Most HR software now has AI built in: CV screening, candidate ranking, interview analysis, chatbots, performance analytics. Under the EU AI Act, many of these uses count as high-risk, with strict obligations for both the companies that build the tools and the employers that use them. In July 2026 the EU postponed those high-risk obligations to December 2027, but some rules for AI at work already apply, and the rest need preparation. This guide explains what’s high-risk in HR, what’s already banned, and what HR teams should be doing now.
The timeline, after the 2026 changes
The AI Act (Regulation (EU) 2024/1689) applies in stages. The “Digital Omnibus on AI” (Regulation (EU) 2026/1744), in force since 27 July 2026, moved several of the later dates. The ones that matter for HR:
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices are banned, including emotion recognition in the workplace |
| 2 August 2025 | Penalty rules and national enforcement structures apply |
| 2 August 2026 | Most transparency duties apply, e.g. telling people when they’re interacting with an AI system such as a chatbot |
| 2 December 2026 | Machine-readable marking of AI-generated content applies (moved from August 2026) |
| 2 December 2027 | High-risk obligations for Annex III systems apply, including employment and HR (moved from August 2026) |
Fifteen months sounds like a lot. But for a vendor, meeting the high-risk requirements means rebuilding documentation, testing and logging. For an employer, it means knowing which tools you use, changing how decisions are made, and consulting employee representatives. Neither is quick.
Already banned at work
Since February 2025, the AI Act has prohibited several practices outright. Two are directly relevant to HR:
- Emotion recognition in the workplace, except for medical or safety reasons. Tools that claim to read a candidate’s “enthusiasm” from facial expressions in a video interview, or an employee’s mood from their voice on calls, fall into this category.
- Biometric categorisation that infers sensitive traits, such as race, political opinions, trade union membership, religious beliefs or sexual orientation, from biometric data.
These carry the Act’s highest fines: up to €35 million or 7% of worldwide annual turnover, whichever is higher. If a video-interview or call-analytics tool in your stack does anything like this, switch the feature off now. Don’t wait for 2027.
What counts as high-risk in HR
Annex III of the Act lists employment as a high-risk area. Point 4 covers two groups of AI systems:
- systems “intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”;
- systems “intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships”.
In practice:
| HR use of AI | Likely classification |
|---|---|
| Ranking or shortlisting CVs | High-risk |
| Scoring candidates in assessments or interviews | High-risk |
| Targeting job ads at particular audiences | High-risk |
| Recommending promotions, pay changes or dismissals | High-risk |
| Allocating shifts or tasks based on individual behaviour or traits | High-risk |
| Monitoring or scoring employee performance or behaviour | High-risk |
| Reading emotions from faces or voices at work | Prohibited |
| An HR chatbot answering policy questions | Not high-risk, but people must be told it’s AI |
| Drafting job descriptions with a writing assistant | Generally not high-risk (still worth a bias check) |
| Scheduling interviews on a calendar | Generally not high-risk |
The narrow exception, and its limit
Article 6(3) allows a system in an Annex III area to fall outside the high-risk rules if it doesn’t pose a significant risk. For example, if it only performs a narrow procedural task, improves the result of work a human has already completed, or does preparatory work for a human assessment. The provider has to document that reasoning.
There is one important limit: a system that profiles individuals is always high-risk. Most AI in recruitment and performance management works by profiling people, so HR teams shouldn’t assume the exception applies. Ask the vendor for its written assessment.
Provider or deployer: which one are you?
The Act splits obligations between the provider (whoever develops the system and puts it on the market under its name) and the deployer (whoever uses it in their own work). An employer using an AI screening tool is normally a deployer.
But you can become a provider without meaning to. Under Article 25, that happens if you put your own name or trademark on a high-risk system, make a substantial modification to it, or use a general tool for a high-risk purpose it wasn’t intended for. Building your own CV-ranking script on top of a general-purpose AI model, for example, can turn an HR team into a provider, with the provider’s much heavier obligations.
What employers (deployers) must do
From December 2027, an employer using a high-risk HR system must, among other things:
- Use it according to the provider’s instructions, and within its intended purpose (Article 26(1)).
