EU AI Act Recruitment AI – What HR Teams Must Do Before December 2027

Key takeaways

• Under Annex III point 4 of the EU AI Act, AI intended to place targeted job ads, filter applications or evaluate candidates is high-risk – permitted, but regulated – unless the narrow Article 6(3) derogation applies, and an Annex III system that profiles people is always high-risk.
• After the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), high-risk rules for newly placed or put-into-service stand-alone Annex III systems, including recruitment tools, apply from 2 December 2027 (European Commission); systems already in service before that date need an Article 111 assessment.
• Some rules already apply as of October 2026: the ban on inferring emotions in the workplace since 2 February 2025, and Article 50 transparency duties, such as making clear to candidates that they are talking to an AI, since 2 August 2026.
• An employer or agency that commissions a custom screening tool and puts it into service under its own name is likely the provider of that system, not its development partner.
• Deployers of high-risk systems must assign competent human oversight, keep automatically generated logs under their control for at least six months, and inform workers' representatives before using such a system at the workplace (Article 26).

When EU AI Act recruitment AI counts as high-risk

Annex III of the AI Act (Regulation (EU) 2024/1689) lists high-risk use cases. Point 4 covers employment and workers' management, in two parts:

• Recruitment and selection – AI intended to recruit or select people, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
• Decisions in work relationships – AI intended to make decisions affecting terms of work, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour.

In practice, that catches CV ranking, scoring of recorded video interviews, chatbot knock-out questions that decide who moves forward, and ad tools that choose who sees a vacancy.

The Article 6(3) derogation is narrow. Under Article 6, an Annex III system is not high-risk only if it poses no significant risk of harm to health, safety or fundamental rights – including by not materially influencing the outcome of decision-making – and at least one listed condition applies, such as performing a narrow procedural task or a preparatory task.

There is a hard limit: an Annex III system that performs profiling of natural persons is always high-risk. Ranking or scoring candidates on their attributes will usually be profiling. A provider relying on Article 6(3) must document its assessment before market placement or putting the system into service, and register the system in the EU database under Article 49(2); the Omnibus simplified that registration but did not remove it.

What already applies, and what the AI Omnibus moved to 2027

The AI Act applies in stages. The AI Omnibus (Regulation (EU) 2026/1744) moved the high-risk dates but left other rules running:

• 1 August 2024 – the AI Act entered into force.
• 2 February 2025 – prohibited practices apply. Article 5 bans AI that infers people's emotions in the workplace, except for medical or safety reasons. Emotion recognition is defined by reference to biometric data (Recital 18), so a tool that infers emotions from candidates' faces or voices needs an Article 5 assessment; text sentiment analysis is not automatically caught.
• 2 August 2025 – obligations for providers of general-purpose AI models apply.
• 27 July 2026 – the AI Omnibus entered into force. It also changed the AI-literacy rule in Article 4: providers and deployers must take measures to support their staff's AI literacy, but need not guarantee a particular level for any individual.
• 2 August 2026 – Article 50 transparency duties apply. A candidate-facing chatbot should make clear that people are interacting with an AI, unless that is obvious. The only grace period, to 2 December 2026, covers machine-readable marking of AI-generated content for certain systems placed on the market before 2 August 2026.
• 2 December 2027 – high-risk duties for stand-alone Annex III systems, including recruitment and HR, apply (Article 113).
• 2 August 2028 – high-risk duties for AI embedded in products covered by Annex I apply.

Systems already in use. Under Article 111, high-risk systems placed on the market or put into service before the high-risk date are generally caught only if their design changes significantly afterwards (public-authority systems have their own deadline). Get advice before relying on this.

Provider or deployer – your role decides your duties

Roles follow from facts, not from what a contract calls you. Under Article 3, a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free. A deployer uses an AI system under its authority in a professional context.

Note the third row: a custom build should produce the documentation and controls you, as likely provider, will need – agreed in scope.

Provider duties, in summary (Chapter III of the AI Act): risk management; data governance, including checking training and test data for possible bias; technical documentation; automatic logging; instructions for use; design for human oversight; accuracy, robustness and cybersecurity; a quality management system; for a stand-alone Annex III point 4 system, an internal-control conformity assessment without a notified body (Article 43); a declaration of conformity and CE marking; EU database registration; and post-market monitoring.

