Updated 15 October 2026 with the new timeline. If you read here that the high-risk rules for recruitment applied from 2 August 2026, that date no longer stands.
If you use AI to filter CVs, score candidates or assess interviews in the European Union, the AI Act (Regulation (EU) 2024/1689) already applies to you in three ways: some practices have been banned since February 2025, you have a duty to promote AI literacy in your team, and since August 2026 people have to know when they are talking to an AI. The high-risk obligations, which are the heavy part for hiring, apply from 2 December 2027. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI and published in the Official Journal on 24 July 2026, delayed them.
Below: which uses of AI in hiring are high-risk, what falls on your company and what on your vendor, and what to have in place before December 2027. This is not legal advice; we cite the articles so you can check them.
When does the AI Act apply to hiring? From 2 December 2027
The high-risk obligations for AI used to screen, score or evaluate candidates apply from 2 December 2027, the date Regulation (EU) 2026/1744 wrote into Article 113 of the AI Act in place of 2 August 2026. Other parts of the Act apply earlier:
| From | What | Where |
|---|---|---|
| 2 February 2025 | Prohibited practices, including inferring emotions in the workplace | Article 5 |
| 2 February 2025, new wording since 27 July 2026 | AI literacy: take measures to promote it among the people who use AI systems | Article 4 |
| 2 August 2026 | Transparency: people must be told they are interacting with an AI, unless it is obvious | Article 50 |
| 2 December 2027 | Requirements and obligations for Annex III high-risk systems, employment included | Chapter III, sections 1 to 3 |
The delay only moves the last row. What was banned is still banned, and the GDPR has not changed: if you make decisions about candidates with AI today, data protection law already applies (more on that below).
Regulation 2026/1744 gives its own reason for the delay in recital 40: harmonised standards, common specifications and guidance were late, and not every national competent authority was in place. Nobody can promise today that all of that will be ready by December 2027. The date that counts is the one published in the Official Journal.
Which uses of AI in hiring are high-risk
Annex III, point 4(a), lists as high-risk the AI systems intended for the recruitment or selection of people, "in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates". Point 4(b) adds systems that make decisions on working conditions, promotion, termination, allocating tasks based on individual behaviour or personal traits, or monitoring and evaluating performance.
There is a way out in Article 6(3): an Annex III system is not high-risk if it does not materially influence the decision and meets one of the paragraph's four conditions, such as performing only a narrow procedural task or a preparatory task. The same paragraph closes that door in one case: a system that profiles people is always high-risk. In hiring, ranking or scoring candidates against a role is profiling, under the GDPR definition that Article 3(52) refers to.
| Use in a hiring process | Where it lands |
|---|---|
| Filtering applications automatically | High-risk (Annex III, 4(a)) |
| Scoring or ranking candidates by fit for the role | High-risk. It profiles people, so the Article 6(3) exception does not apply |
| Showing a job ad only to specific profiles | High-risk: the Annex names "targeted job advertisements" |
| Assessing answers from a recorded interview | High-risk |
| Inferring emotions from a candidate's voice or face | Banned since 2 February 2025 (Article 5(1)(f)) |
| A chatbot that answers candidates' questions | Article 50 transparency. If it also filters or assesses, high-risk |
| Drafting a job ad, scheduling interviews, summarising a CV for a person to read | Can fall outside under Article 6(3) if it does not profile or influence the decision. Write down why |
| Deciding promotions, allocating tasks based on individual behaviour or personal traits, or measuring staff performance | High-risk (Annex III, 4(b)) |
For the unclear cases, the useful question is whether the system influences who moves forward. If a recruiter only ever sees the candidates the tool let through, it does.
Provider or deployer: who does what
The AI Act splits the work between whoever builds the system (the provider) and whoever uses it in their organisation (the deployer). A company using AI hiring software is a deployer. So is an agency that uses it to run searches for its clients.
