Recruiting is where AI saves the most hours — and where EU law is the strictest. A tool that reads 400 applications overnight and hands you the “top 20” feels like pure productivity. Under the AI Act, it is a high-risk system. Under the GDPR, an automatic rejection is a decision with significant effects. And under Article 5, analysing a candidate’s facial expressions for “enthusiasm” is something you should not be doing at all.
The market is moving fast regardless. Workday bought Paradox, a recruiting assistant with 189 million candidate conversations behind it (HR Executive), and voice-AI screening interviews are a growing use case at staffing agencies (a16z). This guide shows which uses are fine today, which need high-risk controls by 2 December 2027, which are banned — and how to get the productivity without the liability.
Why hiring is “high-risk”
Annex III, point 4 of the AI Act classifies two groups of employment systems as high-risk:
- Recruitment and selection — in particular systems to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
- Decisions during employment — systems used to decide on promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour.
The logic is simple: these systems shape people’s livelihoods, and historical hiring data carries historical bias. After the Digital Omnibus (Regulation 2026/1744), the high-risk obligations for Annex III systems apply from 2 December 2027 (AIActo). That sounds far away until you remember procurement, works council negotiations and vendor changes take months.
The dates HR teams need on one page:
- Since 2 February 2025 — EU ban on emotion recognition at the workplace; AI literacy for staff using AI.
- Since 1 January 2026 — Illinois HB 3773 and Texas TRAIGA apply to AI in employment in the US.
- Since 2 August 2026 — candidate-facing chatbots and voice agents in the EU must disclose that they are AI.
- 1 January 2027 — Colorado’s revised, disclosure-based AI law takes effect.
- 2 December 2027 — full high-risk obligations for recruitment and HR systems in the EU.
The traffic light: what is allowed, what is high-risk, what is banned
| AI use in recruiting | Status in the EU | Why |
|---|---|---|
| Drafting job descriptions and interview questions | Green — minimal risk | Assists humans; check wording for bias |
| Candidate FAQ chatbot, interview scheduling | Green — transparency duty | Disclose that it is AI (Art. 50) |
| Parsing CVs into ATS fields without ranking | Amber — possibly outside high-risk | May be a “narrow procedural task” under Art. 6(3); document the assessment |
| Summarising applications for a recruiter | Amber | Becomes high-risk if it effectively filters or scores |
| Targeted delivery of job ads | Red — high-risk | Explicitly listed in Annex III |
| Ranking, filtering or scoring applicants | Red — high-risk | Explicitly listed in Annex III |
| Automated scoring of video or voice interviews | Red — high-risk | Evaluates candidates |
| Emotion or “personality” inference from interviews | Black — treat as prohibited | Art. 5(1)(f): emotion recognition at the workplace |
| Inferring ethnicity, religion, orientation from biometrics | Black — prohibited | Art. 5(1)(g): biometric categorisation |
| AI performance monitoring of employees | Red — high-risk | Annex III, point 4(b) |
On emotion recognition: Article 5(1)(f) prohibits it in the workplace and in education, except for medical or safety reasons, and it has applied since 2 February 2025 (AI Act, Article 5). Interviewing is the gateway to the workplace; we advise treating candidate emotion scoring as covered and simply not using it. Outside the EU the trend is the same — Kazakhstan’s AI law, in force since 18 January 2026, bans emotion recognition without consent (Kursiv).
Provider or deployer: the role decides the workload
| Provider (builds or sells the tool) | Deployer (the employer using it) | |
|---|---|---|
| Risk management | Risk management system (Art. 9) | Use per instructions; report risks (Art. 26) |
| Data | Data governance incl. bias examination (Art. 10) | Ensure input data you control is relevant and representative |
| Documentation | Technical documentation (Art. 11), instructions for use (Art. 13) | Keep the provider’s documentation; record your usage |
| Logging | Automatic logging built in (Art. 12) | Keep logs for at least six months (Art. 26(6)) |
| Human oversight | Design for oversight (Art. 14) | Assign competent, trained people with authority (Art. 26(2)) |
| Accuracy and security | Art. 15 | Monitor operation; report serious incidents |
| Market entry | Quality management, conformity assessment, CE marking, EU database registration | — |
| People affected | — | Inform workers’ representatives and workers before use (Art. 26(7)); inform candidates (Art. 26(11)); explain decisions on request (Art. 86) |
The trap for SMBs: if you build your own screening workflow — say, a prompt that asks a general-purpose model to score CVs against a job profile — you may become the provider of a high-risk system (Article 25). That means conformity assessment and documentation duties designed for software vendors. Buying from a provider that takes on those duties is usually cheaper and safer than improvising.
The GDPR layer applies today
The AI Act deadlines are in 2027, but the GDPR already governs every AI touchpoint in your hiring funnel:
- Article 22 — automated decisions. Candidates have the right not to be subject to a decision based solely on automated processing that significantly affects them. An automatic rejection qualifies. Human involvement must be meaningful: a recruiter who rubber-stamps every AI “no” is not oversight.
- Articles 13–14 — transparency. Tell candidates that AI is used, for what, and — where Article 22 applies — give meaningful information about the logic involved.
- Article 35 — DPIA. Systematic evaluation of candidates with new technology is a classic trigger for a data protection impact assessment.
- Article 9 — special categories. Health data, ethnicity or religion must not be inferred or used as selection signals.
- Storage limitation. Define how long applicant data and AI scores are kept after the process closes.
