.png)
A Practical Guide to Using AI in Recruitment Under the EU AI Act
Whether hiring AI is high-risk depends on the task it performs.
The AI may be a feature inside an HR platform, or a general-purpose chatbot that a recruiter uses to summarise CVs, compare applicants with a job description, or suggest who should advance. Each use affects the hiring decision differently.
Classification therefore starts with the specific use. Employers and recruitment firms need to define that use, understand how it affects selection, and tell candidates which uses are permitted and excluded. A high-risk classification does not itself prohibit the use. It means additional controls are required when the relevant rules apply.
A recruiter making the final decision does not remove the influence of an earlier score, ranking, recommendation, or shortlist.
Skip to section:
Classification depends on how the AI is used
A software inventory entry that says "AI in our applicant-tracking system" hides most of what matters. One recruiter may use a built-in parser to organise dates and qualifications. Another may paste a CV into a general-purpose chatbot for a summary. A third may rely on a match score to decide who appears first.
These are separate recruitment use cases. A short use-case assessment should answer four practical questions:
Which feature, chatbot, model, and version are being used?
What candidate information goes in, and what output comes back?
Who sees that output, and what happens because of it?
Which uses, prompts, and decisions are outside the approval?
The software vendor will generally be the provider of a system developed and supplied under its name. The employer or recruitment firm using it under its authority will generally be the deployer. The provider knows how the product was designed and evaluated. The employer knows the jobs, candidates, prompts, settings, and decisions in the actual workflow. A reliable classification needs information from both parties.
General-purpose chatbots make this especially important. The provider may offer a broad assistant without designing it to evaluate job applicants. A recruiter can still create that use through a prompt such as "rank these candidates against the role." Where an employer changes the intended purpose of an AI system so that it becomes high-risk, Article 25 can place provider responsibilities on the employer. That possibility is fact-specific, but it is another reason to define approved uses and prompts clearly.
A vendor's high-risk classification is based on the system and use that the vendor assessed. The company that is using the system still needs to assess how the system is used in its own recruitment process. Processes can vary not only between companies, but internally within a company as well.
What makes AI use high-risk or prohibited?
The system's "risk level" in EU AI Act terminology changes as it moves closer to candidate selection. A summary condenses what the recruiter sees. A matching tool interprets experience against a role. A ranking determines who appears first. A "parser" transfers facts into fields. When AI evaluates or ranks candidates, its output can affect who recruiters review first and who proceeds to the next stage. Even when a person still makes the final hiring decision.
First ask whether the feature or chatbot use is an AI system under the EU AI Act. The Commission's non-binding AI-system-definition guidelines say that basic processing or software that merely executes rules defined solely by people may fall outside the definition. If the use does involve an AI system, Annex III classifies recruitment and selection systems that analyse or filter applications or evaluate candidates as high-risk.
In this context, procedural or preparatory support means limited tasks that organise or prepare information without assessing candidate suitability or materially influencing the decision.
What the AI is asked to do | Likely position |
Extract employers, dates, qualifications, or skills into fixed fields | Data processing. Generally basic processing outside the AI-system definition or procedural support, depending on how the system works. |
Produce a factual CV summary while the original remains available | Fact-specific. It is more likely to remain procedural or preparatory support where it does not assess suitability, flag strengths or weaknesses, or emphasise information that the system predicts is more relevant. |
Compare a candidate's experience with a job and assess compatibility, capability, potential, or culture fit | Candidate evaluation and generally high-risk. It may also constitute profiling, which prevents reliance on the Article 6(3) exception. |
Generate a match score, fit category, ranking, recommendation, filter, priority order, or shortlist | Candidate evaluation or application filtering and generally high-risk. |
Article 6(3) provides a narrow exception for specified support uses that do not present a significant risk, because they do not materially influence the decision. The exception does not apply if the system profiles candidates. A provider (not an employer, user, or recruiter) relying on this exception will have to document the assessment and register the system under Article 49(2) when the relevant Annex III rules apply.
