EU AI Act in HR
The EU AI Act regulates AI systems according to their use and risk. Certain recruitment and employment applications fall within its high-risk category, with separate responsibilities for the organisations providing and using them.
Which hiring uses fall within the Act
Annex III, point 4 includes AI intended for recruitment or selection, such as analysing and filtering applications or evaluating candidates. It also covers specified decisions and monitoring within employment. This classification concerns the intended use of a system, rather than an entire HR software category.
Article 6 provides limited conditions under which an Annex III system may not be high-risk, including certain procedural or preparatory tasks that do not pose a significant risk. Those conditions require assessment; adding a human approval button is not an exemption. An Annex III system that profiles people remains high-risk under that provision.
A vendor’s obligations do not replace the employer’s
The Act distinguishes the provider, which develops or places a system on the market under its name, from the deployer, which uses it under its authority. An employer using another company’s system will often be a deployer, but changing a system’s purpose or making a substantial modification can change that position.
For relevant high-risk uses, Article 26 addresses following instructions, assigning competent people with authority to oversee the system, monitoring its operation and informing affected people. Employers should establish what their actual workflow requires and who is responsible for it. Buying software does not transfer every obligation to its supplier.
The employment-system timetable changed in 2026
The AI Omnibus entered into force on 27 July 2026. Under the amended timetable, the main high-risk rules for Annex III systems apply from 2 December 2027. This replaces the earlier August 2026 date for those rules.
Other provisions follow different dates. Existing General Data Protection Regulation (GDPR) requirements, employment law and anti-discrimination duties continue to matter before the high-risk deadline. The extension is not permission to defer all safeguards.
Start by identifying the actual feature, its intended purpose and its influence on a hiring decision. Obtain the provider’s classification and relevant documentation, then assess your own use. A general statement that an ATS is “AI Act compliant” is insufficient to resolve those questions.