EU AI Act Compliance for Automated Hiring Decisions

Annex III of the EU AI Act classifies recruitment, candidate selection and employment-decision AI as high-risk because errors and bias can harm fundamental rights. CV screening, interview scoring and assessment tools fall within those functions. To comply with the rules on automated hiring decisions, employers therefore need to stop unlawful practices now and have a system that is documented and supervised by people. The dividing line is decision influence.

Who is actually bound: providers, deployers, and the extraterritorial reach

The Act divides responsibility between providers that build and market AI systems and deployers that use them. Most employers occupy the second role, but a vendor contract does not discharge their own obligations. The scope also extends beyond EU-established organisations. It covers providers placing AI on the EU market, EU-established deployers and organisations outside the EU where system outputs are used in the EU. A US or UK company screening candidates for roles in Berlin or Dublin is therefore in scope, and Brexit does not exempt UK employers hiring into or from the EU.

An employer’s role can change through customisation. Substantially modifying a high-risk system or putting its own name on it can make an employer a provider, with the corresponding obligations. Heavy customisation or fine-tuning on internal hiring data can trigger that change. Staffing agencies submitting AI-scored candidates to EU clients have deployer obligations even when the vendor and end client are elsewhere. The Digital Omnibus provisional agreement extended certain documentation relief from SMEs to small mid-caps, but substantive safety obligations remain across organisation sizes.

What is already illegal as of February 2025

Workplace emotion recognition, biometric categorisation that infers protected traits, certain social scoring and harmful manipulation became prohibited on 2 February 2025. The ban on emotion recognition also applies to job interviews, except in narrow medical or safety cases. Biometric categorisation includes inference of race, political views or sexual orientation. For recruiting, the ban on social scoring covers scores that public authorities give people based on their social behaviour or personal characteristics and that lead to harmful treatment in unrelated settings. Harmful manipulation requires behaviour distortion that causes or is reasonably likely to cause significant harm.

Video interview features marketed as “engagement scoring,” “sentiment analysis,” or “personality trait inference” can conceal prohibited inference from facial expressions or voice tone. The Dutch Data Protection Authority’s summer 2025 report described emotion recognition as resting on “disputed assumptions” and linked it to discrimination risk. For employers, the immediate action is to disable prohibited features used in EU hiring, including those pitched as reading tone, facial cues or traits. Continued use is a present breach, subject to the Act’s more severe penalty regime for prohibited practices, so preparation for 2027 must include ending it now.

Why GDPR Article 22 binds automated hiring decisions independently of the AI Act

GDPR Article 22 gives candidates the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. An application rejection that no human reviews falls directly within that concern. The AI Act does not replace this protection. Its high-risk implementation timetable therefore offers no basis for postponing review of fully automated rejection workflows.

The European Data Protection Board and the European Data Protection Supervisor co-hosted a conference in July 2026 examining automated candidate screening and Article 22. That attention covers both tools already in use and those to be deployed in the future. Any workflow in which an AI screener rejects applications without qualified human review before candidates are notified requires immediate redesign. Organisations should also expect to carry out Data Protection Impact Assessments and to receive requests from candidates under GDPR for access to or explanations of the automated logic.

This creates a direct starting point for oversight design. Human involvement required for current rejection decisions can underpin the architecture the AI Act will require by 2027. Later compliance, however, cannot retroactively cure GDPR violations committed during the intervening period.

The Digital Omnibus moved the high-risk deadline to 2 December 2027 — what actually changed and what did not

The Digital Omnibus amending regulation entered into force in late July 2026 and moved the operative deadline for stand-alone high-risk employment AI to 2 December 2027. The earlier August 2026 date no longer applies. High-risk AI embedded in regulated products follows a later date of 2 August 2028, a distinction less relevant to typical recruiting stacks. The European Commission’s stated rationale was that harmonised standards and conformity-assessment tools were not uniformly available across member states.

Employment AI is still high-risk under Annex III, which covers screening, ranking, automated interview scoring and assessment outputs. Risk management, data governance, human oversight and deployer accountability remain intact, as do transparency and notice obligations. Employers still have to meet their Article 26 duties even when vendors comply, while the Omnibus gave the AI Office stronger powers to make governance less fragmented.

A grandfather clause creates a separate contracting risk. Systems placed on the EU market before 2 December 2027 become subject to the high-risk requirements only if substantially modified after that date. EDRi, Access Now, AlgorithmWatch, Amnesty International and ECNL warned that providers could rush systems to market to use that exemption. Employers should therefore audit contracts now to establish which product version they license and how the vendor plans to update it.

The full set of high-risk obligations that must be in place by 2 December 2027

Article 9 requires a written record of how risks of bias, fairness and discrimination are managed. Article 10 connects that work to data governance, addressing training data that encodes historical discrimination or proxy variables. These controls also help with bias monitoring after the system has been developed. Technical documentation must make the system and its controls assessable.

Article 12 requires automatic decision logging, with retention for at least six months. Article 13 requires sufficient operational transparency and instructions covering provider identity, intended purpose, capabilities, limitations, human oversight measures and logging information. Those instructions anchor the employer’s duty to use the system appropriately. Article 14 requires human oversight built into the design so that hiring decisions cannot be fully automated.