- Assign human oversight to people who have the competence, training and authority to override the system (Article 26(2)). A recruiter who clicks “approve” on every AI shortlist is not oversight.
- Make sure input data is relevant and sufficiently representative, as far as the employer controls it (Article 26(4)).
- Monitor the system, and suspend it and inform the provider if it presents a risk (Article 26(5)).
- Keep the logs the system generates for at least six months (Article 26(6)).
- Inform workers’ representatives and affected workers before putting a high-risk system into use at the workplace (Article 26(7)).
- Tell candidates and employees when they’re subject to decisions made or assisted by a high-risk system (Article 26(11)).
- Use the provider’s information when doing a data protection impact assessment under the GDPR (Article 26(9)).
People affected by a decision based on a high-risk system’s output also get a right to an explanation of the system’s role in that decision (Article 86). And the GDPR hasn’t gone away: Article 22 still restricts decisions based solely on automated processing that significantly affect people.
What vendors (providers) must do, and what to ask them
Providers of high-risk systems carry the heaviest load: a risk management system, data governance for training data, technical documentation, automatic logging, clear instructions for use, human-oversight features, accuracy and cybersecurity requirements, a quality management system, a conformity assessment, CE marking, and registration in the EU database.
You don’t need to audit all of that yourself. But these questions will quickly show whether a vendor is preparing:
- Which features of your product use AI, and which do you classify as high-risk under Annex III?
- If you consider a feature not high-risk under Article 6(3), can we see the documented assessment?
- What is your plan and timeline for conformity assessment and registration before 2 December 2027?
- What data was the model trained on, and how do you test for bias across sex, age, nationality and disability?
- What human-oversight controls does the product provide? Can a reviewer see why a candidate was ranked where they were?
- What logs does the system keep, for how long, and can we export them?
- Does any feature analyse facial expressions, voice or other biometric signals? (If yes: which, and why?)
- Will you provide the instructions for use and information we need for our DPIA and our notice to workers?
- Can AI features be switched off individually without losing the rest of the product?
A practical plan for the next 15 months
Now: find and stop the banned uses
- List every tool in your HR stack: applicant tracking, assessment platforms, video interviewing, HRIS, performance and engagement tools, workforce scheduling. Include features vendors have switched on in recent updates.
- For each, note which features use AI and what they do.
- Switch off anything that recognises emotions or infers sensitive traits from biometric data.
- Make sure any HR chatbot tells people it’s an AI.
Over the next six months: classify and question
- Classify each AI feature using the table above.
- Send the vendor questions to every provider of a likely high-risk feature.
- Check whether any in-house scripts or workflows built on general AI tools could make you a provider.
- Build AI requirements into procurement, so every new contract covers them.
Before December 2027: change how decisions are made
- Define who provides human oversight for each high-risk system, and train them.
- Write the notices for candidates and employees, and plan the consultation with workers’ representatives (national law may require formal consultation too).
- Set up log retention for at least six months, and a process for handling explanation requests.
- Update your DPIAs using the vendor’s documentation.
- Retire or replace tools whose vendors can’t show a credible compliance plan.
A note on AI literacy
The original Act required providers and deployers to ensure their staff had sufficient AI literacy. The 2026 Omnibus softened that duty, giving the Commission and member states a bigger role in promoting AI literacy. Even so, training the people who use AI in HR decisions remains sensible. Effective human oversight, which is still required, is impossible without it.
How this connects to pay transparency
AI tools that recommend pay, promotions or bonuses are high-risk under the AI Act, and their outputs also feed into the gender pay gap reporting required by the EU Pay Transparency Directive. If an algorithm contributes to an unexplained pay gap, both regimes apply. See our guide to the Pay Transparency Directive for what that reporting involves.
Sources and further reading
- EUR-Lex: Regulation (EU) 2024/1689 (AI Act), full text
- European Commission: AI Omnibus enters into force
- AI Act Explorer: Annex III, high-risk AI systems
- Morgan Lewis: EU approves delays and other amendments to the AI Act
This article is general information, not legal advice. Guidance from the European Commission and national authorities is still being published, and national employment law may add consultation or information requirements. Confirm your obligations with legal counsel. Status as of September 2026.