Recruitment & HR compliance: AI Act (high risk) & GDPR

Why the 'Recruitment & HR' sector is affected

AI has become widespread in HR: CV screening, candidate scoring, automated interview analysis, and performance assessment and management tools. The AI Act classifies these uses as high-risk, as they determine access to employment and career progression — issues with significant implications for individuals' rights.

The central risk is discrimination: an algorithm trained on biased data can reproduce — or even amplify — discrimination in hiring or career progression. Bias management and human oversight are therefore at the heart of the compliance obligations.

In parallel, the GDPR governs the processing of candidate data (including the retention of unsuccessful applications) and employee data, with particular vigilance regarding sensitive data, monitoring, and profiling.

AI Act — high-risk HR AI

The AI Act classifies as high-risk any AI intended for recruitment and selection (targeted distribution of job offers, screening and evaluation of applications) as well as workforce management (promotion or termination decisions, task allocation, performance evaluation). The obligations are substantial: risk management, data quality, bias control, human oversight, transparency, and documentation.

The employer is the deployer; the HR tool publisher is the provider.

Key obligations

• Qualify HR tools with AI (high risk).
• Bias control and data quality.
• Human oversight of decisions.
• Informing candidates and employees.
• Documentation and compliance assessment (supplier).

GDPR — candidates and employees

The employer and the recruitment firm are both data controllers in respect of candidate and employee data. Key areas of vigilance: the legal basis, retention periods for unsuccessful applications, data minimisation (no irrelevant sensitive data), and the governance of monitoring and profiling.

Key obligations

• Legal basis and information for candidates and employees.
• Retention period for applications regulated.
• Data minimisation (avoiding irrelevant sensitive data).
• Framework for HR monitoring and profiling.

Comparative overview of regulations

How these regulations interact

HR is the textbook case of GDPR / AI Act overlap. A CV screening tool combines personal data processing (GDPR: legal basis, information obligations, retention periods) and a high-risk system (AI Act: bias control, human oversight, documentation). Non-discrimination is the requirement that runs through both regulations.

The allocation of roles is critical: the HR solution vendor (provider) bears responsibility for system compliance, while the employer (deployer) bears responsibility for its use — including information, effective human oversight, and the rejection of fully automated decisions with significant effects absent adequate safeguards.

Application timeline

• 1GDPR. In force; vigilance on retention and monitoring.
• 2AI Act. High risk: Main obligations from 2 August 2026 for HR AI.

Applicable penalties

The cumulative exposure is significant: the AI Act up to €35M or 7%, GDPR up to €20M or 4%. Added to this are employment tribunal risk and discrimination risk, which can give rise to both individual and collective claims.

A biased recruitment algorithm thus combines an AI Act breach, a GDPR violation, and discrimination — a three-headed legal risk.

Compliance roadmap

• 1Inventorying AI-powered HR tools. Inventory CV screening, scoring, analysed interviews, and performance evaluation, and qualify high-risk use cases.
• 2Control biases. Audit data and tool outputs to prevent discrimination.
• 3Ensuring human oversight. Ensure effective human oversight, with no full automation producing a significant effect.
• 4Securing GDPR processing activities. Legal basis, information, retention periods, minimisation.
• 5Distribute the roles. Clarify supplier (publisher) and deployer (employer).

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports employers, firms and HR software publishers on the GDPR / AI Act interplay and bias management.

DCO offers tailored templates (HR register, candidate information notice, AI Act documentation for recruitment tools).

Frequently asked questions