AI in HR and Recruitment

The legal framework

Employment is one of the areas the AI Act treats most strictly, because AI decisions can shape a person's livelihood. Two rules matter.

Prohibited: emotion recognition at work

Article 5(1)(f) of Regulation (EU) 2024/1689 prohibits AI systems that infer the emotions of a person in the workplace or in education, except for medical or safety reasons. The ban has applied since 2 February 2025. A video interview tool that scores a candidate's facial expressions or tone to infer mood or enthusiasm falls under it.

High-risk: Annex III, point 4

Annex III lists as high-risk the AI systems intended to be used for:

• recruitment or selection of persons, in particular to place targeted job advertisements, to analyse and filter applications and to evaluate candidates;
• decisions affecting the terms of work-related relationships, promotion or termination;
• allocating tasks based on individual behaviour or personal traits; and
• monitoring and evaluating the performance and behaviour of persons in such relationships.

Under Article 6(3), a system in that list is not high-risk if it does not pose a significant risk to health, safety or fundamental rights, for example because it only performs a narrow procedural or preparatory task. The provider must document that assessment, and a system that profiles natural persons is always high-risk. Do not assume the exception applies to a tool that ranks people.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the application date for Annex III high-risk systems from 2 August 2026 to 2 December 2027. The prohibitions and the AI literacy duty already apply. Check the timeline before acting on any date.

Employer duties as deployer

An employer using a high-risk HR system is a deployer. Article 26 requires it to:

• use the system in accordance with the instructions for use;
• assign human oversight to people with competence, training and authority;
• ensure that input data under its control is relevant and representative;
• monitor the system and keep the automatically generated logs for at least six months;
• inform workers' representatives and the affected workers before putting the system into use at work; and
• inform persons subject to decisions that the system is used (Article 26(11)).

A person affected by a decision based on a high-risk system's output that has legal or similarly significant effects has a right to a clear explanation of the system's role (Article 86). An employer that substantially modifies a system, or puts its own name on it, may become a provider (Article 25).

National labour law and the GDPR

The AI Act does not replace labour law, and member states may keep or introduce rules that are more favourable to workers. Information and consultation duties towards works councils and rules on monitoring employees differ per country. Check the national rules, including collective agreements, where you employ people. The GDPR runs in parallel: a lawful basis for processing candidates' data, transparency, a DPIA for systematic evaluation (Article 35), and the ban on decisions based solely on automated processing with significant effects (Article 22). The Court of Justice held in SCHUFA (C-634/21) that even producing a score on which a third party strongly relies can amount to an automated decision. The fundamental rights impact assessment of Article 27 applies to public bodies, private bodies providing public services and some credit and insurance uses, not to private employers in general. A DPIA, however, is often needed. See the AI Act and the GDPR.

In practice

A retailer buys a recruitment platform that ranks applicants against the job profile and suggests who to invite. Because it ranks and filters candidates, it is high-risk. The retailer asks the vendor for the instructions for use and confirmation of the provider's own obligations, appoints two recruiters to review every rejection recommendation, tells candidates in the job posting that AI supports screening, informs the works council, and carries out a DPIA. It stops using an add-on that scores video interviews for enthusiasm, because that infers emotions.

Frequently asked questions

Is a CV parser always high-risk?

Not necessarily, but if it filters or ranks candidates it is within Annex III. A tool that only extracts text into fields may fall under the Article 6(3) exception, with documented reasoning.

Does the AI Act apply to small employers?

Yes. There is no size threshold for the high-risk rules.

Can we let the tool decide automatically who is rejected?

This is risky under both the GDPR (Article 22) and the AI Act's human oversight rule. Keep a person with real authority in the loop.

Who is liable if the vendor's system is biased?

Both can be. The provider must design and test for bias, and the employer must use the system correctly and oversee it. Contract terms allocate recourse between them.

How this connects

Our AI Act compliance service covers HR tools alongside the rest of your AI estate. Our AI Act register classifies each system and records obligations by role, and our DPIA tool supports the impact assessment that recruitment tools usually need. See also building an AI governance framework.