Guide · EU AI Act

EU AI Act in recruiting: what employers must do by December 2027

AI that screens, interviews or ranks candidates is a high-risk AI system under the EU AI Act. The main obligations apply from 2 December 2027, but some rules already apply today. This guide sets out what applies when, who is responsible for what, and what to do now.

By Dr. Philipp Götting, founder of Hurraay. Updated 12 November 2026. This guide is not legal advice.

Why recruiting AI counts as high-risk

Annex III of the AI Act lists the uses the EU considers high-risk. Point 4 covers employment, including AI systems intended for the recruitment or selection of people, in particular to place targeted job ads, to analyse and filter applications, and to evaluate candidates.

The reason is simple: these systems influence who gets access to work. Errors or bias in them can affect careers, so the AI Act requires the people building them and the people using them to manage those risks.

Timeline: what applies when

2 February 2025: prohibited practices, including emotion recognition in the workplace (Article 5(1)(f)), and AI literacy (Article 4).
2 August 2025: rules for general-purpose AI models.
27 July 2026: the Digital Omnibus on AI enters into force and moves the high-risk deadlines.
29 July 2026: Germany's act implementing the AI Act enters into force and names the Bundesnetzagentur as the competent supervisory authority.
2 August 2026: transparency duties (Article 50): people must be told when they interact with an AI system.
2 December 2027: high-risk obligations for Annex III systems, including AI in recruiting.

What employers must do as deployers (Article 26)

Use the system according to the provider's instructions for use.
Assign human oversight to people with the competence, training and authority to carry it out.
Make sure the input data you control, such as job criteria, is relevant and sufficiently representative for the purpose.
Monitor the system, and report serious incidents and risks to the provider and the authority.
Keep the logs the system generates for at least six months.
Inform workers' representatives and affected workers before using a high-risk system at the workplace.
Inform candidates that a high-risk AI system is used in decisions about them.
Use the provider's information for your data protection impact assessment under the GDPR.

In addition, people affected by a decision based on a high-risk AI system have a right to an explanation of the role the AI played (Article 86).

What providers must do

The provider, the company that builds the recruiting AI, carries the larger share: a risk management system, data governance, technical documentation, automatic logging, instructions for use, a design that enables human oversight, accuracy and robustness, a conformity assessment, CE marking and registration in the EU database. Ask your provider how far along they are, and for the documents you will need.

Three rules that apply already today

No emotion recognition. Inferring candidates' emotions from their voice or face in interviews is prohibited.
Disclose the AI. Candidates must be told when they are talking to an AI, at the latest at the start of the conversation.
AI literacy. Employers must take measures to support the AI literacy of the staff who use AI systems.

German specifics

GDPR: no decision with legal effect may be based solely on automated processing (Article 22), and AI screening usually requires a data protection impact assessment (Article 35).
Works council: technical systems that can monitor behaviour or performance are subject to co-determination (section 87(1) no. 6 BetrVG), and so are selection guidelines (section 95 BetrVG).
General Equal Treatment Act (AGG): rejected candidates can claim discrimination within two months, so selection decisions must be explainable.

Checklist for employers

List every AI tool used in recruiting and check whether it falls under Annex III.
Make sure no tool analyses candidates' emotions, voice or facial expressions.
Check that candidates are told when they talk to an AI.
Name the people who oversee the AI's results and train them.
Check that a person makes every hiring decision and that it can be explained.
Carry out or update the data protection impact assessment.
Involve the works council early.
Ask your provider for instructions for use and their plan for conformity by 2 December 2027.

How Hurraay handles it

Hurraay is built for these rules: every call starts with an AI disclosure and consent to record, scoring uses the transcript only with no voice or emotion analysis, the AI never rejects a candidate, every rating quotes its evidence, and hosting and AI processing run in the EU. We provide the documentation for your data protection impact assessment. More about Hurraay's AI recruiting software.

FAQ

Is AI in recruiting banned under the EU AI Act?

No. It is high-risk, which means it is allowed with obligations. Only certain practices are banned, such as emotion recognition in the workplace.

When do the rules for recruiting AI apply?

The high-risk obligations apply from 2 December 2027. The ban on emotion recognition and AI literacy apply since 2 February 2025, the duty to disclose AI since 2 August 2026.

Who is responsible, the employer or the software provider?

Both. The provider must build and certify a compliant system. The employer, as deployer, must use it as instructed, oversee it, keep logs and inform candidates and the works council.

Do candidates have to be told that AI is used?

Yes. They must be told when they talk to an AI (Article 50, since 2 August 2026). From 2 December 2027, they must also be told that a high-risk AI system is used in decisions about them.

Recruiting AI that is built for the AI Act.

Start with one role, from €0 a month.

Start for free See pricing