Is Your Recruitment AI High-Risk Under the EU AI Act?

If your recruitment agency, HR team, or talent acquisition function uses an AI system intended to recruit or select people, including screening or filtering applications or evaluating candidates, the use case appears in Annex III of the EU AI Act. You still need to apply Article 6 to the specific system rather than treating every use of a general-purpose AI tool in a recruitment workflow as automatically high-risk.

Annex III of Regulation (EU) 2024/1689 expressly lists AI systems intended for recruitment or selection of natural persons, notably targeted job advertising, analysing and filtering applications, and evaluating candidates. Article 6(3), however, provides circumstances in which an Annex III system may not be high-risk if it does not pose a significant risk of harm and does not materially influence decision-making. Profiling of natural persons remains high-risk.

The intended purpose and the way the system is actually used matter. Using a general-purpose assistant to improve the wording of a vacancy is not the same compliance question as using an AI system to score, filter or rank applicants. The full deployer package for standalone high-risk systems like this one, including the duty to tell candidates they've been subject to an AI assisted decision under Article 26(11), comes into force on 2 December 2027, under the timetable confirmed by the EU's Digital Omnibus on AI. What already applies now, regardless of that date: staff AI literacy under Article 4, in force since February 2025. Article 50 only requires candidate-facing disclosure where the specific tool itself is designed to interact directly with candidates, such as an AI driven interview chatbot, or generates content Article 50 covers; it is not a general recruitment-AI disclosure duty.

The EU AI Act classifies AI systems as high-risk where their outputs could have significant effects on people’s lives, particularly in contexts where individuals are in a vulnerable position or have limited ability to challenge decisions made about them.

Recruitment sits squarely in this category. A candidate who is screened out by an AI system and never reaches a human recruiter may never know why. They cannot challenge a ranking they cannot see. They cannot correct a CV that was misread by a language model. The economic and personal consequences of being excluded from employment are significant and, in many cases, irreversible.

The Act therefore imposes heightened obligations on anyone who deploys AI in this context, obligations designed to ensure transparency, human oversight, and the ability to challenge AI assisted decisions.

If your recruitment AI is high-risk and the relevant activity falls within the EU AI Act's territorial scope, deployer obligations can apply. A simple commercial connection to the EU is not, on its own, a complete scope test.

• Fundamental Rights Impact Assessment (Article 27), only if it applies to you. This is a specific legal requirement for public bodies, private organisations delivering public services, and businesses using AI for credit or insurance risk scoring, not for recruitment agencies generally. If that's not you, a FRIA isn't something you're legally required to produce, though documenting your own assessment of discrimination, privacy and transparency risk is still sensible given the Equality Act 2010 exposure below.
• AI Literacy (Article 4). Providers and deployers in scope must take measures, to their best extent, to support a sufficient level of AI literacy among relevant staff and others operating AI systems on their behalf, taking account of their knowledge, experience, training and context.
• Human Oversight (Article 26). Deployers of high-risk AI systems must assign human oversight to people with the necessary competence, training and authority and use the system in accordance with the provider's instructions. The appropriate oversight controls depend on the system and its risks; do not turn AI output into an automatic decision merely because the tool produced a score or shortlist.
• Transparency to Candidates. Article 50 is not a blanket recruitment-AI disclosure rule. Separate transparency duties can apply where a system directly interacts with candidates or produces content covered by Article 50. For high-risk systems, Article 26(11) also provides a specific deployer information duty for people subject to decisions or assisted decisions, when that provision applies.
• Incident Response. You must have a procedure for detecting and responding to AI incidents: including outputs that appear to be biased, inaccurate, or discriminatory, and data breaches involving candidate personal data.
• Vendor Risk Management. You must maintain documentation of the AI tools you use, their risk classifications, your data processing agreements, and the controls you have in place to manage the risks they present.

AI tools used in recruitment carry a well-documented risk of producing biased outputs. Large language models trained on historical data may reflect historical patterns of discrimination. Proxy variables, such as educational institution, postcode, or language style, may correlate with protected characteristics in ways that are invisible to the recruiter but systematic in their effect.

Under the Equality Act 2010, indirect discrimination, a provision, criterion, or practice that puts persons with a protected characteristic at a particular disadvantage, is unlawful regardless of intent. An AI system that systematically disadvantages candidates from particular backgrounds, even without any deliberate design to do so, may expose your business to discrimination claims.

The EU AI Act’s human oversight requirements are designed in part to catch exactly this kind of bias before it results in discriminatory outcomes. Periodic testing of AI assisted recruitment outcomes can help identify patterns of unfairness or discrimination. The appropriate frequency and method should be proportionate to the system, scale, risks and changes in use rather than treated as a universal monthly legal requirement.

Article 99 provides a penalty framework for specified infringements rather than an automatic fine calculated from turnover alone. For undertakings, turnover can determine the applicable maximum and Article 99 contains specific treatment for SMEs. The amount in an individual enforcement case depends on the infringement and the factors the competent authority must consider.

Beyond regulatory fines, the practical consequences include discrimination claims from affected candidates, regulatory investigations triggered by candidate complaints, reputational damage affecting client relationships, and loss of contracts with clients who require supplier AI governance compliance.

To comply with the EU AI Act as a high-risk AI deployer in recruitment, you need:

That is nine documents. Produced by a law firm, this work typically costs between £4,000 and £8,000 and takes several weeks.

Clausely’s High-Risk Ready Pack generates the nine included documents from information about your recruitment business, AI tools, EU exposure and oversight arrangements, supplied in editable format for review and adoption.

1. AI Acceptable Use Policy: governing which tools are approved and how they must be used
2. AI Literacy Policy: ensuring recruiters understand the capabilities, limitations, and risks of the AI systems they use
3. Candidate information and transparency controls: document the disclosures that actually apply, including Article 26(11) for relevant high-risk decisions and any separate Article 50 duty triggered by the system or content
4. Human Oversight SOP: documented procedures for recruiter review of AI outputs
5. AI Incident Response Procedure: for detecting and responding to AI errors, bias events, and data incidents
6. Vendor AI Risk Register: covering ChatGPT, Claude, Copilot, and any other tools used
7. Fundamental Rights Impact Assessment: only included where it actually applies to your business (public bodies, public-service providers, and credit/insurance risk scoring)
8. AI Risk Register: your own record of identifying, assessing, and mitigating risks across the workflow, as evidence for your deployer obligations rather than the provider-level Article 9 risk management system
9. Compliance Self-Check: a due-diligence review of your own position and the assurances held from your AI providers, distinct from formal Article 43 conformity assessment, which sits with the provider