The AI Act and recruitment: what the law requires, and from when

The AI Act entered into force on 1 August 2024 and applies in waves. For recruitment, the key date moved in 2026. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, pushed back the obligations for Annex III high-risk systems, which include tools that screen and evaluate candidates, from 2 August 2026 to 2 December 2027. That delay gives you time to prepare an audit of your tools without excusing you from doing it, because part of the text and the whole of the GDPR already apply.

We wrote this guide to answer the questions we hear in demos: what the law requires, and from when, what becomes non-compliant in current practice, and what to ask an HR vendor before you sign.

Why recruitment is classified as "high risk"

The AI Act sorts AI systems by risk level. Its Annex III, point 4(a), lists as high-risk the systems intended for recruiting or selecting people, in particular to place targeted job ads, analyse and filter applications and evaluate candidates. Article 6 provides exceptions for narrow or preparatory tasks, but a system that profiles people is always high-risk.

The text distinguishes the provider, who builds the tool and handles the technical documentation, risk management and instructions for use, from the deployer, meaning the company or agency that uses it. From 2 December 2027, Article 26 requires the deployer, among other things, to:

• Use the tool in line with the provider's instructions for use.
• Assign human oversight to people with the necessary competence, training and authority.
• Make sure the input data it controls is relevant and sufficiently representative.
• Monitor how the system operates and alert the provider in case of risk or serious incident.
• Keep the automatically generated logs for at least six months, unless another rule applies.
• Inform workers' representatives and the employees concerned before using the system in the workplace.
• Inform the people subject to decisions the system takes or helps take, candidates included, that the system is being used on them.
• Use the information supplied by the provider to carry out the data protection impact assessment (DPIA) required by the GDPR.

Article 86 adds a right for the person concerned. When a decision taken on the basis of the output of an Annex III system produces legal effects or similarly significantly affects them, they can obtain from the deployer clear and meaningful explanations of the role of the AI and the main elements of the decision.

What already applies, and what waits until December 2027

The timeline, as it results from the 2024 regulation amended by Regulation (EU) 2026/1744, subject to later changes:

• Since 2 February 2025: the prohibited practices of Article 5, including systems that infer a person's emotions in the workplace (except for medical or safety reasons), and the AI literacy obligation of Article 4. In its version rewritten in 2026, that article asks providers and deployers to take measures to support the AI literacy of their staff, without having to guarantee a given level for each person.
• Since 2 August 2026: general application of the regulation.
• From 2 December 2027: the requirements and obligations of Chapter III, Sections 1 to 3, for Annex III systems, meaning the provider's obligations and the deployer's obligations under Article 26.

These requirements come on top of the GDPR, which already governed candidate profiling before the AI Act.

Opaque scores become hard to defend

The AI Act doesn't ban scores. Still, a system that gives a candidate a rating it can't break down into understandable factors puts the deployer in a tight spot, since the deployer will have to provide effective human oversight and, if the candidate asks, explain the role the AI played in the decision.

Candidate A gets an 87% match, candidate B gets 64%.

If you can't say in plain language what produces that 87% and that 64%, no one on the team will be able to justify the decision to a candidate or an authority.

Plenty of tools display a score on the grounds that it's "calculated from 12 weighted criteria." If the weighting is neither shown, nor editable, nor justifiable on an individual basis, you're still in opaque-score territory. The provider's technical documentation doesn't settle everything, because the recruiter only ever sees a number.

Consumer generative AI becomes a trap

The second change, less visible but just as decisive, concerns consumer generative AI models that originate outside Europe. Not because the technology is bad, but because:

• The data sent to the model may leave the EU.
• The conversation history can be used for training, depending on the account and the settings.
• Erasure guarantees depend on the type of account and the contract.
• The company usually keeps no usable record to answer a DPO or CNIL audit.

Recruitment teams work around it, and badly.

It's become common practice. The recruiter copy-pastes a manually anonymized CV, or uses a third-party extension, or asks the AI to generate an interview outline from a job description without really knowing where the data goes. The DPO looks the other way or gets annoyed, and no one is compliant.

The six questions to ask before buying an HR tool

If you're evaluating an HR tool that includes AI, here are the questions to ask, and to get written into the contract, before you sign.

1. Data location. Where is candidate data stored and processed? Which subprocessors are involved, and is any data transferred outside the EU?
2. Training. Is client data used to train a model? If so, under what conditions, and can you opt out by default?
3. Model used. Which AI model powers the tool? Is it auditable, or is it a black box supplied by a third party?
4. Explainability. Does the tool produce scores? If so, can you see the criteria they're built from? If not, how are decisions presented to the recruiter?
5. Retention. How long is candidate data kept? Does the vendor honor the right to erasure, with proof?
6. Audit. Can the vendor provide logs on request for a DPO audit or a formal notice?

