The EU AI Act and your hiring stack: what actually applies

Systems used for recruitment and selection are classified as high-risk under the EU AI Act. A lot of the published commentary addresses vendors. The obligations that land on employers deploying these systems get less attention, and they are the ones most of our clients have to act on.

If you deploy a high-risk system, you are required to use it in line with the provider's instructions, assign human oversight to someone with the competence and authority to act on what they see, keep logs, and inform candidates that an automated system is in use. Meaningful human oversight is the requirement most commonly failed in practice — a reviewer who rubber-stamps a ranked list is not oversight.

You also need to be able to explain, to an individual candidate who asks, the role the system played in a decision affecting them. If your vendor cannot give you that explanation, you cannot give it either, and the obligation is still yours.

Practical steps we recommend: inventory every tool in the funnel including the ones procurement did not buy, get written confirmation of conformity from each vendor, name the person accountable for oversight of each system, and write the candidate-facing notice before you need it.

None of this is a reason to avoid automation. It is a reason to be able to describe what your automation does — which, in our experience, is a useful exercise regardless of what any regulator requires.