Measures if risks materialize: pausing the tool, escalating, notifying candidates.
On the practical side, run periodic checks comparing shortlists with and without the AI step, look at pass-through rates across applicant groups, and record what you found and what you changed. Our own piece on AI bias in recruiting and a per-job audit plan walks through a simple routine.
Transparency toward candidates
Candidates have a right to know when AI plays a role in a decision about them and to ask for human review. The EU’s employment services network says in its guide for jobseekers that the Act treats AI in employment decisions as high-risk, and that people should understand the role AI plays in their application. Agencies that explain this plainly are better placed to meet the disclosure requirements than those that hide it.
A candidate notice should say, in plain language:
that an automated system helps screen, score or match applications;
what the system looks at, for example skills, experience and project requirements;
that a recruiter reviews the result and makes the decision;
how to ask for human review or raise a concern, and whom to contact.
Put this in your application forms, your career page and your privacy notice. If you build a branded career site, make the notice part of the template rather than an afterthought.
How the AI Act fits with GDPR
The AI Act does not replace data protection law. Legal commentators such as Eversheds Sutherland recommend treating it as an extension of your existing GDPR program rather than a separate technical hurdle. Both regimes ask similar questions: what data do you hold, on what legal basis, who can see it, how long do you keep it, and can you show it?
That overlap helps. If you already maintain consent records, retention schedules and access logs for candidate data, you have a base for AI Act logging and documentation. If you keep candidates in spreadsheets, inboxes and personal folders, you have a bigger gap to close, since neither regime can be satisfied when you cannot find out where a candidate’s data sits.
Fines and enforcement
Penalties are tiered. The staffing-sector resource cited above states that non-compliance with high-risk obligations can reach 15 million EUR or 3% of global annual turnover, whichever is higher. Prohibited practices attract higher ceilings. Beyond fines, the more immediate commercial risk is that EU clients will ask for proof of compliance in procurement questionnaires, and agencies that cannot answer will lose placements.
A practical preparation plan for 2026 to 2027
You do not need to rebuild your stack. You need to know what you use and be able to show how you use it. A sensible order of work:
Inventory every AI feature in your hiring workflow. Include parsers, matching engines, scoring, ad targeting, chatbots and sourcing extensions, and note which ones touch EU candidates.
Classify each tool. Ask the vendor to confirm in writing whether it considers the feature high-risk, and what its intended-use statement says.
Confirm your role. Document why you are a deployer, and flag any customization that could amount to a substantial modification.
Train your people. Cover what each score means, known limits, bias risks and override procedure. Keep attendance and materials on file.
Define human oversight. Name who reviews AI output, what they check and how overrides are recorded.
Switch on logging and set retention. Keep logs at least six months, and align longer periods with your GDPR schedule.
Prepare candidate notices and a route for requesting human review.
Draft the FRIA where required, and schedule recurring bias checks.
Update client contracts. EU clients will want to know what AI you use on their searches.
If you want a deeper look at the scoring step specifically, our guide to AI candidate scoring and how to use it responsibly covers what a score should and should not be used for.
Our perspective: AI that supports recruiters, not replaces them
We build recruitment software for IT agencies and headhunters, so we read the AI Act as people who have to translate it into product decisions. Three views shape how we think about it.
First, the law and good recruiting point the same way. A match score is useful when it narrows a long list into a shortlist a recruiter then evaluates with context the algorithm cannot see: motivation, client culture, a candidate’s reason for moving. The Act’s insistence on meaningful human oversight describes how experienced recruiters already want to work. We explore this in our article on AI scoring without losing the human touch.
Second, compliance is mostly a data-hygiene problem. Logs, consent records and an audit trail only work when candidate data lives in one system. That is why Recruitify brings the ATS, the CRM and the contracting module into one environment, with GDPR consent management and a full audit trail built into the architecture. Having these records in one place does not make an agency compliant by itself, because the deployer’s own duties remain: oversight, training, notices and assessments. But it removes the hardest obstacle, which is not knowing where the evidence is.
Third, explainability beats opacity. We design scoring so that a recruiter sees a percentage match against stated project requirements and can judge the reasoning, rather than receiving an unexplained verdict. Anything that cannot be explained to a candidate on request is a liability under the Act.
- Recruitify Team
Where Recruitify fits
If you are consolidating scattered tools while you prepare for the Act, our platform combines candidate database and ATS, CRM, AI matching and scoring, CV parsing and Blind CV generation in a single workspace, with GDPR consent handling and an audit trail. You can review the AI recruitment features first, then see plans on the pricing page: the HR Team plan is €69 per month per user, the Recruitment Agencies plan is €79 per month per user, and Enterprise pricing is available on request through the same page.
