EU AI Act Compliance for HR, Recruitment and Workforce AI

The Four Workflows Most at Risk

Four deployment patterns account for the vast majority of HR AI risk exposure:

1. Automated CV screening and ranking. Candidates have Article 86 rights to explanation. Training data from historical hires typically encodes historical discrimination. Article 10 data governance is the non-trivial obligation.
2. Video-interview analysis. If the system infers emotional state, confidence, enthusiasm, deception, it is prohibited under Article 5(1)(f) in workplace contexts. The workplace carve-out has been interpreted broadly in pre-enforcement guidance.
3. Productivity and engagement monitoring. High-risk under Point 4(d). If it passively surveils without individual evaluation impact, scope is contested, but employees and works councils can trigger Article 26(7) information duties.
4. Compensation and promotion algorithms. Point 4(b). Typically integrated with performance-management systems. Explainability is the binding constraint.

What to Tell Works Councils, and When

Article 26(7) requires deployers to inform workers and their representatives before a high-risk AI system is put into service. In Germany, the Betriebsverfassungsgesetz section 87(1) Nr. 6 already gives works councils co-determination rights over technical surveillance, the AI Act duty reinforces and extends this. In France, the CSE must be consulted under the Labour Code. Dutch OR, Italian RSU, Spanish comité de empresa, similar regimes across Member States.

The practical consequence: Article 26(7) information is not a one-off notification. It interlocks with national works-council consultation timelines, which typically run 30 to 90 days. Plan deployment calendars accordingly.

Platform Workers Directive Interaction

Digital labour platforms (ride-hail, delivery, domestic services, gig-economy work platforms) are subject to Directive (EU) 2024/2831. Transposition deadline is 2 December 2026. Key overlaps with the AI Act:

• Article 9 of the Platform Workers Directive requires human oversight of significant decisions, analogous to AI Act Article 14.
• Article 10 of the Directive requires explanation of automated decisions to platform workers, overlaps with AI Act Articles 26(11) and 86.
• The Directive introduces specific limitations on processing of biometric, emotional, and health data, reinforcing the AI Act Article 5 prohibitions.

Compliance programmes that treat the two regimes separately tend to produce inconsistent audit trails. A unified governance framework, one risk register, one control library, two regulatory reporting lines, is the emerging practice.