EU AI Act in HR: When Your Recruiting Tools Become "High-Risk Systems"
The AI Act's high-risk category captures almost every algorithmic recruiting and people-decision tool. Here's the obligations stack and what HR buyers should be asking vendors right now.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI regulation. For HR teams, the relevant section is Annex III, which classifies AI systems used in "employment, workers' management and access to self-employment" as high-risk. The phase-in timeline is real: prohibited practices applied from February 2025, general-purpose AI obligations from August 2025, and the full high-risk obligations land in August 2026.
What counts as a high-risk HR AI system
Annex III, point 4 covers AI used for:
- Recruitment or selection — CV filtering, video-interview analysis, automated scoring of applicants
- Decisions affecting terms of work — promotions, terminations, task allocation, performance monitoring based on AI signals
- Monitoring or evaluating performance and behaviour
This sweep captures almost every commercial applicant tracking system with built-in scoring, every "AI interviewer" platform, and every productivity-monitoring tool that uses machine learning on keystroke or screen data. The European Commission's AI Act portal is the canonical reference for scope debates.
The obligations stack
For a high-risk system, both the AI provider and the deploying employer have obligations. The employer must:
- Use the system in line with the provider's instructions and monitor its operation
- Ensure human oversight by someone competent to override or stop the system
- Conduct a fundamental rights impact assessment before deployment
- Inform workers (and their representatives) before the system is used
- Keep logs for at least six months
The NIST AI Risk Management Framework is not legally binding in the EU but is the de facto operational template most vendors are aligning to.
What HR buyers should be asking right now
Before signing a new contract for any AI-powered HR tool, ask the vendor for:
- Their classification of the system under the AI Act (high-risk yes/no and reasoning)
- Their conformity assessment plan and CE marking timeline
- The technical documentation required by Article 11
- Sample logs that demonstrate transparency to employees
If the vendor cannot answer those four questions in writing, the contract is a risk to your compliance program. HourSquare's own AI-generated HR briefs ship with full prompt transparency and a per-tenant opt-out; the underlying classification documentation is published before the August 2026 deadline.