FAQ
Does the EU AI Act apply to the USA?
It applies to US companies when the output of their AI system is used in the EU, or when the system affects people in the EU. A US agency that screens EU candidates or fills roles for EU clients with AI tools is in scope. A purely domestic US hiring process generally is not, though US state and local rules may apply.
Is all AI in HR high-risk under the Act?
No, but the core recruitment uses are. Annex III lists systems for recruitment and selection, application filtering, candidate evaluation and decisions on work terms, promotion, termination, task allocation and performance monitoring. Administrative tools such as calendar scheduling are less likely to be covered. Have the vendor and your counsel confirm the classification of each feature.
Did the EU AI Act pass, and when do the hiring rules start?
Yes. The Act entered into force in August 2024. After the Digital Omnibus, now Regulation (EU) 2026/1744, the high-risk rules for employment systems apply from 2 December 2027. The ban on workplace emotion recognition and the AI literacy duty already apply.
Can we still use AI scoring and CV parsing for EU candidates?
Yes, with conditions. You need human oversight by trained staff, logging, candidate information, and a FRIA where required, and no final decision should rest on the AI alone. Tools that explain their output and keep an audit trail make those conditions much easier to meet.
Who is responsible: the software vendor or the agency?
Both, for different things. The vendor, as provider, handles documentation, risk management and conformity assessment. The agency, as deployer, handles oversight, training, logs, notices and use within the vendor’s instructions. Substantially modifying a system can shift provider duties onto you.
Sources
Annex III: High-Risk AI Systems, EU Artificial Intelligence Act
EU AI Act: High-risk AI systems in employment, Eversheds Sutherland
The EU AI Act Deal: Digital Omnibus Now in Force, Usercentrics
Recommended
3.4M Applicants Show AI Recruiting Bias: HR Per Job Audit Plan
How Artificial Intelligence is Transforming Recruitment in 2025: Hype vs. Reality
News & Updates
Stay up-to-date with the latest innovations, features, and tips about Recruitify!
By providing your email address within the newsletter sign-up form, you confirm its processing to send marketing information regarding the Administrator’s products and services. The Administrator of your personal data processed for the abovementioned purposes is Recruitify Spółka z o.o., based in Warsaw, Poland (KRS 0000709889). For more information on the principles of personal data processing and the rights of data subjects, please check the Privacy Policy.
Last updated:
EU AI Act and Recruitment: What Hiring Teams Must Do
Applicant Tracking System
The Recruitify Team
The EU AI Act classifies AI used for recruitment and selection as high-risk, and it applies to US agencies and employers whenever the output of a tool is used in the EU or affects candidates there. After the Digital Omnibus amendment, the main high-risk obligations for these tools now apply from 2 December 2027, not August 2026. That gives hiring teams a window of roughly 13 months from today (20 October 2026) to inventory their tools, set up human oversight and prepare candidate notices. Some duties, such as AI literacy and the ban on certain practices, already apply.
This guide explains which hiring tools are covered, who carries which obligations, what changed in the timeline, and how to prepare without freezing your recruitment process.
Key takeaways
AI that screens, filters, ranks or evaluates candidates, and AI that targets job ads, is listed as high-risk in Annex III of the AI Act.
High-risk obligations for these systems now apply from 2 December 2027, but the ban on emotion recognition at work and the AI literacy duty already apply.
Most agencies and HR teams are deployers: they need human oversight, logging, candidate information and, where applicable, a fundamental rights impact assessment.
The Act reaches non-EU companies when a system’s output is used in the EU, so a US-based agency placing candidates in Europe is in scope.
A tool that supports a recruiter’s judgment and leaves an audit trail is far easier to defend than one that makes decisions on its own.
Table of Contents
The fundamental rights impact assessment and bias monitoring
Our perspective: AI that supports recruiters, not replaces them
Why recruitment AI is treated as high-risk
The Act sorts AI systems by the harm they can cause. Hiring sits in the high-risk tier because decisions about who gets a job shape livelihoods, and because, as the European Commission’s AI Act Service Desk puts it, AI can perpetuate historical patterns of discrimination across the recruitment process.
Annex III, point 4, names two groups of employment uses. The first covers systems intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyze and filter applications and to evaluate candidates. The second covers systems used to make decisions affecting the terms of work relationships, promotion or termination, to allocate tasks based on behavior or personal traits, or to monitor and evaluate performance.
In practice, the following tools are likely to fall into scope:
CV screening and ranking engines, including keyword and semantic matching that produces a ranked shortlist.
AI candidate scoring that assigns a match percentage or grade.
