Your AI hiring tool might be high-risk under the AI Act. Here's what that means.

AI in HR is not automatically high-risk

Storing CVs does not make an ATS high-risk. Neither does booking interview slots or drafting a neutral job description. What decides the classification is the system's intended purpose and the way it actually gets used once the vacancy is live and the queue starts filling up with applications nobody has time to read.

Annex III reaches further than most HR departments expect. It covers targeted job advertising, analysing or filtering applications, evaluating candidates, and decisions affecting terms of work, promotion, termination, task allocation or worker monitoring, which is most of what an HR platform does day to day. Those uses need close assessment.

Three dates get mixed up. The high-risk rules for Annex III systems apply from 2 December 2027. The AI Omnibus entered into force earlier, on 27 July 2026. The later date, 2 August 2028, concerns high-risk AI that is a regulated product or safety component under Annex I, not ordinary recruitment software.

AI Act timeline, European Commission. The AI Act Service Desk employment guidance also distinguishes recruitment decisions from administrative support.

Article 6(3) matters. An Annex III use falls outside the high-risk class only where it presents no significant risk to health, safety or fundamental rights, and only where it does not materially influence the decision. The listed cases are a preparatory task, a narrow procedural task, improving an already completed human activity, or detecting patterns that neither replace nor influence the reviewed human assessment. An Annex III system that profiles natural persons stays high-risk regardless.

Write down the intended purpose, the inputs, the output, the name of the person who can override it, and the reason you believe an exception applies. Ranking is not administrative support, whatever the internal memo calls it.

Ask the ATS supplier and your own team

Ask the supplier for documentation covering the intended use. Start with what the documentation says the model is for. Does it filter applications before a human sees them? Or does it only order a shortlist and pass the names along? Ask which data and which proxies feed it, whether anyone has checked those proxies against protected characteristics, and whether any of that counts as profiling at all.

Can a recruiter see the reasons behind a result? Can that recruiter correct the data and override the outcome before a consequential decision is made? Then ask for the bias testing and the change-control record. You want the incident process in writing before anything goes wrong, so the responsibilities and response steps are agreed before an incident.

A supplier is usually the provider and an employer using the tool is usually the deployer. Their duties are different and the contract has to say which side carries which.

For a high-risk system, the provider handles the required system controls and documentation, the risk management, and the logs that sit under its control rather than yours. Article 19 requires those logs to be kept for an appropriate period of at least six months, unless other applicable law says otherwise. A deployer follows the instructions and monitors use in production. The deployer also assigns effective human oversight and tells affected workers or other persons wherever the Act requires it. Oversight means a real control. A rubber stamp is not one.

GDPR Article 22 has its own test for solely automated decisions with legal or similarly significant effects. It does not create a blanket rule for every AI-assisted HR decision.

Article 27 does not require every private employer using HR AI to perform a fundamental-rights impact assessment. The scope is narrower. It targets public bodies and private entities providing public services. Specified credit uses and life or health insurance uses are on that list too. A DPIA may still be needed under GDPR, and existing work can be cross-referenced where the law allows it instead of being written out twice from scratch.

Where AI affects pay, current national rules matter as well, and our pay-transparency article goes through them.

Start with a technical audit. Map the tools and their purposes, classify each use against Annex III, then obtain the supplier documentation needed for the legal assessment. Test representative workflows. Document where in that process a human actually decides. Contact us if you need help assessing an ATS or HR system.