AI Act HR compliance – what deployers must do

Most employers and agencies will be deployers of tools they buy. Article 26 sets out their duties. In plain language:

1. Use the system as the provider instructs.
2. Assign human oversight to people with the competence, training and authority to do it. A recruiter who cannot overrule the tool is not oversight.
3. Make sure input data is relevant and sufficiently representative for the intended purpose, to the extent you control it.
4. Monitor the system and, if you have reason to think it presents a risk, inform the provider and the market surveillance authority and suspend use. Serious incidents must be reported.
5. Keep the logs it generates, to the extent they are under your control, for at least six months, unless other EU or national law – data protection law in particular – provides otherwise.
6. Inform workers' representatives and affected workers before use – this applies to employers using a high-risk system at the workplace.
7. Inform candidates and other people about whom the Annex III system makes or assists decisions that they are subject to its use.

Under Article 86, a person subject to a decision based on such a system's output, with legal or similarly significant effects they consider adverse, can ask the deployer for a clear explanation of the AI's role and the main elements of the decision, within the Article's limits. The fundamental rights impact assessment in Article 27 does not generally apply to private employers using recruitment AI, but public bodies and private entities providing public services should check.

Where GDPR fits in. The GDPR applies today. Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects – an automatic rejection can fall within it. Check whether your screening needs a data protection impact assessment (DPIA) under Article 35 before live use; our GDPR compliant AI outsourcing checklist covers DPIAs and processor agreements.

A roadmap to 2 December 2027 – and how to pilot responsibly now

Procurement, informing workers' representatives and vendor changes can take longer than the technical fixes.

You can pilot recruitment AI before December 2027 with the requirements designed in:

• A human makes every decision, with the authority to override.
• Documented criteria that are job-related, free of proxies for age, gender or origin, and shown with each result.
• Logging designed in: inputs, outputs, model version and the human decision, with retention agreed with your DPO. The model version matters: when a provider updates a model, results can shift, and without it in the log you cannot explain why.
• Clear notices: candidates are told AI is used and how to reach a person.
• Real data only after the checks: anonymised or synthetic data first, live applicants once any required DPIA is done.

NKKTech Global, an AI engineering company based in Hanoi, Vietnam, builds pilots on those terms: our AI Pilot for recruitment takes one use case to a working pilot on your real data in 3–4 weeks for a fixed fee of USD 5,000–15,000 as of October 2026 (indicatively EUR 4,500–13,500 or DKK 34,000–101,000 at our reference rate), the code is yours, and a full build follows only if it proves its value. See pricing.

Two published case studies show the patterns; neither client is European, and neither case study establishes EU AI Act compliance:

• Recruitment. For AWING Technologies, a technology company in Hanoi, Vietnam, we built a chatbot for CV screening, interview scheduling and candidate FAQs on the website, Messenger and Zalo. The published case study reports an 80% reduction in response time, 65% more candidate engagement, 30% less manual HR workload and 45% higher pre-screening completion. In an EU deployment, a stand-alone FAQ or scheduling function may fall outside Annex III point 4 altogether, while candidate screening or scoring is more likely to be high-risk.
• Compliance documents. For a US healthcare startup, we built AI compliance-document automation in 12 weeks. The published case study reports 90% less manual review time, a three-week backlog cleared in two weeks and more than 600 hours saved per month. It is relevant if you plan to use AI to help prepare the documentation the Act requires, but it was built under US rules.

Related reading: AI recruitment software in Australia – what to build first · AI development in Denmark – offshore options, costs and GDPR · GDPR-compliant AI outsourcing checklist

Frequently asked questions

Is it illegal to use AI to screen CVs under the EU AI Act? No. AI intended to filter applications or evaluate candidates is generally high-risk under Annex III (subject to the Article 6(3) test and its profiling override), not prohibited. High-risk duties apply from 2 December 2027, chatbot transparency has applied since 2 August 2026 and the GDPR applies now; the ban bites where a tool infers candidates' emotions from biometric data in a workplace setting.

When do the AI Act high-risk rules for AI hiring tools apply after the AI Omnibus? From 2 December 2027 for stand-alone Annex III systems, which include recruitment and HR tools. Systems already in use before then are generally caught only if their design changes significantly afterwards, so check with counsel before relying on that.

If we buy an AI recruitment tool from a vendor, are we still responsible? Yes, as a deployer: follow the instructions for use, assign competent human oversight, keep the automatically generated logs under your control for at least six months unless other law provides otherwise, monitor the system and give the worker and candidate notices Article 26 requires. If you rebrand, substantially modify or commission a tool under your own name, you may be the provider.