Targeted job advertising tools that decide who sees a vacancy.
Video interview analysis and automated assessments of skills or competencies.
Performance and productivity monitoring used for staff decisions.
Tools that only perform narrow, preparatory tasks may fall outside the high-risk category, but the Act sets conditions for that exemption, and a system that profiles individuals is always treated as high-risk. If a tool touches candidate evaluation, plan as if it is covered, and ask your vendor and your counsel for a written classification.
What is already banned or required today
Not everything waits until 2027. According to the high-level summary of the Act, prohibited practices include emotion recognition in the workplace, except for medical or safety reasons, and biometric categorization used to infer sensitive attributes such as race, political opinions or sexual orientation. A video-interview tool that claims to read candidates’ emotions is therefore not a gray area.
The AI literacy duty is also live. Since February 2025, providers and deployers must take reasonable measures so that staff using AI systems have a sufficient understanding of them, as Eversheds Sutherland explains. For a recruitment team, that means recruiters should know what a match score represents, what data feeds it, where it can be wrong, and when to override it. Keep a record of the training you deliver.
The timeline after the Digital Omnibus
The original date for high-risk obligations was 2 August 2026. The Digital AI Omnibus, now Regulation (EU) 2026/1744, changed that. According to Usercentrics’ summary, it has been in force since 27 July 2026, moves the Annex III deadline to 2 December 2027 and the Annex I deadline to 2 August 2028. The Future of Privacy Forum gives the same dates in its overview of the revised timeline.
Some older articles still quote the 2026 date, so check the publication date of anything you read. Here is how the timeline looks for a hiring team:
Milestone | What it means for recruitment |
|---|---|
August 2024 | The Act entered into force |
February 2025 | Prohibited practices and the AI literacy duty apply |
2 December 2027 | Annex III high-risk obligations apply, including recruitment and selection tools |
2 August 2028 | Obligations for AI embedded in products under Annex I |
The delay is a grace period for preparation, not a reason to stop. Contracts you sign now will still be running in December 2027, and the data you collect today will be what your future audits examine.
Provider or deployer: where your agency sits
The Act splits responsibility between providers, who develop or place a system on the market, and deployers, who use it under their own authority. Staffing and recruitment firms are usually deployers, as the AI Act resource on staffing businesses explains.
That matters because the duties differ. Providers carry the heavy load: risk management, technical documentation, conformity assessment. Deployers carry duties tied to how the tool is used.
Deployer duties
According to Eversheds Sutherland’s practical guide, deployers of high-risk employment systems must:
Put technical and organizational measures in place so the system is used according to the provider’s instructions.
Assign human oversight to trained, competent people.
Monitor the system’s operation and report serious incidents or risks.
Keep the automatically generated logs for a period appropriate to the purpose, at least six months.
Inform affected individuals, and workers’ representatives where relevant, before the system is put into use.
Carry out a fundamental rights impact assessment (FRIA) where the Act requires one.
Human oversight is the point most hiring teams underestimate. The same sources stress that an AI tool cannot be left to make final hiring decisions without meaningful human involvement. A recruiter who clicks “accept” on every shortlist within seconds is unlikely to count as meaningful oversight.
When a deployer becomes a provider
Many agencies assume that buying an off-the-shelf tool keeps them on the deployer side permanently. The Eversheds guidance warns otherwise: a substantial modification, such as retraining a model on your own proprietary database or changing the algorithm to score candidates on criteria the original developer did not include, can make you the provider, with the conformity assessment liabilities that follow. Before you customize any scoring logic, ask the vendor in writing what configuration is within the intended use and what is not.
Does the EU AI Act apply to US companies?
Yes, in many cases. The Act applies to providers and deployers outside the EU when the output of the AI system is used in the Union. For recruitment, the staffing resource notes that this catches non-EU firms that screen EU-based candidates or place people with EU clients. Moving data processing offshore does not remove the obligation.
A few concrete situations show how this works:
A US agency sources developers in Poland or Germany for a client in Austin and uses AI scoring on their profiles. The tool’s output affects EU residents, so the Act is relevant.
A US employer hires remote workers across several EU countries and uses an AI screening tool on all applicants. The EU applicants are covered.
A US agency that recruits only for US roles from US candidates is generally outside the Act, although US state and city rules on automated hiring tools may apply, and those deserve their own legal review.
The practical first step is to audit your candidate database and sourcing workflows and mark which records and which searches involve EU residents or EU roles.
The fundamental rights impact assessment and bias monitoring
A FRIA is a structured document describing how and why you use the system, which groups it affects, what risks to their rights it creates, how humans oversee it and what you do if harm occurs. It is not a one-time form. Because a model can reproduce historical discrimination when fed unrepresentative hiring data, the monitoring continues for as long as the tool is in use.
