Recruitment & HR · AI Act

Recruitment & HR — AI Act: governing AI in employment

The AI Act classifies AI used to recruit, select, and manage workers as high-risk. Employers, recruitment firms, and HR software vendors must qualify these use cases and, above all, manage the risk of discrimination. This guide details the qualification process, high-risk obligations, and the allocation of roles.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • The HR tool vendor is the provider; the employer or firm using it is the deployer.
  • Qualify the systems.
  • Control biases.
  • Ensuring human oversight.
  • Up to €35M or 7% for prohibited practices and €15M or 3% for high risk, in addition to GDPR and employment tribunal exposure.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

Annex III of the AI Act targets AI intended for recruitment and selection (targeted dissemination of job offers, filtering and evaluation of applications) and workforce management (decisions on promotion, termination, task allocation, and assessment of performance and behaviour). These systems are subject to the obligations applicable to high-risk AI.

The purpose — deciding on access to employment and its progression — justifies this classification.

Is the 'Recruitment & HR' sector concerned?

The HR tool vendor is the provider; the employer or firm using it is the deployer. Each carries its own obligations.

Purely administrative uses with no decision-making impact on individuals fall under lighter regulatory regimes.

Detailed obligations

Qualify the systems

Isolate tools making recruitment or career decisions (high risk).

Control biases

Audit training data and outputs to prevent discrimination.

Ensuring human oversight

Ensuring an effective human decision, not merely a formal opinion.

Inform

Informing candidates and employees about the use of AI.

Document (supplier)

Compiling the technical documentation and conformity assessment.

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high risk, on top of GDPR and employment law exposure. Algorithmic discrimination gives rise to individual and collective legal actions.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2High risk. From 2 August 2026 for HR AI.

Common mistakes in the sector

  • 1High risk denied. Treating an automated CV screening tool as a neutral tool.
  • 2Untested biases. Not audit results by profile.
  • 3Superficial oversight. Mechanically validating AI-generated proposals.
  • 4Missing information. Not informing candidates.

Practical case

A firm uses a candidate scoring tool. As a high-risk system, it requires a bias audit (selection rates by profile), genuine human oversight of decisions, and candidate notification, with the vendor providing the compliance documentation.

Compliance roadmap

  1. 1

    Inventory. Inventorying AI-powered HR tools.

  2. 2

    Qualify. Isolate high risk.

  3. 3

    Auditing biases. Monitor data and outcomes.

  4. 4

    Frame. Supervision and information.

  5. 5

    Document. Documentation and assessment (supplier).

Frequently asked questions

Yes: filtering and evaluating applications are high-risk use cases.

Back to the Recruitment & HR guideRecruitment & HR & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to recruitment & hr.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the recruitment & hr sector secured their compliance with DCO.

See testimonials