AI in the hiring workflow: What the EU AI act means for global employers

Key takeaways:

• Many employers already use AI in hiring without realising it, because it’s built into ATS platforms, sourcing tools, assessment software and recruitment suppliers’ services.
• Under the EU AI Act, AI that filters, scores, or ranks candidates or even targets job adverts can be high-risk, while narrow procedural tasks such as interview scheduling and CV parsing may be exempt. 
• The Annex III high-risk rules for employment AI apply from 2 December 2027. Before then, employers should take stock of their AI tools, classify each use case, and set up human oversight, logging and processes for informing candidates.

Ask an HR team whether it uses Artificial intelligence (AI) in hiring and the answer is often no. Yet, its applicant tracking system (ATS) may disagree. In fact, AI now sits inside many of the tools employers already rely on, from candidate matching and CV screening to online assessments and interview platforms. While these AI hiring tools save time, they can also shape who’s shortlisted, considered, or rejected.

That’s where EU AI Act recruitment rules come in. Under the Act, AI used for recruitment and selection can be classified as high-risk, particularly when it evaluates, scores or ranks candidates. So rather than asking whether you’ve bought an AI recruitment tool, ask where AI influences access to employment anywhere in your hiring workflow, including through your suppliers.

For global employers, that question reaches well beyond HR’s own software. Recruitment agencies, RPO providers, and assessment vendors may all use AI on your behalf. 

This guide maps where AI in hiring actually operates, explains what the EU AI Act recruitment rules mean in practice, and sets out how to prepare before the high-risk obligations apply in December 2027.

Where is AI already operating in your hiring workflow?

The final hiring decision is only one part of a much longer process. By the time a recruiter selects a candidate, earlier steps may have already shaped who gets considered and who does not. This means employers need to examine the entire process, not just the point where a hiring decision is made.

AI sourcing and job advertising can influence who enters the recruitment funnel

AI can influence a hiring decision before a candidate has even submitted an application. That means AI risk does not begin only when an employer evaluates a CV of a potential hire. In fact, it can affect access to employment opportunities much earlier through different ways: 

• Programmatic job advertising uses data to decide who sees a vacancy or who sees job ads
• Candidate sourcing tools are used across professional networks, job boards, and talent databases for potential candidates
• Matching features recommend profiles and rank talent pools by how closely they fit a role.

The risk is that qualified people are filtered out before they can apply. For example, a sourcing tool might favour candidates with certain qualifications and miss others who’ve built equivalent skills through work experience. Those people may never appear in the recruiter’s search results at all.

Under the EU AI Act recruitment rules, targeted job advertising and candidate sourcing can be classified as high-risk when they materially affect access to employment. The distinction matters because these systems can limit opportunities without directly or formally rejecting an application. 

The key question for employers is this: Does the technology simply help recruiters administratively, or does it materially influence who gains knowledge of and access to the employment opportunity?

CV screening, candidate ranking, and assessments are key high-risk areas

The closer AI gets to evaluating candidate suitability, the more significant the EU AI Act implications become. An ATS that stores CVs is doing filing, but one that decides which CVs matter is doing selection.

The Commission’s employment guidance is explicit here. Systems that analyse candidate information and produce scores, rankings or suitability categories are high-risk when those results materially influence recruitment. Its own example is a job-matching tool that gives recruiters a ‘top five candidates’ list.

Potentially high-risk uses include:

1. CV filtering against job requirements
2. Candidate scoring
3. Automated candidate ranking
4. Automated shortlisting
5. Job matching and skills inference
6. Scoring written or oral assessment responses
7. Personality or competency evaluation
8. Risk scores generated during candidate screening

Say a screening tool sorts applicants into ‘high fit’ and ‘low fit.’ Recruiters can override it, but in practice the ratings decide who progresses. Once a tool compares candidates with requirements and produces scores or rankings, it’s evaluating them. That’s material influence, and a recruiter’s final click doesn’t undo it.

That doesn’t make every ATS high-risk. A tool that simply organises CV details into a searchable database is treated differently from one that matches candidates against job requirements and decides who advances.

Interview tools and hiring decisions: where automation becomes consequential

Not every AI-enabled interview tool creates the same regulatory risk:

• Some only handle logistics, such as scheduling interviews, sending reminders, and organising application data. 
• The Commission’s guidance gives interview scheduling as an example of a narrow procedural task that falls under an exception, because it doesn’t contribute to selecting candidates.

Meanwhile, other AI tools sit much closer to the decision making process:

• They might score interview answers, analyse candidate responses, assess competencies, rank candidates or produce fit scores. 
• Some go further and even recommend who should progress or be rejected, and those recommendations can carry straight through to the final hiring decision.

That’s where errors get expensive. An automated score could mark down a strong candidate whose answer is phrased unusually, or who’s answering in their second language. Video tools that claim to read emotions need particular care. Emotion recognition in the workplace, recruitment included, has been prohibited under the Act since February 2025, apart from limited medical and safety uses.