A workable FRIA for a recruitment team usually covers:
The purpose of the tool (for example, ranking applicants for IT contract roles) and the roles and countries involved.
The data it uses, and where that data comes from.
The categories of candidates affected, including groups likely to be disadvantaged by gaps in data, such as career breaks or non-linear paths.
The oversight process: who reviews outputs, how they can override them, and what authority they have.
Measures if risks materialize: pausing the tool, escalating, notifying candidates.
On the practical side, run periodic checks comparing shortlists with and without the AI step, look at pass-through rates across applicant groups, and record what you found and what you changed. Our own piece on AI bias in recruiting and a per-job audit plan walks through a simple routine.
Transparency toward candidates
Candidates have a right to know when AI plays a role in a decision about them and to ask for human review. The EU’s employment services network says in its guide for jobseekers that the Act treats AI in employment decisions as high-risk, and that people should understand the role AI plays in their application. Agencies that explain this plainly are better placed to meet the disclosure requirements than those that hide it.
A candidate notice should say, in plain language:
that an automated system helps screen, score or match applications;
what the system looks at, for example skills, experience and project requirements;
that a recruiter reviews the result and makes the decision;
how to ask for human review or raise a concern, and whom to contact.
Put this in your application forms, your career page and your privacy notice. If you build a branded career site, make the notice part of the template rather than an afterthought.
How the AI Act fits with GDPR
The AI Act does not replace data protection law. Legal commentators such as Eversheds Sutherland recommend treating it as an extension of your existing GDPR program rather than a separate technical hurdle. Both regimes ask similar questions: what data do you hold, on what legal basis, who can see it, how long do you keep it, and can you show it?
That overlap helps. If you already maintain consent records, retention schedules and access logs for candidate data, you have a base for AI Act logging and documentation. If you keep candidates in spreadsheets, inboxes and personal folders, you have a bigger gap to close, since neither regime can be satisfied when you cannot find out where a candidate’s data sits.
Fines and enforcement
Penalties are tiered. The staffing-sector resource cited above states that non-compliance with high-risk obligations can reach 15 million EUR or 3% of global annual turnover, whichever is higher. Prohibited practices attract higher ceilings. Beyond fines, the more immediate commercial risk is that EU clients will ask for proof of compliance in procurement questionnaires, and agencies that cannot answer will lose placements.
A practical preparation plan for 2026 to 2027
You do not need to rebuild your stack. You need to know what you use and be able to show how you use it. A sensible order of work:
Inventory every AI feature in your hiring workflow. Include parsers, matching engines, scoring, ad targeting, chatbots and sourcing extensions, and note which ones touch EU candidates.
Classify each tool. Ask the vendor to confirm in writing whether it considers the feature high-risk, and what its intended-use statement says.
Confirm your role. Document why you are a deployer, and flag any customization that could amount to a substantial modification.
Train your people. Cover what each score means, known limits, bias risks and override procedure. Keep attendance and materials on file.
Define human oversight. Name who reviews AI output, what they check and how overrides are recorded.
Switch on logging and set retention. Keep logs at least six months, and align longer periods with your GDPR schedule.
Prepare candidate notices and a route for requesting human review.
Draft the FRIA where required, and schedule recurring bias checks.
Update client contracts. EU clients will want to know what AI you use on their searches.
If you want a deeper look at the scoring step specifically, our guide to AI candidate scoring and how to use it responsibly covers what a score should and should not be used for.
Our perspective: AI that supports recruiters, not replaces them
We build recruitment software for IT agencies and headhunters, so we read the AI Act as people who have to translate it into product decisions. Three views shape how we think about it.
First, the law and good recruiting point the same way. A match score is useful when it narrows a long list into a shortlist a recruiter then evaluates with context the algorithm cannot see: motivation, client culture, a candidate’s reason for moving. The Act’s insistence on meaningful human oversight describes how experienced recruiters already want to work. We explore this in our article on AI scoring without losing the human touch.
Second, compliance is mostly a data-hygiene problem. Logs, consent records and an audit trail only work when candidate data lives in one system. That is why Recruitify brings the ATS, the CRM and the contracting module into one environment, with GDPR consent management and a full audit trail built into the architecture. Having these records in one place does not make an agency compliant by itself, because the deployer’s own duties remain: oversight, training, notices and assessments. But it removes the hardest obstacle, which is not knowing where the evidence is.
Third, explainability beats opacity. We design scoring so that a recruiter sees a percentage match against stated project requirements and can judge the reasoning, rather than receiving an unexplained verdict. Anything that cannot be explained to a candidate on request is a liability under the Act.
