The EU AI Act and AI hiring tools: what changes on 2 December 2027

This article is not legal advice.

Why is AI used in hiring "high-risk"?

The AI Act (Regulation (EU) 2024/1689) lists high-risk uses in Annex III. Point 4(a) covers AI intended for recruiting or selecting people, "in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates".

Article 6(3) exempts some systems that only do a narrow procedural or preparatory task. But an Annex III system that profiles people is always high-risk. A tool that scores, ranks or filters candidates fits the wording of point 4(a).

What already applies today?

The AI Act entered into force on 1 August 2024 and applies in steps.

• 2 February 2025: banned practices (Article 5). AI that infers emotions in the workplace is banned, except for medical or safety reasons (point (f)). The Commission's guidelines, which are not legally binding, cover candidates too: "Using emotion recognition AI systems during the recruitment process is prohibited." The ban is about biometric data, such as face, voice or typing rhythm. According to the guidelines, emotions inferred from written text are not covered. Using biometric data to infer race, political opinions, religion, sexual orientation and some other sensitive traits is also banned (point (g)).
• 2 February 2025: AI literacy (Article 4). As amended in 2026, providers and deployers must "take measures to support the development of AI literacy" of the staff who use their AI. Train users on what the tool does and where it can fail.
• 2 August 2025: penalties. Using a banned practice can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher (Article 99).
• 2 August 2026: AI disclosure (Article 50(1)). Providers must design AI systems that talk directly with people so that people know they are dealing with an AI, unless this is obvious.

What moved in 2026, and what is the new date?

The high-risk rules for Annex III systems were first due on 2 August 2026. Regulation (EU) 2026/1744, the "Digital Omnibus on AI" (adopted 8 July 2026, in force since 27 July 2026), moved them. These rules (Chapter III, Sections 1 to 3: classification, requirements, and the duties of providers and deployers) now apply from 2 December 2027. For AI in products under Annex I, the date is 2 August 2028.

A transition rule covers systems already on the market before that date (Article 111(2)). Ask a lawyer whether it applies to your tools.

What must the vendor (provider) do?

The provider develops the system and puts it on the market under its own name. It must manage risk (Article 9), govern its data (Article 10) and write technical documentation (Article 11). The system must keep automatic logs (Article 12), come with instructions for use (Article 13), allow human oversight (Article 14) and be accurate, robust and secure (Article 15). The provider also needs a quality management system, a conformity assessment, an EU declaration of conformity, the CE marking and an entry in the EU database (Articles 16, 17, 43 and 47 to 49).

For hiring tools, the conformity assessment is based on internal control, without a notified body (Article 43(2)). So ask for the documentation, not for a third-party certificate.

What must your company (the deployer) do?

Article 26 lists the main duties of a company using a high-risk system:

1. Use it according to the provider's instructions for use.
2. Assign human oversight to people with the competence, training, authority and support to do it. The system must let them understand its limits, watch for "automation bias" (trusting the output too much) and override it (Article 14(4)).
3. Make sure the input data you control is relevant and sufficiently representative.
4. Monitor it. If it may present a risk, tell the provider and the authority and stop using it. Report serious incidents.
5. Keep the logs under your control for at least six months, unless other law says otherwise.
6. Inform workers' representatives and affected workers before using it at the workplace.
7. Tell candidates that a high-risk AI system is used in decisions about them.
8. Use the provider's information for your GDPR data protection impact assessment, where one is required.

People affected by a significant decision based on the system's output can also ask you to explain the AI's role and the main elements of the decision (Article 86). Under Article 25, you can become the provider yourself, for example if you put your own name on a high-risk system. Breaking deployer duties can cost up to €15 million or 3% of worldwide turnover, whichever is higher (Article 99(4)). For SMEs, the lower amount applies.

What should you ask an AI hiring vendor?

• Is the tool high-risk under Annex III, point 4? If not, can we see your written assessment (Article 6(4))?
• What is its intended purpose, and where are the instructions for use?
• Does it ever reject, rank or advance candidates automatically? Can our staff see the reasons and override a result?
• Does it infer emotions or traits from faces, voices or typing?
• What does it read: CVs, photos, video, or only the candidate's answers?
• What have you measured about accuracy, consistency and differences between groups?
• Which logs do you keep, for how long, and can we get them?
• What notice do you give candidates about the AI?
• What is your plan for the conformity assessment, CE marking and registration before 2 December 2027?
• Where is candidate data processed, and will you sign a data processing agreement?

Does GDPR still apply?

Yes. Under GDPR Article 22, people have the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects. Where an exception applies, they can at least get human intervention, give their view and contest the decision.

Can national law add more?

Yes. In Finland, section 13 of the Act on the Protection of Privacy in Working Life (759/2004) allows personality and aptitude assessments only with consent. The methods must be reliable, the assessors experts and the findings free from error, and the person gets a free written statement on request. Section 2 applies the Act to job applicants "as appropriate".

What does a tool built for these rules look like?

With hire.center, a behavioral simulation assessment, a person makes every decision: there is no ranking and no hire / no-hire label. Candidates are told the assessment is AI-assisted, and every score shows the candidate's own words, checked against the conversation. Our provider documentation is still being prepared. See how we approach the EU AI Act.

Frequently asked questions

Is every AI tool used in HR high-risk?

No. Annex III point 4 covers recruitment and selection, and decisions about promotion, termination, tasks and monitoring. A tool that only does a narrow procedural task may fall outside (Article 6(3)), but not if it profiles people.

Can we use emotion recognition in video interviews?

No. It has been banned in the workplace since 2 February 2025, and the Commission's guidelines say this includes recruitment. Only medical or safety uses are exempt.

Do the rules apply to small companies?

Yes. Deployer duties do not depend on company size. SMEs get lower fine caps, and SME providers may use a simplified form for technical documentation.

Who is responsible if the tool gets it wrong: the vendor or us?

Both. The provider answers for how the system is built and documented. You answer for how you use it and what you decide.