Whatever the tool, the relevant question is how much influence the system has over the employment decision.

What counts as high-risk recruitment AI under the EU AI Act?

AI does very different jobs across the hiring workflow, and EU AI Act recruitment rules don’t treat them all alike. A high-risk classification doesn’t automatically mean a system is banned. It just means stricter requirements apply to how it’s developed and used.

Why recruitment and selection AI can fall into the high-risk category

The EU AI Act doesn’t classify AI as high-risk simply because HR uses it. It’s about the system’s intended purpose and impact.

Recruitment gets closer attention because there’s a lot riding on it. After all, hiring decisions control access to employment and shape careers and income. Additionally, AI trained on past hiring data can repeat old patterns of discrimination linked to age, gender, or disability, and it processes a lot of personal data along the way. 

Systems that process personal information or rely on historical hiring data can raise privacy concerns and repeat unfair patterns linked to age, gender or disability. These risks can affect people’s fundamental rights, even when a recruiter makes the final decision.

That’s why Annex III, the Act’s list of high-risk use cases, includes AI intended for recruiting or selecting people:

• In practice, that means tools that filter applicants, rank candidates, score applications, assess applicant responses, or otherwise meaningfully influence who’s selected. 
• It also covers some later employment decisions, such as promotion, termination, and task allocation.

However, Article 6 provides limited exceptions for systems that do not pose significant risks or materially influence decisions. But any Annex III system that profiles people stays high-risk. So assess what a system actually does and what it’s intended for. The vendor’s marketing label doesn’t decide its classification.

High-risk vs. procedural AI: the distinction employers need to understand

Two AI features inside the same ATS can have very different regulatory classifications because a feature’s purpose matters more than the platform it sits in.

The European Commission’s draft guidelines illustrate how Annex III and Article 6 exceptions may apply. The guidelines are still in draft and aren’t legally binding. No example settles the classification of a specific product, so check how each tool actually works

AI use	Typical function	Potential AI Act treatment
Candidate ranking	Scores and ranks applicants	High-risk
CV screening	Filters candidates	Potentially high-risk
Assessment scoring	Evaluates applicant responses	Potentially high-risk
Candidate sourcing	Filters or selects prospects	Potentially high-risk
Background-check risk scoring	Profiles candidates to flag risk	High-risk (profiling rules out exceptions)
Interview scheduling	Handles logistics only	Potential procedural exception
CV parsing	Organises information only	Potential procedural exception
Job-ad wording checker	Flags discriminatory language in ad text	Outside the high-risk category

Global employers and organisations should conduct individual use-case assessments rather than classifying a whole platform in one go, especially where software bundles several functions.

HR, Legal and technical teams can then decide which obligations apply to each feature. Recording the findings also means a future software update only triggers a review of the features it changes. Repeat the exercise whenever a vendor adds or upgrades an AI feature, as a ‘minor update’ can move a tool into a different category.

The timeline global employers need to prepare for

Employers have a defined preparation window, but that shouldn’t be read as a reason to delay AI governance. The AI Act applies in stages, and the AI Omnibus (Regulation (EU) 2026/1744) moved the EU AI Act hiring deadlines for high-risk systems from August 2026 to December 2027 (see the Commission’s implementation timeline):

• 1 August 2024: the AI Act entered into force
• 2 February 2025: the prohibited practices and first general provisions began to apply
• 2 August 2025: general-purpose AI obligations began to apply
• 2 August 2026: wider provisions and the enforcement framework became applicable
• 2 December 2027: Annex III high-risk rules, including employment AI, apply
• 2 August 2028: high-risk rules for AI in certain regulated products apply

The extra time only covers the high-risk rules. The prohibitions, including the ban on emotion recognition at work, already apply.

Use 2026–27 to get ready. Start by taking an inventory of AI across your hiring workflow and classifying each use case. Next, review supplier contracts, set up human oversight and prepare logging processes. Then train the teams involved, and reassess vendors whenever their systems change.

What employers need to do when AI influences hiring decisions

Understanding which systems are high-risk and when the rules apply is only one part of the compliance process. Global employers must also ensure these systems are used responsibly and that the necessary safeguards are in place. This requires turning regulatory requirements into practical procedures that HR teams and other stakeholders can follow throughout recruitment.

Human oversight must mean more than adding a recruiter to the workflow

Human oversight is not meaningful if recruiters automatically accept every score or recommendation produced by the system. This is automation bias or trusting AI outputs over your own judgement and without questioning their accuracy. The Act names it as a risk too. Reviewers must understand what a tool measures, its limitations, and when its findings need checking.