- Recruitify Team
Where Recruitify fits
If you are consolidating scattered tools while you prepare for the Act, our platform combines candidate database and ATS, CRM, AI matching and scoring, CV parsing and Blind CV generation in a single workspace, with GDPR consent handling and an audit trail. You can review the AI recruitment features first, then see plans on the pricing page: the HR Team plan is €69 per month per user, the Recruitment Agencies plan is €79 per month per user, and Enterprise pricing is available on request through the same page.
FAQ
Does the EU AI Act apply to the USA?
It applies to US companies when the output of their AI system is used in the EU, or when the system affects people in the EU. A US agency that screens EU candidates or fills roles for EU clients with AI tools is in scope. A purely domestic US hiring process generally is not, though US state and local rules may apply.
Is all AI in HR high-risk under the Act?
No, but the core recruitment uses are. Annex III lists systems for recruitment and selection, application filtering, candidate evaluation and decisions on work terms, promotion, termination, task allocation and performance monitoring. Administrative tools such as calendar scheduling are less likely to be covered. Have the vendor and your counsel confirm the classification of each feature.
Did the EU AI Act pass, and when do the hiring rules start?
Yes. The Act entered into force in August 2024. After the Digital Omnibus, now Regulation (EU) 2026/1744, the high-risk rules for employment systems apply from 2 December 2027. The ban on workplace emotion recognition and the AI literacy duty already apply.
Can we still use AI scoring and CV parsing for EU candidates?
Yes, with conditions. You need human oversight by trained staff, logging, candidate information, and a FRIA where required, and no final decision should rest on the AI alone. Tools that explain their output and keep an audit trail make those conditions much easier to meet.
Who is responsible: the software vendor or the agency?
Both, for different things. The vendor, as provider, handles documentation, risk management and conformity assessment. The agency, as deployer, handles oversight, training, logs, notices and use within the vendor’s instructions. Substantially modifying a system can shift provider duties onto you.
Sources
Annex III: High-Risk AI Systems, EU Artificial Intelligence Act
EU AI Act: High-risk AI systems in employment, Eversheds Sutherland
The EU AI Act Deal: Digital Omnibus Now in Force, Usercentrics
Recommended
3.4M Applicants Show AI Recruiting Bias: HR Per Job Audit Plan
How Artificial Intelligence is Transforming Recruitment in 2025: Hype vs. Reality
News & Updates
Stay up-to-date with the latest innovations, features, and tips about Recruitify!
By providing your email address within the newsletter sign-up form, you confirm its processing to send marketing information regarding the Administrator’s products and services. The Administrator of your personal data processed for the abovementioned purposes is Recruitify Spółka z o.o., based in Warsaw, Poland (KRS 0000709889). For more information on the principles of personal data processing and the rights of data subjects, please check the Privacy Policy.
Last updated:
EU AI Act and Recruitment: What Hiring Teams Must Do
Applicant Tracking System
The Recruitify Team
The EU AI Act classifies AI used for recruitment and selection as high-risk, and it applies to US agencies and employers whenever the output of a tool is used in the EU or affects candidates there. After the Digital Omnibus amendment, the main high-risk obligations for these tools now apply from 2 December 2027, not August 2026. That gives hiring teams a window of roughly 13 months from today (20 October 2026) to inventory their tools, set up human oversight and prepare candidate notices. Some duties, such as AI literacy and the ban on certain practices, already apply.
This guide explains which hiring tools are covered, who carries which obligations, what changed in the timeline, and how to prepare without freezing your recruitment process.
Key takeaways
AI that screens, filters, ranks or evaluates candidates, and AI that targets job ads, is listed as high-risk in Annex III of the AI Act.
High-risk obligations for these systems now apply from 2 December 2027, but the ban on emotion recognition at work and the AI literacy duty already apply.
Most agencies and HR teams are deployers: they need human oversight, logging, candidate information and, where applicable, a fundamental rights impact assessment.
The Act reaches non-EU companies when a system’s output is used in the EU, so a US-based agency placing candidates in Europe is in scope.
A tool that supports a recruiter’s judgment and leaves an audit trail is far easier to defend than one that makes decisions on its own.
Table of Contents
The fundamental rights impact assessment and bias monitoring
Our perspective: AI that supports recruiters, not replaces them
Why recruitment AI is treated as high-risk
The Act sorts AI systems by the harm they can cause. Hiring sits in the high-risk tier because decisions about who gets a job shape livelihoods, and because, as the European Commission’s AI Act Service Desk puts it, AI can perpetuate historical patterns of discrimination across the recruitment process.
