AI in Hiring: EU AI Act Compliance for Recruitment AI

Artificial intelligence has transformed recruitment. From CV screening algorithms that filter thousands of applications in seconds to video interview analysis tools that evaluate candidates' communication patterns, AI is now embedded throughout the hiring pipeline. For employers, these tools promise efficiency and consistency. For job seekers, they can mean the difference between getting an interview and being silently rejected by an algorithm they never knew existed.

The EU AI Act (Regulation 2024/1689) takes a firm position on this: AI systems used in recruitment and hiring are classified as high-risk under Annex III, point 4(a). This classification triggers the full set of obligations under Articles 8 through 15, imposing substantive requirements on both providers who build these tools and deployers who use them.

Why Recruitment AI Is High-Risk

The rationale for classifying recruitment AI as high-risk is straightforward: hiring decisions directly and significantly affect people's livelihoods. A biased or opaque AI system that screens out qualified candidates based on irrelevant or discriminatory criteria can cause real harm — denying individuals access to employment, reinforcing systemic inequalities, and doing so at scale.

The regulation specifically covers AI systems intended to be used for:

• Recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates
• Decisions affecting terms of work-related relationships — promotion, termination, task allocation based on individual behaviour or personal traits
• Monitoring and evaluation of the performance and behaviour of persons in work-related relationships

This is a broad scope. It captures not just the obvious CV-screening tools but also AI systems used for workforce analytics, performance monitoring, and even algorithmic scheduling that affects workers' conditions.

Which Recruitment AI Systems Are Affected

Understanding exactly which tools fall under this classification is critical for compliance planning.

CV Screening and Applicant Tracking Systems

Any AI system that automatically filters, ranks, or scores job applications based on CV content, keywords, experience patterns, or other candidate data is high-risk. This includes:

• Automated resume parsers that extract and evaluate qualifications
• Ranking algorithms within applicant tracking systems (ATS)
• AI-powered matching tools that compare candidate profiles against job requirements
• Systems that predict candidate suitability or "fit" based on historical hiring data

Video Interview Analysis

Tools that analyse video interviews using AI to assess candidates are squarely within scope. These systems may evaluate:

• Facial expressions and micro-expressions
• Voice tone, pace, and word choice
• Body language and eye contact patterns
• Linguistic complexity and communication style

These tools raise particular concerns about bias and scientific validity. The EU AI Act's requirements for accuracy documentation and bias testing are especially relevant here.

Automated Decision-Making in Hiring

Any AI system that makes or materially influences hiring decisions — whether to advance a candidate to the next stage, extend an offer, or reject an application — is covered. This includes systems that:

• Automatically shortlist or reject candidates without human review
• Generate hiring recommendations that are routinely followed
• Score or rank candidates in ways that determine interview invitations

Workforce Management AI

Beyond recruitment, AI systems used for ongoing employment decisions are also high-risk. This includes tools for:

• Performance evaluation and scoring
• Promotion or termination recommendations
• Task allocation based on algorithmic assessment of worker capabilities
• Employee monitoring systems that feed into management decisions

Compliance Requirements for Recruitment AI

As high-risk AI systems, recruitment tools must meet all requirements under Articles 8 through 15 of the AI Act. Here is what this means in practice for HR technology.

Risk Management System (Article 9)

Providers of recruitment AI must establish and maintain a risk management system throughout the AI system's lifecycle. For hiring tools, this means:

• Identifying risks of bias against protected characteristics (gender, age, ethnicity, disability, religion)
• Assessing the risk of qualified candidates being incorrectly filtered out
• Testing the system against known bias scenarios
• Implementing mitigation measures and documenting residual risks

The risk management system must be a living document, updated as new risks are identified or as the system is modified.

Data Governance (Article 10)

Training data for recruitment AI deserves exceptional scrutiny. Historical hiring data frequently reflects past discrimination — if a company historically hired predominantly from one demographic group, an AI trained on that data will learn to favour similar candidates.

Requirements include:

• Documenting the provenance, composition, and characteristics of training datasets
• Assessing training data for biases related to protected characteristics
• Ensuring datasets are sufficiently representative of the candidate population the system will evaluate
• Implementing data quality controls for accuracy, completeness, and relevance

Technical Documentation (Article 11)

Providers must prepare comprehensive technical documentation before placing a recruitment AI system on the market. This documentation must include:

• A general description of the system, its intended purpose, and its intended users
• Detailed information about the development process, including design choices and training methodology
• Information about training, validation, and testing data — including how bias was assessed and addressed
• Performance metrics, including accuracy rates across different demographic groups
• Known limitations and conditions under which the system may not perform as intended

Logging and Traceability (Article 12)

Recruitment AI systems must include automatic logging capabilities that record:

• Each use of the system and its duration
• The input data processed (such as CV data or interview recordings)
• The outputs generated (scores, rankings, recommendations, decisions)
• The identity of persons exercising human oversight

These logs must be retained for a period appropriate to the system's purpose and accessible to deployers and, upon request, to market surveillance authorities.

Transparency and Instructions (Article 13)

Providers must supply deployers with clear instructions covering:

• The system's intended purpose and the types of decisions it is designed to support
• The level of accuracy the system achieves, including any variation across demographic groups
• Known biases and limitations
• Human oversight measures and how to exercise them
• What input data the system expects and how data quality affects outputs

Human Oversight (Article 14)

This is perhaps the most consequential requirement for recruitment AI. The system must be designed to allow effective human oversight, meaning a human must be able to:

• Understand the system's capabilities and limitations
• Correctly interpret the system's outputs
• Decide not to use the system's output or to override it
• Intervene in or halt the system's operation

In practical terms, this means that fully automated hiring decisions — where an AI rejects candidates without any human review — are extremely difficult to justify under the AI Act. Human oversight must be genuine, not a rubber stamp.

Accuracy, Robustness, and Cybersecurity (Article 15)

Recruitment AI must achieve appropriate levels of accuracy, and that accuracy must be declared and tested. The system must be robust against errors and attempts at manipulation — for instance, it should handle unusual CV formats gracefully rather than penalising candidates who do not use standard templates.

Cybersecurity measures must protect against unauthorized access to candidate data and manipulation of the system's inputs or outputs.

Obligations for Deployers (Employers)

Organisations that use recruitment AI — the deployers — have their own set of obligations under Article 26, independent of the provider's obligations.

Use According to Instructions

Deployers must use recruitment AI systems in accordance with the provider's instructions for use. This means reading and following the documentation, not repurposing a tool designed for one context in a different one.

Human Oversight Assignment

Deployers must assign human oversight to individuals who have the necessary competence, training, and authority. In an HR context, this means the people reviewing AI recommendations must:

• Understand how the AI system works and what its limitations are
• Have the authority to override the system's recommendations
• Have sufficient time and resources to conduct meaningful review (not be under pressure to simply accept the AI's output)

Input Data Relevance

Deployers must ensure that the input data they provide to the system is relevant and sufficiently representative. If a recruitment AI was trained on data from one industry or region, deploying it in a very different context may produce unreliable results.

Monitoring and Incident Reporting

Deployers must monitor the AI system's operation based on the provider's instructions and report any serious incidents or malfunctions. If the AI system begins producing systematically biased outcomes, the deployer must act.

Fundamental Rights Impact Assessment

Public bodies and private entities providing public services must conduct a fundamental rights impact assessment (Article 27) before deploying a high-risk recruitment AI system. Even where this is not legally required, conducting such an assessment is good practice.

Interaction with Existing Employment Law

The EU AI Act does not exist in a vacuum. Recruitment AI must also comply with:

• GDPR — automated decision-making provisions under Article 22 already require safeguards for decisions based solely on automated processing that produce legal effects or similarly significant effects. Data protection impact assessments (DPIAs) are likely required.
• Employment Equality Directives — EU anti-discrimination law prohibits discrimination in employment on grounds of gender, race, ethnic origin, religion, disability, age, and sexual orientation. An AI system that produces discriminatory outcomes violates these directives regardless of AI Act compliance.
• National employment law — many EU member states have additional protections, including works council consultation requirements for introducing new workplace technologies.

Practical Steps for HR Teams

Audit your current AI tools. Identify every AI-powered system used in your recruitment and workforce management processes. Include third-party tools embedded in your ATS or HRIS platforms.

Engage your vendors. Ask your recruitment technology providers about their AI Act compliance roadmap. Request technical documentation, bias testing results, and information about human oversight mechanisms. If they cannot provide this information, consider alternative providers.

Establish human oversight processes. Design workflows that ensure genuine human review of AI-generated hiring recommendations. Define clear escalation paths for cases where the AI's output seems questionable.

Train your HR team. The AI literacy obligation under Article 4 is already in force. HR professionals using AI recruitment tools must understand how those tools work, what their limitations are, and when to override them.

Document everything. Keep records of your AI system inventory, risk assessments, human oversight procedures, and any incidents or concerns. This documentation is your evidence of compliance.

Monitor for bias. Regularly analyse your recruitment outcomes across demographic groups. If your AI tools are producing disparate impact, investigate and address the root cause — regardless of whether a regulatory inquiry prompts you to.

Timeline for Recruitment AI Compliance

Conclusion

AI in recruitment offers genuine benefits — faster processing, broader candidate reach, and potentially more consistent evaluation. But the EU AI Act recognises that these benefits must be balanced against the risks to individuals whose livelihoods depend on fair and transparent hiring processes.

For HR leaders and technology teams, the message is clear: recruitment AI is high-risk, and high-risk systems require serious compliance work. The organizations that start now — auditing their tools, engaging their vendors, and building genuine human oversight into their hiring workflows — will be well-positioned when full enforcement begins in August 2026. Those that wait may find themselves scrambling to comply or, worse, facing enforcement action for systems that should have been brought into compliance months earlier.