The EU AI Act and assessments in recruitment

Why recruitment counts as high-risk

The AI Act, Regulation (EU) 2024/1689, sorts AI systems by risk. Annex III, point 4, lists employment as a high-risk area. It covers AI systems intended to:

• place targeted job advertisements
• analyse and filter applications
• evaluate candidates
• make or support decisions on promotion, termination and task allocation, and monitor or evaluate workers

These decisions shape people's livelihoods, and a system that judges people badly does so at scale. An Annex III system that profiles people, for example by evaluating personality or abilities to predict performance at work, is always treated as high-risk.

One practice is banned outright

Since 2 February 2025, AI systems that infer people's emotions in the workplace from biometric data, such as facial expressions or voice, are prohibited except for medical or safety reasons (Article 5(1)(f)). The European Commission's non-binding guidelines on prohibited practices treat candidates in a selection procedure as part of the workplace context. Be very cautious with video interview tools that claim to read enthusiasm, stress or honesty from a face or a voice.

Is your assessment an AI system?

The high-risk rules only apply to an AI system as defined in Article 3(1): a machine-based system that operates with some autonomy and infers from its input how to generate outputs such as predictions, recommendations or decisions. That is a functional test, not a label. A vendor calling a product AI does not settle it, and neither does a vendor avoiding the word. For assessments, the difference often lies in how the score is produced:

• A questionnaire scored with a fixed key and compared with a norm group, following rules written by people, may fall outside the definition.
• Scoring, ranking or matching by a model that has learned from data, for example one that predicts job success from answers, video or CVs, can fall inside it.
• One platform can contain both: a classically scored personality questionnaire next to a machine-learning matching feature.

Where the line falls for a particular tool is not settled for every case. Ask the vendor how they classify each part of their product and why, and keep the answer on file. Where it stays unclear, apply the high-risk safeguards anyway: most of them are simply good assessment practice.

What the vendor must do, and what you must do

The Act distinguishes the provider, who develops a system and places it on the market, from the deployer, who uses it under its own authority. With recruitment assessments, the vendor is usually the provider and you as employer are the deployer.

The provider

• risk management across the lifecycle
• data governance, including examining training data for possible bias
• technical documentation, automatic logging and instructions for use
• a design that allows effective human oversight
• appropriate accuracy, robustness and cybersecurity
• a conformity assessment and registration in the EU database

For recruitment systems the conformity assessment is an internal procedure by the provider, without an external body. A tool advertised as AI Act certified therefore deserves a follow-up question.

You as employer

Article 26 sets out the deployer's duties. In practice:

• Use the system in line with the provider's instructions.
• Assign human oversight to people with the competence, training and authority to do it.
• Where you control the input data, make sure it is relevant and sufficiently representative.
• Monitor the system, report problems to the provider, and suspend use if you identify a risk.
• Keep the logs under your control for at least six months, unless other law requires otherwise.
• Inform workers' representatives and the workers concerned before putting a high-risk system into use at the workplace.
• Inform candidates that a high-risk system is used when it makes or helps to make decisions about them.

Under Article 86, a person affected by a decision based on such a system's output can, in certain cases, ask for a clear explanation of the system's role and the main elements of the decision. And if you substantially modify a system or use it for a high-risk purpose the provider did not intend, you can become a provider yourself (Article 25).

The GDPR applies alongside. Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects, unless an exception applies and safeguards are in place.

The timeline

• 1 August 2024: the AI Act entered into force.
• 2 February 2025: the prohibitions apply, including the ban on emotion recognition in the workplace.
• The text as adopted in 2024 set 2 August 2026 for the high-risk obligations of Annex III systems.
• The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in July 2026, moved that date: the high-risk obligations for Annex III systems, recruitment included, now apply from 2 December 2027.

The postponement gives more time but does not change what is required. Vendor contracts and procedures you set up now will often still be running in 2027, so build the requirements in from the start. The GDPR and national employment law, including any rights of works councils, apply already.

A practical checklist for employers

Questions to ask a vendor

• Which parts of your product do you consider an AI system under the AI Act, and why?
• If a part is high-risk, can we see the instructions for use, and when will the conformity assessment and registration be in place?
• What evidence of reliability and validity is there for our use, and is it documented, for example in a technical manual?
• How do you examine bias, and what are the limits of those analyses?
• Is candidate data used to train models, and on which legal basis?

Human oversight and information

• Train the people who review results to interpret scores, including score ranges and norm groups, and watch for automation bias: following a system because it looks objective.
• Give them the authority to depart from a ranking, and record why they did. Never let a score or cut-off reject a candidate without a person looking at it.
• Tell candidates which assessments they take, what for, who sees the results and how long they are kept, and prepare how you will answer a request for an explanation.

Documentation and monitoring

• Record per vacancy which assessments were used, how scores were weighed and who decided.
• Look regularly at outcomes in your own procedure, such as selection rates per group where you may lawfully collect that data. See fairness and bias for what such analyses can and cannot show.

What this means for how Match.hr is built

We treat recruitment as the high-risk use the Act describes and build for its requirements now. A person always decides: the platform never rejects candidates automatically, and the report supports a structured decision alongside interviews and references, as described in how it works. Every score is shown with its score range and norm group, so a reviewer can explain what it means. There is documentation per test version and there are audit logs; more under security and privacy. None of this makes an employer compliant on its own, and you can put the vendor questions above to us as to anyone else.