Annex III, point 4, names two groups of employment uses. The first covers systems intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyze and filter applications and to evaluate candidates. The second covers systems used to make decisions affecting the terms of work relationships, promotion or termination, to allocate tasks based on behavior or personal traits, or to monitor and evaluate performance.
In practice, the following tools are likely to fall into scope:
CV screening and ranking engines, including keyword and semantic matching that produces a ranked shortlist.
AI candidate scoring that assigns a match percentage or grade.
Targeted job advertising tools that decide who sees a vacancy.
Video interview analysis and automated assessments of skills or competencies.
Performance and productivity monitoring used for staff decisions.
Tools that only perform narrow, preparatory tasks may fall outside the high-risk category, but the Act sets conditions for that exemption, and a system that profiles individuals is always treated as high-risk. If a tool touches candidate evaluation, plan as if it is covered, and ask your vendor and your counsel for a written classification.
What is already banned or required today
Not everything waits until 2027. According to the high-level summary of the Act, prohibited practices include emotion recognition in the workplace, except for medical or safety reasons, and biometric categorization used to infer sensitive attributes such as race, political opinions or sexual orientation. A video-interview tool that claims to read candidates’ emotions is therefore not a gray area.
The AI literacy duty is also live. Since February 2025, providers and deployers must take reasonable measures so that staff using AI systems have a sufficient understanding of them, as Eversheds Sutherland explains. For a recruitment team, that means recruiters should know what a match score represents, what data feeds it, where it can be wrong, and when to override it. Keep a record of the training you deliver.
The timeline after the Digital Omnibus
The original date for high-risk obligations was 2 August 2026. The Digital AI Omnibus, now Regulation (EU) 2026/1744, changed that. According to Usercentrics’ summary, it has been in force since 27 July 2026, moves the Annex III deadline to 2 December 2027 and the Annex I deadline to 2 August 2028. The Future of Privacy Forum gives the same dates in its overview of the revised timeline.
Some older articles still quote the 2026 date, so check the publication date of anything you read. Here is how the timeline looks for a hiring team:
Milestone | What it means for recruitment |
|---|---|
August 2024 | The Act entered into force |
February 2025 | Prohibited practices and the AI literacy duty apply |
2 December 2027 | Annex III high-risk obligations apply, including recruitment and selection tools |
2 August 2028 | Obligations for AI embedded in products under Annex I |
The delay is a grace period for preparation, not a reason to stop. Contracts you sign now will still be running in December 2027, and the data you collect today will be what your future audits examine.
Provider or deployer: where your agency sits
The Act splits responsibility between providers, who develop or place a system on the market, and deployers, who use it under their own authority. Staffing and recruitment firms are usually deployers, as the AI Act resource on staffing businesses explains.
That matters because the duties differ. Providers carry the heavy load: risk management, technical documentation, conformity assessment. Deployers carry duties tied to how the tool is used.
Deployer duties
According to Eversheds Sutherland’s practical guide, deployers of high-risk employment systems must:
Put technical and organizational measures in place so the system is used according to the provider’s instructions.
Assign human oversight to trained, competent people.
Monitor the system’s operation and report serious incidents or risks.
Keep the automatically generated logs for a period appropriate to the purpose, at least six months.
Inform affected individuals, and workers’ representatives where relevant, before the system is put into use.
Carry out a fundamental rights impact assessment (FRIA) where the Act requires one.
Human oversight is the point most hiring teams underestimate. The same sources stress that an AI tool cannot be left to make final hiring decisions without meaningful human involvement. A recruiter who clicks “accept” on every shortlist within seconds is unlikely to count as meaningful oversight.
When a deployer becomes a provider
Many agencies assume that buying an off-the-shelf tool keeps them on the deployer side permanently. The Eversheds guidance warns otherwise: a substantial modification, such as retraining a model on your own proprietary database or changing the algorithm to score candidates on criteria the original developer did not include, can make you the provider, with the conformity assessment liabilities that follow. Before you customize any scoring logic, ask the vendor in writing what configuration is within the intended use and what is not.
Does the EU AI Act apply to US companies?
Yes, in many cases. The Act applies to providers and deployers outside the EU when the output of the AI system is used in the Union. For recruitment, the staffing resource notes that this catches non-EU firms that screen EU-based candidates or place people with EU clients. Moving data processing offshore does not remove the obligation.
A few concrete situations show how this works:
A US agency sources developers in Poland or Germany for a client in Austin and uses AI scoring on their profiles. The tool’s output affects EU residents, so the Act is relevant.
A US employer hires remote workers across several EU countries and uses an AI screening tool on all applicants. The EU applicants are covered.
