EU AI ACT — GUIDE
EU AI Act for recruitment AI — Annex III point 4 obligations apply from 2 December 2027 under Regulation (EU) 2026/1744 (in force 27 July 2026)
AI that screens CVs, ranks applicants, targets job advertisements or assists shortlisting decisions is high-risk under EU AI Act Annex III point 4(a). Regulation (EU) 2026/1744 — the Digital Omnibus — was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It defers the entire standalone Annex III high-risk regime, provider and deployer obligations alike, to 2 December 2027; recruitment AI is covered because it sits inside Annex III, not because employment systems were singled out. Article 4 AI literacy has applied since 2 February 2025 and Article 50 transparency since 2 August 2026 — neither was deferred. When the Annex III obligations do bite, the HR team using the tool — not just the vendor — carries deployer obligations under Article 26.
Why recruitment AI is high-risk
Annex III point 4 of Regulation (EU) 2024/1689 lists employment, workers management and access to self-employment as high-risk use areas. Point 4(a) covers AI systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Point 4(b) covers AI used to make or materially influence decisions on promotion, termination, task allocation, and performance monitoring.
Article 6(3) allows a narrow exception when an Annex III system does not pose a significant risk of harm to fundamental rights and does not materially influence decision-making. Profiling of natural persons is always high-risk and cannot use the exception. CV screening and candidate ranking almost never qualify because they directly influence the hiring outcome.
Article 26 deployer obligations
- Art 26(1) — Use the system in accordance with the provider’s instructions for use.
- Art 26(2) — Assign human oversight to natural persons with the necessary competence, training and authority.
- Art 26(4) — Ensure input data is relevant and sufficiently representative for the intended purpose, to the extent the deployer exercises control over input data.
- Art 26(5) — Monitor operation on the basis of the instructions for use and inform the provider of serious incidents.
- Art 26(6) — Keep logs automatically generated by the system for an appropriate period, in any case at least six months.
- Art 26(7) — Inform workers’ representatives and the affected workers before putting a high-risk AI system into service or use in the workplace.
- Art 26(11) — Inform natural persons subject to a decision taken or assisted by a high-risk system that they are subject to it.
Article 14 human oversight in practice
The deployer must be able to override, disregard or reverse a recommendation produced by the AI system. A “rubber-stamp” review where the recruiter merely confirms the AI ranking does not satisfy Article 14. Document who exercises oversight, how reviewers are trained, and which decision points are reversible.
Article 27 fundamental rights impact assessment
Public bodies and private operators providing services in areas listed in Annex III, including most employment use cases involving workers under public authority, must complete a fundamental rights impact assessment (FRIA) before first deployment. Private employers should still perform an equivalent assessment as evidence of due diligence and as input to the GDPR Article 35 DPIA that is almost always required for automated candidate evaluation.
Article 4 AI literacy (already in force)
Since 2 February 2025, deployers must ensure a sufficient level of AI literacy for staff dealing with the operation and use of AI systems, taking into account their technical knowledge, experience, education and the context in which the AI systems are used. Maintain a register of training delivered to recruiters, hiring managers and HR business partners.
Article 50 transparency toward candidates
From 2 August 2026, deployers must inform candidates that they are interacting with an AI system unless this is obvious from the context. AI-generated content used in candidate communications (offer drafts, screening summaries, synthetic interview avatars) is subject to the marking and disclosure rules in Article 50(2) and 50(4). See the Article 50 transparency guide for the full breakdown.
Evidence checklist
- AI inventory entry per recruitment system with vendor, version, purpose and risk class.
- Copy of the provider’s instructions for use and CE-mark documentation.
- Human-oversight SOP naming roles, escalation paths and decision-reversal mechanism.
- Worker and candidate information notices (Art 26(7), Art 26(11), Art 50).
- Log-retention policy committing to at least 6 months (Art 26(6)).
- AI literacy training log per Art 4.
- FRIA (Art 27) or equivalent fundamental-rights assessment, plus GDPR Art 35 DPIA.
Related EU guides
- Deployer vs provider under the EU AI Act
- AI inventory requirements
- Fines under the EU AI Act (Article 99)
- NIS2 for HR systems
Sources
- Regulation (EU) 2024/1689, Annex III point 4 and Articles 4, 14, 26, 27, 50, 99 — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
Note: The EU AI Act applies in phases. Regulation (EU) 2026/1744 (the Digital Omnibus), in force 27 July 2026, defers the standalone Annex III high-risk regime — employment and recruitment systems included — to 2 December 2027; verify the current consolidated text on EUR-Lex before locking a compliance plan to any specific date. PowerQuant supplies software and documentation for use in your internal compliance process — not legal advice.
PowerQuant Module 1
AI inventory, Article 4 literacy register and Annex III classification — for HR-tech vendors answering customer AI due-diligence questionnaires and HR teams building internal compliance evidence. You review and approve every answer before it goes to a customer or auditor. Delivered in 5 working days. Fixed fee, no monthly subscription.
Price: EUR 1,499 — fixed fee, no subscription.
Start Module 1