Under Article 26 of the EU AI Act: organisations or employers using high-risk AI are generally called “deployers,” even when a supplier owns the technology. As deployers, they must assign oversight to people with suitable competence, training, authority, and support. That means:

• Named reviewers should be able to challenge scores and override recommendations, escalating concerns if any
• Training on the system’s limits and what to do when something looks wrong
• A route for escalating doubtful outputs to HR or Compliance
• Reviews of unusual outcomes, such as a sudden drop in shortlisted candidates from one location
• A documented process showing how reviews work and who signs off

So if a qualified candidate gets an unusually low score because the system misreads their experience, the reviewer needs enough information to investigate. The test is simple: can the human reviewer genuinely change the outcome?

Transparency, monitoring and record keeping need operational processes

AI compliance requires evidence of how a recruitment system is actually being used, not simply a policy stating that the organisation uses AI responsibly. Each duty in Article 26 needs a process behind it:

• Use as instructed: an inventory of systems, their approved uses, and the provider’s instructions for use
• Monitor operation: regular checks on how each system performs in practice
• Keep logs: access and retention rules, with automatically generated logs under your control kept for at least six months unless other law requires otherwise
• Record interventions: a record of each time a reviewer changes or overrides an output
• Handle incidents: a way to pause a system and alert the provider and authorities if it appears to create a risk

Where you control the input data, Article 26 also requires it to be relevant and sufficiently representative for the system’s intended purpose.

Candidates must also be informed when certain high-risk systems make or assist decisions about them. That sits alongside the GDPR, which already applies and brings its own transparency rules, rights around solely automated decisions and, often, a data protection impact assessment. National employment law can add more. Agree upfront who issues notices, keeps records and acts on problems.

Vendor due diligence must cover the entire recruitment technology supply chain

The fact that a third party owns the technology does not make the employer’s governance problem disappear. AI built into a supplier’s platform or service can still influence hiring even if HR never bought AI hiring tools of its own, and the organisation using it may still be a deployer with responsibilities of its own.

Your review should cover ATS platforms, recruitment process outsourcing (RPO) providers, recruitment agencies, sourcing platforms, assessment providers, video-interview tools, background-screening services, job advertising platforms and talent marketplaces.

‘AI-powered’ and ‘AI compliant’ are now commonly used marketing claims, so treat them as the start of the conversation. AI vendor due diligence should ask:

• Where is AI used, and which hiring decisions does it influence?
• Does it rank candidates, and what input data does it use?
• Who oversees outputs, can recommendations be overridden, and how are bias and performance monitored?
• What logs and technical documents are available?
• How are model updates communicated, and which party handles each compliance duty?

If a vendor can’t explain how its tool ranks candidates, you can’t meet your own oversight duties. Build a hiring AI supply-chain register covering each supplier, its AI functions, the decisions affected and the team responsible, not just a list of tools HR bought directly.

How CXC can help global employers build more governed hiring and workforce processes

Managing these responsibilities becomes more complex when recruitment spans several countries and involves multiple suppliers. Different systems, processes and local requirements can make it difficult to maintain consistent oversight. CXC Global’s recruitment and workforce management services can help organisations improve coordination and visibility across their international operations.

Map recruitment workflows across internal teams and external providers

AI governance becomes easier when employers can see every technology, provider, and decision point involved in hiring. Candidates often move between internal recruiters, staffing suppliers, assessment providers, and recruitment platforms. Mapping these handovers shows where AI is used, who reviews its outputs, and which team is accountable.

CXC’s RPO services cover sourcing, screening workflows, candidate communication, recruitment reporting and onboarding coordination, with global and local recruitment support. Our Human+ approach pairs experienced recruiters with technology and AI-powered insights, so you can see where technology supports the process and where people make the calls. That makes it easier to set clear responsibilities and apply the same governance standards across different markets.

It should be noted that recruitment process support is not the same as formal AI Act compliance assessment. Determining whether a particular system is legally high-risk requires input from qualified legal, privacy and technical specialists. CXC can support recruitment governance without replacing these specialised assessments.

Strengthen workforce compliance beyond the recruitment decision

Hiring technology governance is only one part of the wider compliance journey once a worker is selected. Next, you need to confirm how the person should be engaged, whether they have the right to work, and which background checks apply. Those steps vary by country and worker type, which is where inconsistent processes tend to creep in.

CXC Comply supports this work through worker classification, right-to-work verification, background screening, and compliance documentation. It follows the same principle the AI Act applies to hiring tools which is technology backed by people who can check its work. 

Routine checks run efficiently, while cases that need judgement go to compliance experts with country-specific knowledge. The result is audit-ready records and a clearer view of contractor compliance across markets.

For example, two contractors doing similar work in different countries may need different classification assessments and evidence of their right to work. When those checks are linked to the hiring process, missing information surfaces before an engagement starts. Treating recruitment and workforce compliance as connected processes gives you one governance trail, from the first screening decision to the signed contract.

