The EU AI Act and hiring: what changes for recruiters, and when

The timeline at a glance

Why hiring AI counts as high-risk

Annex III, point 4(a), lists "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates". Point 4(b) adds AI used for decisions on promotion and termination, to allocate tasks, or to monitor and evaluate performance.

Article 6(3) says an Annex III system is not high-risk if it poses no significant risk, including by not materially influencing decisions, and it is intended to do one of these:

• perform a narrow procedural task;
• improve the result of a previously completed human activity;
• detect decision-making patterns or deviations, without replacing or influencing the human assessment without proper human review;
• perform a preparatory task to an assessment.

There is a catch. An Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons". A provider that decides its system is not high-risk must document that assessment. Ask your vendor, in writing, which view it takes and why.

Already banned: emotion recognition at work

Since 2 February 2025, Article 5(1)(f) has prohibited "the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions". The only exception is a system put in place for medical or safety reasons.

The ban reaches hiring. According to Lewis Silkin, the Commission's non-binding guidelines on prohibited practices extend it to "candidates in a recruitment cycle or probationary period". Their examples include AI that infers emotions from keystrokes, facial expressions, body postures or voice. The definition of emotion recognition rests on biometric data, so sentiment analysis of written text falls outside it.

Telling candidates they are talking with an AI

Article 50(1) says providers "shall ensure that AI systems intended to interact directly with natural persons are designed and developed" so that people are informed they are interacting with an AI, unless that is obvious. The information must come "at the latest at the time of the first interaction". It has applied since 2 August 2026; the Omnibus left it on schedule (Cooley).

Note who carries the duty: the provider, meaning the company that builds the AI interviewer. An employer that builds its own is the provider. Either way, say it in the interview invitation too. Candidates notice when nobody does: in a Greenhouse survey from May 2026, 70% of US job seekers who had faced an AI interview were not told upfront that AI would evaluate them.

What employers must do from 2 December 2027

When you use a high-risk system, the Act calls you a deployer. Article 26 sets your duties. The main ones for recruiters:

• Use it as instructed. Take appropriate technical and organizational measures to use the system according to the provider's instructions.
• Assign human oversight to people "who have the necessary competence, training and authority".
• Check your input data. Where you control it, it must be relevant and sufficiently representative for the intended purpose.
• Monitor, and stop if needed. Watch how the system performs, tell the provider about risks, and suspend use if you have reason to think the system presents one.
• Keep the logs the system generates, where they are under your control, for at least six months unless other law says otherwise.
• Tell workers first. Employers must inform workers' representatives and the affected workers before a high-risk system is used at the workplace.
• Use the provider's information for your data protection impact assessment, where one applies.
• Tell the people affected. Deployers of Annex III systems that make or help make decisions about people must inform those people.

Article 86 adds a right to an explanation. A person affected by a decision based on a high-risk system's output, which they consider has an adverse impact on their health, safety or fundamental rights, can ask for "clear and meaningful explanations of the role of the AI system" and the main elements of the decision.

What the Digital Omnibus changed

Regulation (EU) 2026/1744 was adopted on 8 July 2026, published on 24 July and in force from 27 July. For hiring, three changes matter:

• High-risk duties for Annex III systems, including recruitment, moved from 2 August 2026 to 2 December 2027 (Hunton).
• Article 50 disclosure stayed on schedule from 2 August 2026. Only the duty to mark AI-generated content got a grace period to 2 December 2026, for systems already on the market (Cooley).
• The AI-literacy duty in Article 4 was rewritten in softer terms: support for staff AI literacy rather than a duty to ensure a set level of it.

The emotion-recognition ban did not move. It has applied since 2 February 2025.

GDPR Article 22 applies today

The AI Act sits on top of the GDPR; it does not replace it. Under Article 22, a person has "the right not to be subject to a decision based solely on automated processing", including profiling, that has legal or similarly significant effects on them. Exceptions exist for contracts, Union or member-state law, and explicit consent. In the contract and consent cases, the employer must offer at least "human intervention", a chance to express a view, and a way to contest the decision.

So a rejection made solely by software has been a GDPR question for years, whatever the AI Act dates say.

What to do now

1. Remove emotion inference. Ask every vendor whether any feature infers emotions or intentions from face, voice or typing. If one does, switch it off for EU hiring.
2. Disclose AI at the first touch. Name the AI in the invitation and again at the start of the conversation.
3. Map your tools against Annex III. Note which ones score, rank, filter or evaluate candidates, and get each provider's written view on high-risk status.
4. Design human oversight now. Name the people who review outputs and make decisions, train them, and make sure they have the authority to disagree with the system.
5. Plan for logs. Confirm you can keep system logs for at least six months.
6. Talk to employee representatives early, where you have them.
7. Keep GDPR in view. Run a data protection impact assessment where the GDPR requires one, and offer human review of any solely automated decision.

Itya runs structured interviews: one rubric per job, consent capture before recording, transcripts with speaker attribution, and scorecards that cite the moment behind each rating. Records like these can help you meet specific duties, such as giving a reviewer the evidence to exercise oversight and explaining a decision on request. They do not carry your obligations for you. Our trust page lists our DPA and subprocessors, and our jurisdiction guide covers the rules outside the EU.