EU AI Act for HR: High-Risk Rules for Recruitment & Workforce AI
AI is now embedded across the employee lifecycle — from CV screening and interview scoring to performance ranking and shift allocation. Under the EU AI Act (Regulation (EU) 2024/1689), most of these systems fall into the high-risk category, triggering the Act's strictest obligations. The rules apply wherever your company is based, so long as the system or its output is used inside the EU.
Is it in scope?
Annex III explicitly lists employment, worker management and access to self-employment as a high-risk area. This covers AI used to recruit or select candidates, to make or influence decisions on promotion and termination, to allocate tasks, and to monitor or evaluate performance and behaviour. Even where a human signs off the final decision, a system that materially influences that outcome is in scope. Some workplace uses are outright prohibited under Art. 5, notably emotion recognition of employees (outside narrow medical or safety exceptions).
Typical AI use cases
- CV parsing and automated candidate shortlisting
- Interview scoring and video-analysis assessment
- Performance evaluation and promotion ranking
- Automated task and shift allocation
- Productivity and behavioural monitoring of workers
- Attrition and flight-risk prediction
Risk classification
HR and workforce systems almost always land in high-risk by virtue of the Annex III employment listing. The AI vendor building the screening or evaluation tool is typically the provider and carries the bulk of the design-time obligations (Art. 9–15). The employer running it is the deployer under Art. 26 — responsible for using it per instructions, ensuring meaningful human oversight, monitoring for bias, and informing affected workers. Both roles must be mapped before deployment.
Obligations to prepare for
FAQ
Is an AI CV-screening tool automatically high-risk?
Yes. Recruitment and candidate selection sit squarely within the Annex III employment category, so screening and shortlisting tools are treated as high-risk unless a narrow derogation genuinely applies.
We only deploy a third-party HR tool — do the rules still apply to us?
They do. As the deployer under Art. 26 you must run the system according to the provider's instructions, ensure human oversight, monitor its operation, and inform the workers who are subject to it.
Can we use AI to detect employee emotions or engagement?
Emotion recognition of workers in the workplace is prohibited under Art. 5, save for limited medical or safety purposes. Most engagement-analytics use cases are therefore off-limits.
Run the free 2-minute risk checker — no sign-up.