Provider assurance extends beyond the model itself. A quality management system, conformity assessment and EU declaration of conformity must precede market placement, with CE marking as the output. High-risk hiring systems must be registered in the EU database, and certain public-sector deployers must also register how they use them. Providers must keep up their post-market monitoring and incident reporting.

Article 26 gives employers a distinct operational role. Deployers must follow instructions and assign oversight to people with the competence, training and authority to intervene, including rejecting recommendations when warranted. Input data under their control must be relevant and sufficiently representative for the intended purpose. They must monitor performance, report risks to providers, suspend use when needed and retain controlled logs for at least six months. A Fundamental Rights Impact Assessment is required where applicable.

Transparency also reaches the people affected by deployment. Candidates must be informed when high-risk AI was used in a decision affecting them and be able to obtain a meaningful explanation. Workers and their representatives require separate notice before deployment in the employment context. Penalties for non-compliance with Articles 9–17 use a fixed maximum amount or a percentage of global annual turnover, whichever is higher. Calling a tool general-purpose does not automatically exempt it, and using a chatbot to rank CVs can itself bring the duties that apply to a provider.

The gap between where most employers are now and where they need to be

Recruitment-stack audits, vendor negotiations and hiring-team training can take a year or more. Starting this work in earnest in 2026 therefore leaves little spare time before December 2027. For employers that act as deployers, much depends on whether vendors can show how they will get CE marking, register in the EU database and carry out post-market monitoring. Many vendors are not yet at that point. Employers still need provider assurance even if they change their own processes.

Contract auditing is consequently more than a procurement exercise. A vendor that freezes its product to avoid the substantial-modification threshold may leave an employer tied to a version outside the updated compliance framework for years. Employers need to establish both the licensed version and the update policy. The audit must also cover ATS-native scoring, sourcing tools and assessment products built into wider HR platforms, alongside well-known AI vendors.

The diagnostic boundary is what each feature does. Systems that rank, score, filter or recommend candidates influence decisions, including sourcing algorithms and job-ad targeting that determine who enters the hiring funnel. An ATS that only stores applications and sends templated emails does not cross that line. The same classification logic extends into promotion, termination, task allocation and worker monitoring. Written assessments, including reasons for excluding a tool from high-risk scope, provide the basis for sequencing remediation.

A phased compliance roadmap from now to December 2027

Employers should turn off prohibited emotion-recognition, biometric trait-inference and social-scoring features, then audit every system that plays a part in hiring decisions and record how it is classified. Automated rejection workflows require concurrent review under GDPR Article 22, with immediate redesign where human review is absent. General-purpose AI used for ranking or filtering also needs assessment for provider-level obligations. Worker and representative notification duties must be established before high-risk deployment, alongside candidate notice.

Through 2026 into mid-2027, the inventory should drive vendor due diligence and oversight redesign. Employers should seek credible CE marking pathways, registration plans and post-market monitoring capability, replacing or renegotiating contracts where vendors cannot demonstrate a compliance roadmap. Contract review should address grandfather-clause exposure through product-version and update terms. Oversight must become an assigned operational responsibility. Personnel need the competence, training and authority to reject AI recommendations, with their role and intervention process documented.

Data and transparency work should develop with that oversight. Employers should check training and input data for historical discrimination and proxy variables, and carry out Fundamental Rights Impact Assessments where the rules require them. Candidate and worker notices should become part of hiring workflows, with a pathway for meaningful explanations. HR teams and hiring managers must also receive the AI literacy training required by Article 4. This duty already applies to providers and deployers, so the phase is an implementation window.

In the final months before 2 December 2027, employers should request provider conformity-assessment documentation and EU declarations of conformity directly from vendors. They should verify EU database registration and establish that logging operates with retention of at least six months. An end-to-end review should establish that oversight personnel can and do intervene before decisions are communicated to candidates.

How enforcement is already moving and what early cases signal

The European Commission says that the AI Office and national authorities gained powers on 2 August 2026 to enforce the provisions that apply, including those on general-purpose AI, prohibited practices and transparency rules. Full high-risk implementation is therefore not the start of regulatory scrutiny. The Board and Supervisor’s July conference also shows that data-protection authorities are looking at screening tools already in use. Employers face overlapping legal routes to scrutiny before December 2027.

Early cases show two linked failures: biased training data and a lack of meaningful human oversight. Historical hiring data can encode proxy variables for protected characteristics, making discriminatory outcomes and adequate bias testing central questions. A system’s recommendations cannot become defensible simply through routine human approval. The oversight process must permit a qualified person to reject them.

The available window is therefore an opportunity to build evidence. Vendor audits, oversight redesign and bias monitoring create a documented record of good-faith effort before high-risk enforcement intensifies. Employers that defer this work risk reaching the deadline with years of hiring outcomes but no record of monitoring or correction. Immediate compliance and longer-term preparation serve different legal deadlines, but both depend on an audit trail that can withstand a challenge to a hiring decision.