A quick look at the US
There is no federal AI law, but states are active. Illinois HB 3773 (AI in employment decisions) and Texas TRAIGA have applied since 1 January 2026; Colorado rewrote its AI act into a disclosure-based regime taking effect on 1 January 2027 (GC AI, Sigma Law). Executive Order 14365 of 11 December 2025 aims to pre-empt state AI laws, but it does not repeal them by itself and no court has ruled on pre-emption yet (Paul Hastings). If you hire in both markets, design for the stricter EU standard and add state-specific notices.
What this looks like in practice
Imagine a 60-person logistics company that hires warehouse staff and drivers all year round. Every opening attracts a stack of applications, two recruiters spend their mornings sorting them, and candidates wait days for an answer. Here is how the same company can use AI on both sides of the line:
- Low-risk set-up. An AI assistant answers candidates’ questions about shifts, pay ranges and licences around the clock, books interview slots in the recruiters’ calendars and sends reminders. Applications are parsed into structured fields in the ATS. Recruiters still read and decide. Duties: AI disclosure in the chat, GDPR notice, retention rules. What it saves: the manual back-and-forth with candidates.
- High-risk set-up. The same system additionally scores each applicant against the job profile and hides everyone below a threshold. Now it filters candidates: from December 2027 the company needs the provider’s documentation, trained oversight, six months of logs, worker and candidate information — and, today already, a GDPR basis for what is effectively automated rejection.
Start with the low-risk set-up and measure how much time it actually saves before deciding whether scoring is worth the extra obligations. If you do move to scoring, do it deliberately, with a vendor that carries provider duties, and keep a human decision on every rejection.
A safe-use playbook for SMBs
1. Map the funnel. Write down every step from job ad to offer and mark each place where AI touches data or decisions — including features switched on by default in your ATS.
2. Keep AI on the assist side. The safest high-value uses help recruiters rather than replace their judgement: drafting ads, answering candidate questions 24/7, scheduling, structuring notes. These save hours without making the system high-risk.
3. If you rank, buy carefully. Ask the vendor for its AI Act roadmap before you sign. The answers separate serious providers from rebranded prompts:
| Question to the vendor | Good answer | Red flag |
|---|---|---|
| Who is the provider under the AI Act? | The vendor, with a plan for conformity assessment, CE marking and registration by December 2027 | “Compliance is the customer’s responsibility” |
| How do you test for bias? | Documented tests across groups, results shared with customers | “Our model is neutral by design” |
| What do the logs contain, and can we export them? | Per-decision logs, exportable, retained at least six months | Scores only in the dashboard |
| Can recruiters see why and override? | Explanations per candidate, override with audit trail | A single opaque score |
| Is any emotion or personality inference included? | No — or it can be switched off entirely | “Engagement” or “enthusiasm” scores from video |
| Where is candidate data processed? | EU region, Article 28 DPA, sub-processor list | Unclear regions, no DPA |
| Do you train your models on our candidates’ data? | No, excluded by contract | Opt-out buried in settings |
4. Test for bias with evals. Before launch and after every model or prompt change, run the system against a representative test set and compare outcomes across groups where lawful. A tool that “works” on average can still disadvantage a group. Our guide to AI evals shows how to build such test sets.
5. Design real human oversight. Name the reviewers, train them on the system’s limits, give them authority to override, and log overrides. If reviewers never disagree with the AI, investigate.
6. Tell candidates. One paragraph in the job ad or application form: what AI does, that a human makes the decision, and how to request an explanation or human review. Disclose AI chatbots as AI (Article 50 guide).
7. Involve employee representatives early. The AI Act requires informing workers’ representatives before a high-risk system is used at the workplace. In Germany, the works council has co-determination rights over technical systems capable of monitoring behaviour or performance (§87 BetrVG) and over selection guidelines (§95 BetrVG); in the Netherlands, the works council’s consent rights under Article 27 WOR cover areas such as hiring policy, personnel data and monitoring systems.
8. Keep the paper trail. Inventory entry, DPIA, vendor documentation, oversight procedure, training records, logs for at least six months. The same folder answers candidates, regulators and enterprise clients. Our GDPR guide for AI assistants covers the data side in detail.
Typical mistakes
- “It’s just a summary.” If recruiters only read the AI’s top candidates, the summary is a filter — and the system is high-risk.
- DIY screening prompts. A clever prompt over a general-purpose model can make you a provider of a high-risk system.
- Emotion and “culture fit” scoring from video. Banned or near-banned in the EU, and scientifically weak anywhere.
- Rubber-stamp oversight. A human who approves 100% of AI decisions without review does not satisfy Article 22 or Article 26.
- Ignoring default-on features. Many ATS platforms ship AI matching switched on; your inventory must catch them.
- Waiting for December 2027. GDPR, Article 5 and Article 50 duties apply today, and works council processes take time.
Conclusion
AI can take the drudgery out of recruiting — answering candidates, scheduling, structuring information — at low regulatory cost. The moment it starts filtering, ranking or scoring people, it becomes a high-risk system with real obligations from 2 December 2027, and GDPR limits on automated rejection apply already. Emotion inference is off the table. Companies that set up oversight, bias testing and transparency now will be able to keep the productivity gains when the deadline arrives; the broader timeline is in our EU AI Act guide for SMBs.
Lotus Libre builds recruiting assistants and agents that keep humans in charge, and the logging, evals and governance layer that high-risk use requires. If you want to know where your current recruiting tools stand, book a free 15-minute audit.
This article is general information and not legal advice. Employment and AI law vary by country; consult a qualified lawyer before deploying AI in hiring decisions.