Compliance for recruitment and staffing agencies.
Recruitment carries three overlapping duties: high-risk AI screening under the EU AI Act, candidate and client data under UK GDPR, and the Worker Protection Act 2023 preventative duty across your own staff and placed workers.
Why this matters
Recruitment sits at the intersection of AI, data, and worker protection duties.
Candidate screening, CV parsing, and ranking tools fall under EU AI Act Annex III high-risk classification.
Article 26 deployer obligations apply: human oversight, impact assessment, record-keeping.
UK GDPR Article 22 automated decision-making rules tighten the documentation burden further, alongside privacy notices, a ROPA, and a DPIA for candidate data.
The Worker Protection Act 2023 preventative duty covers harassment of your own staff and of workers you place, including harassment by clients and site contractors.
Recommended packs
The two tiers most recruitment businesses need.
Clear pricing. 14-day refund.
Larger organisation, multiple entities or a wider rollout? Explore Enterprise.
Professional
For recruiters using AI in screening, sourcing, or candidate communications.
- AI Acceptable Use Policy
- AI Literacy Policy
- Article 50 Transparency Disclosures
- Human Oversight SOP
- AI Incident Response Procedure
- Vendor AI Risk Register
High-Risk Ready
For agencies running AI driven screening, ranking, or matching: a full Annex III deployer pack.
- Everything in Professional
- Fundamental Rights Impact Assessment, where Article 27 applies
- Risk Management Plan
- Conformity Self-Assessment Checklist
FAQ
Common questions for recruitment.
Does this apply if we only use AI for CV parsing, not final decisions?
Yes. The EU AI Act classifies any AI system used in recruitment workflows as high-risk, even if a human makes the final call.
What if we use tools like LinkedIn Recruiter or HireVue?
You’re a deployer under the Act. You hold Article 26 obligations regardless of who built the tool.
How does this interact with UK GDPR?
UK GDPR Article 22 covers the data protection side; the EU AI Act covers the AI governance side. You need both.
What did the Digital Omnibus political agreement (May 2026) actually change?
The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.
Has the high-risk AI deadline really moved to December 2027? What still applies now?
The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.
Does the Digital Omnibus mean we can wait until 2027 to act?
Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.
What actually counts as a “high-risk” AI system under Annex III?
Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.
Does the EU AI Act still apply to UK businesses post-Brexit?
The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.
What happens if our business is not compliant?
The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.
Reviews
What UK businesses say.
“Clausely is a total lifesaver! I used the Risk Checker and it really opened my eyes to where my business was exposed. It provided exactly the clarity I needed and gave me total peace of mind.”
Rosa Rambla Espejo
Ready to get your recruitment compliance pack?
Tailored to your business. Delivered in minutes. Defensible for years.
Not sure where you stand? Take the free compliance risk check.