A US agency that recruits only for US roles from US candidates is generally outside the Act, although US state and city rules on automated hiring tools may apply, and those deserve their own legal review.
The practical first step is to audit your candidate database and sourcing workflows and mark which records and which searches involve EU residents or EU roles.
The fundamental rights impact assessment and bias monitoring
A FRIA is a structured document describing how and why you use the system, which groups it affects, what risks to their rights it creates, how humans oversee it and what you do if harm occurs. It is not a one-time form. Because a model can reproduce historical discrimination when fed unrepresentative hiring data, the monitoring continues for as long as the tool is in use.
A workable FRIA for a recruitment team usually covers:
The purpose of the tool (for example, ranking applicants for IT contract roles) and the roles and countries involved.
The data it uses, and where that data comes from.
The categories of candidates affected, including groups likely to be disadvantaged by gaps in data, such as career breaks or non-linear paths.
The oversight process: who reviews outputs, how they can override them, and what authority they have.
Measures if risks materialize: pausing the tool, escalating, notifying candidates.
On the practical side, run periodic checks comparing shortlists with and without the AI step, look at pass-through rates across applicant groups, and record what you found and what you changed. Our own piece on AI bias in recruiting and a per-job audit plan walks through a simple routine.
Transparency toward candidates
Candidates have a right to know when AI plays a role in a decision about them and to ask for human review. The EU’s employment services network says in its guide for jobseekers that the Act treats AI in employment decisions as high-risk, and that people should understand the role AI plays in their application. Agencies that explain this plainly are better placed to meet the disclosure requirements than those that hide it.
A candidate notice should say, in plain language:
that an automated system helps screen, score or match applications;
what the system looks at, for example skills, experience and project requirements;
that a recruiter reviews the result and makes the decision;
how to ask for human review or raise a concern, and whom to contact.
Put this in your application forms, your career page and your privacy notice. If you build a branded career site, make the notice part of the template rather than an afterthought.
How the AI Act fits with GDPR
The AI Act does not replace data protection law. Legal commentators such as Eversheds Sutherland recommend treating it as an extension of your existing GDPR program rather than a separate technical hurdle. Both regimes ask similar questions: what data do you hold, on what legal basis, who can see it, how long do you keep it, and can you show it?
That overlap helps. If you already maintain consent records, retention schedules and access logs for candidate data, you have a base for AI Act logging and documentation. If you keep candidates in spreadsheets, inboxes and personal folders, you have a bigger gap to close, since neither regime can be satisfied when you cannot find out where a candidate’s data sits.
Fines and enforcement
Penalties are tiered. The staffing-sector resource cited above states that non-compliance with high-risk obligations can reach 15 million EUR or 3% of global annual turnover, whichever is higher. Prohibited practices attract higher ceilings. Beyond fines, the more immediate commercial risk is that EU clients will ask for proof of compliance in procurement questionnaires, and agencies that cannot answer will lose placements.
A practical preparation plan for 2026 to 2027
You do not need to rebuild your stack. You need to know what you use and be able to show how you use it. A sensible order of work:
Inventory every AI feature in your hiring workflow. Include parsers, matching engines, scoring, ad targeting, chatbots and sourcing extensions, and note which ones touch EU candidates.
Classify each tool. Ask the vendor to confirm in writing whether it considers the feature high-risk, and what its intended-use statement says.
Confirm your role. Document why you are a deployer, and flag any customization that could amount to a substantial modification.
Train your people. Cover what each score means, known limits, bias risks and override procedure. Keep attendance and materials on file.
Define human oversight. Name who reviews AI output, what they check and how overrides are recorded.
Switch on logging and set retention. Keep logs at least six months, and align longer periods with your GDPR schedule.
Prepare candidate notices and a route for requesting human review.
Draft the FRIA where required, and schedule recurring bias checks.
Update client contracts. EU clients will want to know what AI you use on their searches.
If you want a deeper look at the scoring step specifically, our guide to AI candidate scoring and how to use it responsibly covers what a score should and should not be used for.
Our perspective: AI that supports recruiters, not replaces them
We build recruitment software for IT agencies and headhunters, so we read the AI Act as people who have to translate it into product decisions. Three views shape how we think about it.
First, the law and good recruiting point the same way. A match score is useful when it narrows a long list into a shortlist a recruiter then evaluates with context the algorithm cannot see: motivation, client culture, a candidate’s reason for moving. The Act’s insistence on meaningful human oversight describes how experienced recruiters already want to work. We explore this in our article on AI scoring without losing the human touch.