The provider has to have, from 2 December 2027 for Annex III: a quality management system, technical documentation, automatic logging, human oversight built into the design, a conformity assessment and an EU declaration of conformity before the system goes on the market (Article 16).
From 2 December 2027, the deployer has to (Article 26):
- Use the system according to its instructions for use.
- Assign human oversight to people with the necessary competence, training and authority, who can reject what the tool recommends.
- Make sure the input data it controls is relevant and sufficiently representative for the system's purpose.
- Monitor how the system works, tell the provider about risks and suspend use when needed.
- Keep the logs the system generates, to the extent they are under its control, for at least six months.
- Inform the people the system makes or helps make decisions about, that is, the candidates (Article 26(11)).
- If it uses the system on its own staff, inform workers' representatives and the affected workers first (Article 26(7)).
When a company or agency becomes a provider
Article 25 turns into a provider anyone who puts their name or trademark on a high-risk system, substantially modifies one, or changes the intended purpose of a system that was not high-risk, general-purpose AI included, so that it becomes high-risk (Article 25(1)(c)). Pasting the CVs for a role into a general-purpose chatbot and asking it to rank them can fit that last case, with every provider obligation attached.
The GDPR already applies today
The AI Act delay does not touch the General Data Protection Regulation. Three points apply right now to any use of AI with candidates:
- Automated decisions (GDPR Article 22). A candidate has the right not to be subject to a decision based solely on automated processing that significantly affects them. Rejecting applications that no person ever looks at is exactly that.
- Impact assessment (GDPR Article 35). Systematic and extensive evaluation of candidates through automated processing, when decisions that significantly affect them depend on it, requires a data protection impact assessment before you start.
- Information. Candidates have to know what data you process, on what legal basis and for how long you keep it.
We go into more detail in our guide to the GDPR and the LOPDGDD in recruiting.
What to do now and what to do before December 2027
Now:
- List where you use AI in hiring: job ads, screening, scoring, interviews, chatbots, candidate messaging.
- Classify each use with the table above: banned, high-risk, transparency only or outside, and write down why for the ones you treat as outside.
- Switch off any feature that infers candidates' emotions.
- If a chatbot talks to candidates, check that it says it is an AI.
- Check which rejections happen without real human involvement, whether by AI or by automatic rules. GDPR Article 22 only allows them in specific cases (contractual necessity, law or explicit consent) and with safeguards, such as the right to have a person review the decision.
- Train the people who use the tools: what each one does, what it does not do and when to overrule it. That is the most direct way to meet Article 4.
- If you use a general-purpose chatbot to rank or assess candidates, plan to stop: from December 2027 Article 25 can make you the provider of a high-risk system, and the GDPR already applies today, including Article 22 if no person reviews the output.
Before 2 December 2027:
- Ask each vendor for their instructions for use and, once they have it, the EU declaration of conformity.
- Name the people who oversee each system and give them the authority to overrule it.
- Turn on logging and keep the logs for at least six months.
- Prepare the candidate notice required by Article 26(11).
- Decide who gets told and how use is suspended if the system fails.
What to ask your hiring software vendor
- Which features of your product do you consider high-risk under Annex III, which not, and why?
- Will you have the conformity assessment and the EU declaration of conformity before 2 December 2027?
- What logs does the system keep, for how long, and how do I export them?
- How can someone on my team see why the system recommends a candidate and overrule it?
- What data was the model trained on and how have you measured its bias?
- Where is my candidates' data processed, and is it used to train models?
If you work with Mainder, ask your contact the same questions. On our platform the AI recommends and a person decides, and every interaction with the AI is logged. The details are on our security and compliance page.
Sources
- Regulation (EU) 2024/1689, the Artificial Intelligence Act: Articles 4, 5, 6, 16, 25, 26 and 50 and Annex III.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI: new Article 4 and new dates in Article 113.
- Regulation (EU) 2016/679, the GDPR: Articles 22 and 35.
