EU AI Act for HR and recruitment
HR is the domain where the derogation argument most often fails and where a second body of law, national labour law and works council rights, can block a deployment the AI Act would permit. It is also the only Annex III point that names advertising as a covered activity.
What is in scope, and what is not
| Detail | |
|---|---|
| Recruitment and selection — point 4(a) | CV parsing, screening, ranking, video interview scoring, candidate evaluation, and the placing of targeted job advertisements, which is named explicitly |
| Worker management — point 4(b) | Decisions affecting terms of the relationship, promotion or termination; task allocation based on behaviour or personal traits; monitoring and evaluating performance and behaviour |
| Not point 4 | Payroll processing, benefits administration, rostering with no behavioural or trait-based allocation, learning content delivery with no evaluation |
Expert analysis. Classification turns on the intended purpose of each system. This is our reading of common deployments, not an authoritative classification.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
The derogation almost never survives the profiling override
The standard vendor position — “we only rank, a recruiter decides” — runs into two walls.
First, point 4(a) names analyse and filter applications and evaluate candidates as the covered activities. Doing them is the trigger; who signs the outcome is not the test.
Second, and decisively: Article 6(3) says an Annex III system is always high-risk where it performs profiling of natural persons. Evaluating a candidate’s suitability from their data is profiling under GDPR Article 4(4). For most recruitment AI the derogation is not merely weak: it is unavailable.
Where it may survive: pure CV parsing into structured fields with no scoring, ranking or filtering. The moment an output influences who a recruiter sees, the threshold gate on materially influencing decision-making closes too. The derogation →
Labour law does not defer to the AI Act
- Article 26(7). Deployers who are employers must inform workers’ representatives and the affected workers before putting a high-risk system into service at the workplace. Before, not after.
- Works council co-determination. In several member states, notably Germany, workplace monitoring and evaluation systems trigger co-determination rights that operate independently of the AI Act and can stop a deployment outright.
- GDPR Article 22. Decisions on recruitment or termination based solely on automated processing engage Article 22 in parallel.
- Equality law. A discriminatory outcome breaches Union equality law directly, and under Article 3(49), infringement of Union law protecting fundamental rights is itself a reportable serious incident under Article 73.
What applies before December 2027
Article 50 applies now if candidates interact with a chatbot or receive AI-generated communications. Article 4 AI literacy applies to your recruiters as deployers, and has since February 2025.
The deferral in Regulation (EU) 2026/1744 covers Chapter III Sections 1 to 3. It does not cover Article 5, Article 4, Chapter V general-purpose AI, Article 49 registration or Article 50 transparency. Full timeline →
Status labels on this page
Verified fact: The Annex III points, article references and dates cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The in-scope/out-of-scope allocation, the sector edge case, and the parallel-regulation reading.
Unsettled: Harmonised standards remain in development and the Commission's Annex III guidelines are in draft. Sector supervisory practice has not yet formed.
Ask your ATS vendor four questions
Who is the provider. What is the registered intended purpose. Which logs do they retain and for how long. Whether their contract restricts you from modifying the intended purpose, because doing so makes you the provider under Article 25.
Classify before you build
Twelve questions mapping your system against Articles 5, 6, 50 and Annex III. No email required.
Frequently asked
Is AI recruitment software high-risk under the EU AI Act?
Generally yes. Annex III point 4(a) covers AI systems intended to be used for recruitment or selection, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. The Article 6(3) derogation is usually unavailable because evaluating candidates constitutes profiling of natural persons, which triggers the absolute override in Article 6(3).
Do employers have to tell staff about AI systems?
Yes. Article 26(7) requires deployers who are employers, before putting a high-risk AI system into service or using it at the workplace, to inform workers' representatives and the affected workers that they will be subject to its use. In several member states this sits alongside works council co-determination rights that apply independently of the AI Act.
When do HR AI obligations apply?
Annex III point 4 obligations apply from 2 December 2027 following Regulation (EU) 2026/1744. Article 50 transparency and Article 4 AI literacy are not deferred and apply now, so a recruitment chatbot owes disclosure today regardless of the 2027 date.