Second, compliance is mostly a data-hygiene problem. Logs, consent records and an audit trail only work when candidate data lives in one system. That is why Recruitify brings the ATS, the CRM and the contracting module into one environment, with GDPR consent management and a full audit trail built into the architecture. Having these records in one place does not make an agency compliant by itself, because the deployer’s own duties remain: oversight, training, notices and assessments. But it removes the hardest obstacle, which is not knowing where the evidence is.
Third, explainability beats opacity. We design scoring so that a recruiter sees a percentage match against stated project requirements and can judge the reasoning, rather than receiving an unexplained verdict. Anything that cannot be explained to a candidate on request is a liability under the Act.
- Recruitify Team
Where Recruitify fits
If you are consolidating scattered tools while you prepare for the Act, our platform combines candidate database and ATS, CRM, AI matching and scoring, CV parsing and Blind CV generation in a single workspace, with GDPR consent handling and an audit trail. You can review the AI recruitment features first, then see plans on the pricing page: the HR Team plan is €69 per month per user, the Recruitment Agencies plan is €79 per month per user, and Enterprise pricing is available on request through the same page.
FAQ
Does the EU AI Act apply to the USA?
It applies to US companies when the output of their AI system is used in the EU, or when the system affects people in the EU. A US agency that screens EU candidates or fills roles for EU clients with AI tools is in scope. A purely domestic US hiring process generally is not, though US state and local rules may apply.
Is all AI in HR high-risk under the Act?
No, but the core recruitment uses are. Annex III lists systems for recruitment and selection, application filtering, candidate evaluation and decisions on work terms, promotion, termination, task allocation and performance monitoring. Administrative tools such as calendar scheduling are less likely to be covered. Have the vendor and your counsel confirm the classification of each feature.
Did the EU AI Act pass, and when do the hiring rules start?
Yes. The Act entered into force in August 2024. After the Digital Omnibus, now Regulation (EU) 2026/1744, the high-risk rules for employment systems apply from 2 December 2027. The ban on workplace emotion recognition and the AI literacy duty already apply.
Can we still use AI scoring and CV parsing for EU candidates?
Yes, with conditions. You need human oversight by trained staff, logging, candidate information, and a FRIA where required, and no final decision should rest on the AI alone. Tools that explain their output and keep an audit trail make those conditions much easier to meet.
Who is responsible: the software vendor or the agency?
Both, for different things. The vendor, as provider, handles documentation, risk management and conformity assessment. The agency, as deployer, handles oversight, training, logs, notices and use within the vendor’s instructions. Substantially modifying a system can shift provider duties onto you.
Sources
Annex III: High-Risk AI Systems, EU Artificial Intelligence Act
EU AI Act: High-risk AI systems in employment, Eversheds Sutherland
The EU AI Act Deal: Digital Omnibus Now in Force, Usercentrics
Recommended
3.4M Applicants Show AI Recruiting Bias: HR Per Job Audit Plan
How Artificial Intelligence is Transforming Recruitment in 2025: Hype vs. Reality
News & Updates
Stay up-to-date with the latest innovations, features, and tips about Recruitify!
By providing your email address within the newsletter sign-up form, you confirm its processing to send marketing information regarding the Administrator’s products and services. The Administrator of your personal data processed for the abovementioned purposes is Recruitify Spółka z o.o., based in Warsaw, Poland (KRS 0000709889). For more information on the principles of personal data processing and the rights of data subjects, please check the Privacy Policy.
Discover More
Recruitment Process
Rate Card Staffing: How to Build, Price and Manage One
A practical guide to staffing rate cards: how bill rates are built from pay rates, which methodology to use, how to review rates, and how to manage them.
25 Oct 2026
Discover More
Innovations
Application Conversion Rate: Formula, Benchmarks, Fixes
Application conversion rate explained for recruiters: the formula, stage-by-stage math, real benchmarks, and the fixes that move the number. Includes app-store rates.
24 Oct 2026
Discover More
Recruitment Process
GDPR-Compliant Analytics for Recruitment Teams
What makes analytics GDPR compliant, from cookies to candidate data: a practical framework for recruitment agencies and HR teams, including US firms hiring in the EU.
23 Oct 2026
Discover More
Recruitment Process
Rate Card Staffing: How to Build, Price and Manage One
A practical guide to staffing rate cards: how bill rates are built from pay rates, which methodology to use, how to review rates, and how to manage them.
25 Oct 2026
Discover More
Innovations
Application Conversion Rate: Formula, Benchmarks, Fixes
Application conversion rate explained for recruiters: the formula, stage-by-stage math, real benchmarks, and the fixes that move the number. Includes app-store rates.
24 Oct 2026
Discover More