The Commission's draft, non-binding employment examples apply this distinction in practice. Organising CV information may be procedural or preparatory support. Matching that produces scores, rankings, recommendations, or shortlists is treated as high-risk even where a recruiter can review or override it. The examples remained draft as of 24 August 2026.
"High-risk" neither bans nor approves the use. It identifies the additional controls that the AI Act will require.
Article 5 prohibits employers from using AI to infer candidates' or workers' emotions from biometric data in the workplace, including during recruitment. A narrow exception applies to systems intended for medical or safety reasons. The prohibition has applied since 2 February 2025; the later Annex III timetable does not apply.
A recruiter making the final decision does not remove the influence of an earlier score, ranking, recommendation, or shortlist. In the Commission's draft view, a system can remain high-risk where that output materially influences who is reviewed, prioritised, interviewed, or selected.
Under the current amended schedule, the Annex III high-risk requirements will apply from 2 December 2027. AI-literacy measures have applied since 2 February 2025, and employment, equality, data-protection, consultation, and transparency requirements may apply on separate timetables.
Empowering real recruitment work
An approved use-case can stop describing reality surprisingly quickly. Recruiters may use the system in ways that the approval does not cover. A recruiter discovers that a summary tool can also rank CVs. A team begins asking a chatbot to infer leadership potential. A vendor update adds a default "best match" sort. The contract may be unchanged, but recruiters are now using the system to evaluate or rank candidates.
A company's guidance for recruiters should make that boundary usable in daily work. It should explain:
what the system is approved to do and which uses are excluded;
what the output means, what information it uses, and where it may be unreliable;
when to review the original evidence, disregard the output, or seek a second review; and
which prompts, settings, integrations, incidents, or vendor changes require review.
The reason is practical as well as regulatory. A 2026 Stanford study analysed four million applications. Researchers found disparities when they examined individual jobs, but not when they combined the results across all jobs. A 2025 University of Washington study found that reviewers sometimes made similarly biased decisions after receiving biased recommendations from a simulated AI system. Neither study assessed EU AI Act compliance. Their findings show why monitoring and human review should be designed for the recruitment process in which the software system is used.
The use-case assessment should describe the recruitment process being monitored. It should identify the approved system and use, jobs, candidate population, inputs, recruiter instructions, human authority, monitoring, and reassessment triggers. Monitoring should use the same scope as the classification: feature or chatbot use, job, language, workflow, and candidate population.
When the high-risk deployer requirements apply, Article 26 will require the employer or recruitment firm to follow the provider's instructions and assign trained, authorised people to oversee the system. The employer must also ensure that input data under its control is relevant and sufficiently representative, monitor the system, and report risks and serious incidents. It must keep automatically generated logs under its control for at least six months, or longer where the intended purpose requires it, unless another applicable law sets a different period.
Before workplace use, Article 26(7) will require the employer or recruitment firm to tell affected workers and their representatives that the system will be used in a way that affects them. If an Annex III system makes or assists with a decision about a candidate, Article 26(11) will require the employer to tell the candidate that the system is being used in that decision.
Under Article 86, an affected candidate may be entitled to a clear, meaningful explanation of how the AI was used and why the decision was made. The right applies when the employer bases the decision on an Annex III high-risk system's output, the decision has legal or similarly significant effects, and the candidate considers those effects adverse to their health, safety, or fundamental rights.
When the relevant high-risk requirements apply, Article 27 will also require an employer that is a body governed by public law or a private entity providing public services to complete a fundamental-rights impact assessment before first use.
Third-party hiring AI should be classified by what it does in the recruitment process, not by the product name or vendor description.
Employers and recruitment firms should record the approved use, explain its limits to recruiters, and review the classification whenever the system or recruitment process changes.
This allows the employer to distinguish administrative support from high-risk candidate evaluation and prohibited workplace emotion recognition.
Validaitor helps employers and recruitment firms document each approved hiring use, assess the provider's evidence, record the classification reasoning, define recruiter instructions and human review, and identify the changes that require reassessment.
General information, not legal advice. Legal sources checked against the consolidated EU AI Act dated 27 July 2026 on 24 August 2026.