If even one of these answers stays vague, you're in a gray area.

The DPO becomes a decision-maker

The DPO still often shows up at the end of the process, for an audit after the purchase and a nod at the terms of service. Yet the data protection impact assessment (DPIA) must be carried out before the processing, and Article 35 of the GDPR requires seeking the DPO's advice when you do it. The CNIL lists processing that profiles people for human resources management among the operations that require a DPIA. From 2 December 2027, Article 26 of the AI Act will also require the deployer to rely on the provider's information to carry it out.

For a recruitment department, that means four things:

• Bring the DPO in at the evaluation stage of an HR tool, not after the pilot.
• Give them the vendor's technical documentation (model, data, hosting).
• Update the records of processing to include the new system.
• Set up an explicit channel for the candidate to object.

Teams that skip these steps expose themselves to concrete operational risk. A candidate complaint, a CNIL inspection, or a letter from a European authority is enough to trigger a demand for immediate compliance, which can block the tool for weeks.

Sovereignty moves from bonus to filtering criterion

The AI Act doesn't require choosing a European vendor. In practice, a vendor hosted in the EU, which limits and declares its transfers outside the Union, makes the compliance file much simpler, transfers being a GDPR matter.

In the tenders we see from agencies and IT services firms (ESNs), hosting location has become a question asked up front, and an HR vendor that doesn't clearly state where candidate data is stored starts at a disadvantage. Still, you have to look past the flag, because what "sovereign" actually means, the vendor's jurisdiction, the Cloud Act, chapter V of the GDPR, decides how solid the file really is.

What makes Hirify easy to clear with a DPO

• Hosting in France on Scalingo (Paris datacenter). Processing located outside the EU, tied to semantic search in the talent pool, is declared on hirify.fr/en/security.
• No match percentage on the candidate profile, and an interview analysis produces no score. Sourcing does rank talent pool profiles, by visible, weightable criteria (skills, experience, interview, logistics), shown in tiers. The Hub surfaces qualified criteria (skill, experience, a constraint the candidate stated) that the recruiter reads like a profile.
• Explainable decisions. Every enrichment of a candidate profile is traceable back to the interview transcript excerpt that justifies it.
• No retraining on your data. By default, client data is not used to train any model, and that's written into the contract.
• Documentation ready. The technical sheet the DPO needs to update the records of processing is provided on request, and the public commitments (host, subprocessors, security measures) are gathered on our Trust & security page.

On our sales cycles, these are the points that reduce friction with DPOs the most. Without them, a DPO sometimes blocks a tool after the purchase, and the value is never delivered.

Frequently asked questions

When does the AI Act apply to recruitment tools?

The obligations specific to Annex III high-risk systems, which include tools that screen and evaluate applications, apply from 2 December 2027. Regulation (EU) 2026/1744, in force since 27 July 2026, pushed back this date, originally set for 2 August 2026. The ban on systems that infer a person's emotions in the workplace and the AI literacy obligation have applied since 2 February 2025, and the GDPR keeps applying alongside.

Is my CV screening tool a high-risk AI system?

In principle, yes. Annex III, point 4(a), covers systems intended for recruiting or selecting people, in particular to place targeted job ads, analyse and filter applications and evaluate candidates. Article 6 provides exceptions, for instance for a narrow procedural or preparatory task with no significant effect on the decision, but a system that profiles people is always high-risk. A provider who rules out that classification must document its assessment.

Can a candidate ask why an AI weighed on the decision?

Article 86 provides for it, within the regime for Annex III high-risk systems. It gives anyone subject to a decision taken on the basis of the output of such a system, which produces legal effects or similarly significantly affects them, the right to obtain from the deployer clear and meaningful explanations of the role of the AI system and of the main elements of the decision. A score that can't be broken down into understandable criteria makes that answer hard to give.

Do you need a DPIA before using an AI recruitment tool?

In most cases, yes. The CNIL, France's data protection authority, lists processing that profiles people for human resources management among the operations that require a DPIA. Article 35 of the GDPR requires it to be carried out before the processing and the DPO's advice to be sought. From 2 December 2027, Article 26 of the AI Act will also require the deployer to use the information supplied by the tool's provider to carry it out.

Key takeaways

• Tools that screen or evaluate candidates are high-risk under the AI Act (Annex III). Their obligations apply from 2 December 2027, after the postponement set by Regulation (EU) 2026/1744.
• The ban on emotion recognition at work, the AI literacy obligation and the GDPR already apply.
• A score that can't be broken down into understandable criteria will be hard to defend when a candidate asks for an explanation.
• Pasting CVs into consumer generative AI, without a suitable contract or settings, raises a GDPR problem that manual anonymization rarely solves.
• Consult the DPO upstream, at the DPIA stage, rather than after the purchase.
• EU hosting and declared subprocessors simplify the compliance file without replacing it.