EU AI Act for HR: What Counts as High-Risk in Hiring

Short answer: under the EU AI Act, AI used to recruit or select people (targeted job ads, sorting and filtering applications, evaluating candidates) and AI used to make decisions about people at work is high-risk. Those rules apply from 2 December 2027. Two duties already apply today: emotion recognition at work is banned, and employers that use AI must support their staff's AI literacy.

What the AI Act is, in two sentences

The AI Act is an EU regulation, binding in its entirety and directly applicable in every member state. It bans some uses of AI and treats others as high-risk, with duties for the company that develops the system and puts it on the market under its name (the provider) and the organisation that uses it under its authority (the deployer) (Regulation (EU) 2024/1689, Articles 3 and 113).

An employer that uses an AI tool in its own HR work is a deployer. The supplier that builds the tool is the provider.

What counts as high-risk in hiring and at work

Annex III of the AI Act lists the high-risk uses. Point 4 covers "employment, workers' management and access to self-employment", in two parts (AI Act, Annex III, point 4):

• Recruitment and selection: AI intended to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
• Decisions about people at work: AI intended to make decisions affecting the terms of work relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate people's performance and behaviour.

So a tool that ranks candidates, screens CVs or scores employees is in the high-risk group. A tool that only helps a person write a job ad that the person then reads, edits and publishes is a different case, as the next section shows.

When an HR tool is not high-risk

Article 6(3) says an Annex III system is not high-risk when it does not pose a significant risk of harm to people's health, safety or fundamental rights, including by not materially influencing the outcome of a decision. That applies when the system does one of these (AI Act, Article 6(3)):

• performs a narrow procedural task;
• improves the result of a human activity already completed;
• detects patterns or deviations in earlier decisions, without replacing or influencing the human assessment without proper human review;
• performs a preparatory task to an assessment.

One exception overrides all four: an Annex III system that profiles people is always high-risk. And the provider that decides its system is not high-risk must document that assessment before the system goes on the market (AI Act, Article 6(3) and 6(4)).

Practical step: Ask your supplier. If you use an AI tool in hiring, ask the supplier in writing whether it treats the tool as high-risk under Annex III, and if not, for its Article 6(3) assessment.

What is already banned at work

Since 2 February 2025, the AI Act bans using AI to infer the emotions of a person in the workplace or in education, except for medical or safety reasons (AI Act, Article 5(1)(f) and Article 113). A tool that claims to read a candidate's feelings from a video interview, or an employee's mood from their face or voice at work, falls under this ban.

AI literacy: what employers must do now

Article 4 has applied since 2 February 2025. In its current wording, as amended in July 2026, providers and deployers must take measures to support the development of AI literacy of their staff and others who operate AI on their behalf, taking into account their knowledge, experience and training and the context the AI is used in. The amended text adds that this does not require them to guarantee any specific level of AI literacy of any individual (Regulation (EU) 2026/1744, amending Article 4).

For an HR team, that means training and guidance that fit how your people actually use AI, for example a short session on what the tools can and cannot do and where a person must decide, and a record that you did it.

What an employer must do with a high-risk tool

When the high-risk rules apply, an employer that uses a high-risk AI system must, among other things (AI Act, Article 26):

• use it in line with the provider's instructions for use;
• give human oversight to people who have the competence, training and authority to do it, and the support they need;
• make sure the input data it controls is relevant and sufficiently representative for the purpose;
• monitor how the system works, and tell the provider and the authority and stop using it if it presents a risk;
• before using it at the workplace, inform workers' representatives and the affected workers that they will be subject to it, following the national rules on informing workers.

When the rules apply

The AI Act entered into force on 1 August 2024, twenty days after its publication on 12 July 2024. Its parts apply on different dates, and the Digital Omnibus on AI, published on 24 July 2026 and in force since 27 July 2026, moved the high-risk dates later (AI Act, Article 113; Regulation (EU) 2026/1744, amending Article 113).

From	What applies
2 February 2025	The general provisions, including AI literacy (Article 4), and the bans on certain practices, including emotion recognition at work (Article 5)
2 August 2026	The general date of application of the AI Act
2 December 2027	The rules for high-risk systems listed in Annex III, which include AI in recruitment and at work, and the duties of the employers that use them (Chapter III, Sections 1 to 3)
2 August 2028	The rules for high-risk AI that is part of products covered by the EU laws in Annex I

The later date for high-risk hiring tools gives employers time, not an exemption: the bans and AI literacy apply already, and the duties for high-risk tools follow in December 2027.

A short checklist for HR teams

1. List every tool in your hiring and people processes that uses AI, and what it does.
2. Mark the ones that rank, screen, filter, score or monitor people: those are the ones to look at first.
3. Stop anything that infers emotions at work.
4. Give your team short, practical AI training, and keep a record.
5. Decide who in HR oversees each tool, and make sure a person makes every hiring decision.
6. Plan when and how you will inform worker representatives and staff.

This guide is general information, not legal advice. For your own situation, read the official text or ask a qualified adviser.

Frequently Asked Questions

Is every AI tool used in HR high-risk?

No. The high-risk list covers AI intended for recruitment and selection and for decisions about people at work. A tool that only performs a narrow procedural task or prepares material for a person to assess can fall outside it, unless it profiles people, which is always high-risk.

When do the high-risk rules for hiring tools apply?

From 2 December 2027, after the Digital Omnibus on AI moved the date from 2 August 2026. The ban on emotion recognition at work and the AI literacy duty have applied since 2 February 2025.

Do we have to tell employees before we use a high-risk AI tool?

Yes. An employer that uses a high-risk AI system at the workplace must inform workers' representatives and the affected workers before putting it into use, following national rules on informing workers.

Does AI literacy mean every employee needs a certificate?

No. In its amended wording, Article 4 asks employers to take measures to support the development of AI literacy, and says it does not require any specific level of AI literacy of any individual.

How Settio helps HR teams

Settio, our product for employers and agencies that move people between countries, is built the way this guide describes: its AI shows what it read and why on every document check, passports are read without AI, and a person signs off every case.

For the rest of your HR work, we also set up AI for HR teams and recruitment agencies, built to follow the EU AI Act and GDPR, with a person making every decision. Talk to us.

Sources

2 official sources

• EUR-Lex: Regulation (EU) 2024/1689, the Artificial Intelligence Act
• EUR-Lex: Regulation (EU) 2026/1744, the Digital Omnibus on AI, amending the AI Act