AI in recruitment is the most common way an ordinary company, not a technology vendor, ends up operating a high-risk system under the AI Act. CV screening and candidate evaluation are listed explicitly in Annex III, and emotion recognition of candidates is already prohibited. Here is what that means for HR and how to use AI without breaking the rules.
Tools for AI in recruitment are everywhere, from ATS modules to a recruiter pasting twenty CVs into a public chatbot. The law looks at the use, not the tool: the model that writes a job ad becomes a high-risk system when given a different task. Legal position as of November 2026. This article is for information only and is not legal advice.
Why AI in recruitment is a high-risk use case
Point 4 of Annex III to the AI Act covers employment. It classifies as high-risk, among others, AI systems intended to be used for:
- recruitment or selection of people, in particular placing targeted job advertisements, analysing and filtering job applications, and evaluating candidates (point 4(a)),
- decisions on promotion, termination, task allocation based on individual behaviour or personal traits, and monitoring and evaluating workers (point 4(b)).
Article 6(3) provides an exception for systems that perform a narrow procedural task or merely prepare an assessment made by a human. The exception does not cover systems that profile natural persons, and ranking candidates by fit for a role is profiling in practice. If you want to rely on the exception, you have to document your assessment.
Following Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, obligations for Annex III high-risk systems apply from 2 December 2027 instead of 2 August 2026. That buys time, not an exemption: the GDPR applies in full today, and adapting a hiring process takes months.
What is already prohibited: emotion recognition
Article 5(1)(f) of the AI Act prohibits AI systems that infer the emotions of people in the workplace and in education, except for medical or safety reasons. The ban has applied since 2 February 2025. In its guidelines on prohibited practices, the European Commission reads “workplace” broadly, including the recruitment process. A tool that analyses a candidate’s facial expressions or voice in a recorded interview and scores their “enthusiasm” or “stress” falls within the ban.
The ban covers inferring emotions from biometric data (face, voice). Biometric categorisation to infer, among other things, political opinions, religious beliefs or sexual orientation is also prohibited. If a video interview vendor advertises “personality analysis”, check it before you buy.
Employer obligations as a deployer
An employer using a high-risk system in recruitment is a deployer. Its obligations under the AI Act overlap with the GDPR and employment law. The AI Act requirements below apply from 2 December 2027; the GDPR requirements apply now:
| Obligation | What it means in practice | Basis |
|---|---|---|
| Human oversight | Outputs are reviewed by someone with the competence, training and authority to override the recommendation | AI Act Art. 26(2) |
| Input data quality | Data under your control (e.g. criteria, job descriptions) is relevant and sufficiently representative | AI Act Art. 26(4) |
| Monitoring and incidents | Monitor operation, report serious incidents, suspend use if there is a risk | AI Act Art. 26(5) |
| Logs | Keep automatically generated logs for at least six months, where they are under your control | AI Act Art. 26(6) |
| Informing workers | Inform workers’ representatives and affected workers before putting the system into use at the workplace | AI Act Art. 26(7) |
| Informing candidates | Candidates know an AI system is used in decisions about them, and can ask for an explanation of its role | AI Act Art. 26(11), Art. 86; GDPR Art. 13 |
| DPIA | Assess risks to candidates, using information supplied by the system provider | GDPR Art. 35, AI Act Art. 26(9) |
| No solely automated decisions | Rejecting a candidate must not result solely from automated processing without meaningful human involvement | GDPR Art. 22 |
| Data scope | The system processes no more data than the employer may lawfully request from a candidate | National law (in Poland, Labour Code Art. 22¹) |
Article 4 of the AI Act also requires measures to make staff operating AI systems sufficiently AI-literate. National enforcement is in place too; in Poland, the Act on Artificial Intelligence Systems has been in force since 11 August 2026. For an overview of roles and risk categories, see self-hosted AI and EU compliance: GDPR, the AI Act, NIS2 and DORA.
Safe uses versus high-risk uses
Not every use of AI in HR is high-risk. The key question is whether the system influences which candidate moves forward.
| Use case | Category | Notes |
|---|---|---|
| Drafting job ad text | Minimal risk | Check wording for discrimination. Note: targeting ads at selected groups is Annex III point 4 |
| Scheduling interviews | Minimal risk | Candidate contact data is still covered by the GDPR |
| Chatbot answering candidate questions | Transparency (Art. 50) | Tell candidates they are talking to AI; no candidate assessment |
| CV summary for the recruiter | Depends on use | Without scoring or ranking it may fall under the Art. 6(3) exception; document it |
| Filtering, ranking and scoring candidates | High-risk | Full obligations from 2 December 2027; GDPR Art. 22 applies today |
| Emotion analysis of interview recordings | Prohibited | Art. 5(1)(f), since 2 February 2025 |
Self-hosted models and compliance: what helps and what does not
A model running on your own GPU server in Poland makes several things easier. Candidates’ CVs do not go to an API provider or outside the EEA. You keep the logs yourself, for as long as the AI Act and your retention policy require. The model version changes only when you decide, so results are reproducible and explanations have something to rest on. Staff also stop using personal accounts on public tools (see how to avoid data leaks to public AI tools).
A self-hosted model does not remove any deployer obligation, though. There is also a trap: if a company builds its own candidate assessment tool on a self-hosted LLM and puts it into use, it may become the provider of a high-risk system. Provider obligations then apply as well: a risk management system, data governance, technical documentation, conformity assessment and registration in the EU database. For tasks that do not assess candidates, such as job ads, scheduling or answering questions, a self-hosted model works well. Our guide to self-hosted LLMs for business explains how to set one up.
FAQ: frequently asked questions
Can you use AI to screen CVs in the EU?
Yes, but it is a high-risk use under the AI Act. From 2 December 2027 it requires human oversight, log retention and informing candidates, among other things, and already today a rejection must not be based solely on automated processing (Article 22 GDPR).
Is analysing candidates’ emotions in video interviews legal?
No. Inferring emotions from faces or voices in the workplace has been prohibited since 2 February 2025, and the European Commission includes recruitment in that concept. The only exceptions are medical and safety reasons.
Do you have to tell candidates that AI is used in recruitment?
Yes. The GDPR requires information on how data is processed, and from 2 December 2027 the AI Act requires deployers of high-risk systems to inform the people subject to decisions. From that date candidates can also ask for an explanation of the system’s role in the decision (Article 86).
When do AI Act rules on recruitment apply?
The ban on emotion recognition and the AI literacy obligation have applied since 2 February 2025. Obligations for Annex III high-risk systems, including recruitment tools, apply from 2 December 2027.
Want to put rules for AI in HR in place before an audit does it for you? A vCISO can help you build an AI system register, a DPIA and an AI use policy. Contact us, and if you want to run a model on your own infrastructure, we will size the hardware too.