EU AI Act for recruitment AI — what HR deployers must do before 2 August 2026

Why recruitment AI is high-risk

Annex III point 4 of Regulation (EU) 2024/1689 lists employment, workers management and access to self-employment as high-risk use areas. Point 4(a) covers AI systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Point 4(b) covers AI used to make or materially influence decisions on promotion, termination, task allocation, and performance monitoring.

Article 6(3) allows a narrow exception when an Annex III system does not pose a significant risk of harm to fundamental rights and does not materially influence decision-making. Profiling of natural persons is always high-risk and cannot use the exception. CV screening and candidate ranking almost never qualify because they directly influence the hiring outcome.

Article 26 deployer obligations

• Art 26(1) — Use the system in accordance with the provider’s instructions for use.
• Art 26(2) — Assign human oversight to natural persons with the necessary competence, training and authority.
• Art 26(4) — Ensure input data is relevant and sufficiently representative for the intended purpose, to the extent the deployer exercises control over input data.
• Art 26(5) — Monitor operation on the basis of the instructions for use and inform the provider of serious incidents.
• Art 26(6) — Keep logs automatically generated by the system for an appropriate period, in any case at least six months.
• Art 26(7) — Inform workers’ representatives and the affected workers before putting a high-risk AI system into service or use in the workplace.
• Art 26(11) — Inform natural persons subject to a decision taken or assisted by a high-risk system that they are subject to it.

Article 14 human oversight in practice

The deployer must be able to override, disregard or reverse a recommendation produced by the AI system. A “rubber-stamp” review where the recruiter merely confirms the AI ranking does not satisfy Article 14. Document who exercises oversight, how reviewers are trained, and which decision points are reversible.

Article 27 fundamental rights impact assessment

Public bodies and private operators providing services in areas listed in Annex III, including most employment use cases involving workers under public authority, must complete a fundamental rights impact assessment (FRIA) before first deployment. Private employers should still perform an equivalent assessment as evidence of due diligence and as input to the GDPR Article 35 DPIA that is almost always required for automated candidate evaluation.

Article 4 AI literacy (already in force)

Since 2 February 2025, deployers must ensure a sufficient level of AI literacy for staff dealing with the operation and use of AI systems, taking into account their technical knowledge, experience, education and the context in which the AI systems are used. Maintain a register of training delivered to recruiters, hiring managers and HR business partners.

Article 50 transparency toward candidates

From 2 August 2026, deployers must inform candidates that they are interacting with an AI system unless this is obvious from the context. AI-generated content used in candidate communications (offer drafts, screening summaries, synthetic interview avatars) is subject to the marking and disclosure rules in Article 50(2) and 50(4). See the Article 50 transparency guide for the full breakdown.

Evidence checklist

• AI inventory entry per recruitment system with vendor, version, purpose and risk class.
• Copy of the provider’s instructions for use and CE-mark documentation.
• Human-oversight SOP naming roles, escalation paths and decision-reversal mechanism.
• Worker and candidate information notices (Art 26(7), Art 26(11), Art 50).
• Log-retention policy committing to at least 6 months (Art 26(6)).
• AI literacy training log per Art 4.
• FRIA (Art 27) or equivalent fundamental-rights assessment, plus GDPR Art 35 DPIA.

Related EU guides

• Deployer vs provider under the EU AI Act
• AI inventory requirements
• Fines under the EU AI Act (Article 99)
• NIS2 for HR systems

Sources

• Regulation (EU) 2024/1689, Annex III point 4 and Articles 4, 14, 26, 27, 50, 99 — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj