The AI Act in HR and recruitment — what applies, and to whom
Employment is one of the eight areas the AI Act singles out. If you screen candidates, rank applications, allocate tasks or evaluate performance with AI, you are in the part of the regulation that carries the real obligations — whether you built the tool or bought it.
First hour’s on us. No commitment.
What you get
- A classification of every tool in your hiring and workforce stack — including the AI features inside platforms you did not buy as AI
- Clarity on whether you are the provider or the deployer, which decides how much of the regulation lands on you
- The deployer documentation — human oversight, monitoring, log retention, information to workers and candidates
- Vendor contract language that puts the provider obligations where they belong
- A GDPR layer that fits, since candidate data and Article 22 apply at the same time
How it works
- Intake, 45 minutes. What tools you use across hiring and workforce management. Free.
- Assessment, one to three weeks. Classification, role determination, gap analysis.
- The plan. Prioritised, with the documents you need drafted or specified.
Who you’ll work with
Fidan Ibrahimzada, Legal Counsel for AI and technology law, leads this work. She advises companies on AI regulation, data protection and technology contracts, and previously led the legal department of a commercial law firm. She holds an LL.M. in European Business Law from Lund University. Lawgent is Sweden’s first law firm dedicated to AI and EU regulation — meet the team.
What Annex III actually covers in employment
The AI Act lists employment, workers management and access to self-employment as a high-risk area. In practice it reaches four things:
- Recruitment and selection — placing targeted job advertisements, analysing and filtering applications, and evaluating candidates
- Decisions affecting terms of work — promotion and termination
- Task allocation based on individual behaviour or personal traits
- Monitoring and evaluation of performance and behaviour
That is broader than most HR teams assume. A CV parser that ranks candidates is in. A scheduling tool that allocates shifts based on measured performance is in. A tool that only formats CVs into a consistent template is not.
The exemption, and why “the human decides” is not enough
Article 6(3) allows a system in an Annex III area to fall outside high-risk where it does not materially influence the outcome — for instance where it performs a narrow procedural task, or is preparatory to a human assessment.
Two things make this harder than it looks in HR. First, there is a hard limit: a system that profiles individuals is always high-risk, with no exemption available. Much of what recruitment technology does is profiling. Second, the claim has to be true of how the workflow actually runs. If the recruiter looks at the top ten of a ranked list and never the rest, the system materially influenced the outcome regardless of what the policy says.
If you do rely on the exemption, the assessment must be documented before the system is put into use, and the system registered.
Are you the provider or the deployer?
Most employers are deployers: they buy the tool and use it. The duties are real but manageable — use the system as instructed, assign human oversight to people with the competence and authority to override it, make sure input data is relevant to the purpose, monitor operation, and keep the logs.
Two duties are specific to the workplace. Before putting a high-risk AI system into use, deployers who are employers must inform workers’ representatives and the affected workers. And where the system makes or assists decisions about individuals, those individuals have a right to an explanation of the role the system played.
HR technology vendors are providers, and carry the heavier set: risk management, data governance, technical documentation, logging, human oversight design, accuracy and cybersecurity, conformity assessment and CE marking.
The trap is in between. An employer who puts its own brand on a white-labelled screening tool, or substantially modifies one, becomes a provider — with all of it.
The GDPR runs alongside, not instead
Candidate and employee data is personal data, so the GDPR applies in full. Three points bite hardest in HR:
Legal basis. Consent rarely works in an employment context — the imbalance of power undermines it. Legitimate interests or contract are the usual routes, and each needs a documented assessment.
Article 22. A hiring rejection produced solely by automated processing is a decision with significant effect. The human in the loop needs authority and competence to reach a different conclusion, and evidence that this happens.
Transparency. Candidates need meaningful information about the logic involved — specific enough that someone could contest the outcome.
The AI Act and the GDPR ask for overlapping evidence here. Build it once.
Frequently asked questions
We use an applicant tracking system with AI features we did not choose. Are we in scope?
Very possibly. What matters is what the feature does, not whether you selected it. Start by asking the vendor for a written statement of which features use AI and how they are classified.
Our vendor says the tool is not high-risk. Is that enough?
It is a starting point, not an answer. You carry the deployer obligations regardless, and if the vendor’s classification is wrong you are the one using an unregistered high-risk system. Get the reasoning, not just the conclusion.
When do the obligations apply?
High-risk obligations under Annex III apply from December 2027. But the prohibitions and the AI literacy requirement have applied since February 2025, and the contracts you sign now will still be running in 2027.
Do we have to tell candidates?
Yes, in more than one way — GDPR transparency, AI Act transparency where the candidate interacts with the system, and the right to an explanation of the system’s role in a decision.
What about the works council?
Deployers who are employers must inform workers’ representatives and affected workers before putting a high-risk system into use. Swedish co-determination obligations may apply in addition.
Where to start
With a list of what is actually in your stack. Most HR teams find one or two systems that matter and several that do not — and the value is in knowing which is which.