Create consistent hiring governance across countries, suppliers and worker types

Global employers need hiring governance that remains consistent even when recruiters, suppliers, technologies, and legal environments change by market. One country may rely on an internal hiring team, while another uses agencies with their own software and assessments. Without shared standards, it becomes harder to spot gaps in how AI is used or decisions are reviewed.

CXC supports workforce programmes in more than 100 countries, across the full lifecycle. Global RPO and Direct Sourcing help you find talent, and MSP services keep staffing suppliers to agreed standards. CXC Comply, EOR, AOR and contractor management services handle compliant engagement, while global workforce reporting brings it all into one view. Local compliance expertise lets common processes respect local rules, alongside the specialist legal and privacy advice that specific AI Act assessments need.

Explore how CXC can help create more visible, consistent and compliant global recruitment and workforce processes.

FAQs

Does the EU AI Act apply to AI used for recruitment?

Yes, certain AI systems intended for recruitment or selection fall within Annex III of the EU AI Act, which means they can be classified as high-risk. Examples include systems that filter applications, rank candidates or evaluate their suitability. Classification depends on the system’s intended purpose and impact, and on whether an Article 6 exception applies, rather than simply whether a tool contains AI. The Act doesn’t treat every HR tool as high-risk, so employers should assess whether each system materially influences recruitment decisions.

Is AI candidate screening considered high-risk under the EU AI Act?

AI candidate screening can be classified as high-risk when it evaluates, filters, or ranks applicants in ways that materially influence recruitment and hiring decisions. This includes systems that analyse CVs, assign suitability scores or recommend candidates for shortlisting. These functions fall within the recruitment and selection activities identified in Annex III. However, a system that simply extracts or organises candidate information without influencing selection may qualify for a limited exception. Employers should examine how screening results are used and whether recruiters rely on them to decide who progresses. Human review alone does not automatically remove a system from the high-risk category.

Is every AI feature inside an ATS considered high-risk?

No, not every AI feature within an ATS is considered high-risk under the EU AI Act. Classification depends on what the individual function does and whether it materially influences recruitment or selection. A feature that ranks candidates by predicted suitability may fall within the high-risk category, while one that only organises CV information may qualify for an exception. The European Commission also identifies interview scheduling as an example of a narrow procedural task when it does not affect candidate evaluation. Employers should therefore review AI functions separately rather than classifying an entire ATS based on its marketing description. Where the system’s purpose or impact is unclear, further legal and technical assessment may be needed.

What human oversight is required for AI recruitment systems?

Under Article 26 of the EU AI Act, deployers of high-risk recruitment AI systems must assign human oversight to individuals with suitable competence, training, authority, and support. Oversight should allow reviewers to understand system outputs, question recommendations, and intervene where necessary. Simply asking recruiters to approve AI-generated shortlists does not establish meaningful control. Employers should identify responsible reviewers and explain when they must investigate or challenge automated results. Staff should understand the system’s limitations and know how to report concerns or override recommendations. These arrangements help reduce over-reliance on AI and support more accountable recruitment decisions.

Do employers need to tell candidates when AI is used in hiring?

Under Article 26 of the EU AI Act, deployers of certain Annex III high-risk systems that make or assist decisions about people must inform those people that the system is being used. In hiring, that can include AI that supports candidate screening, evaluation or selection. This duty applies once the Annex III rules take effect on 2 December 2027. Other obligations may already apply. The General Data Protection Regulation (GDPR), for example, requires transparency about how personal data is processed and sets rules on solely automated decision-making, and national employment laws can add more. What candidates need to be told depends on the tool and use case, so have notices reviewed by privacy or legal specialists.

Are employers responsible for AI used by recruitment vendors?

Employers cannot assume that outsourcing recruitment technology removes their responsibility to understand how AI affects hiring. AI may operate within an external recruitment provider’s platform, assessment system, or candidate sourcing process. The organisations involved may have different duties depending on whether they act as AI providers, deployers, or hold another role under the EU AI Act. Employers should also establish which systems suppliers use, what decisions those systems influence, and how responsibilities are divided. Vendor due diligence should cover system documentation, oversight arrangements, records, monitoring and contractual obligations. These reviews help organisations identify compliance gaps rather than assuming every requirement rests with the technology supplier.

How can CXC support employers using technology across global hiring?

CXC helps employers improve visibility across international hiring by connecting recruitment, supplier management, and workforce processes. Its Recruitment Process Outsourcing (RPO) services support sourcing, screening, candidate communication, and reporting. Direct Sourcing and Managed Service Provider (MSP) services support talent pools and staffing supplier oversight. Beyond selection, CXC Comply supports worker classification, right-to-work verification, background screening, and compliance documentation. Employer of Record (EOR), Agent of Record (AOR) and contractor management services help organisations engage workers across countries. Together, these services create clearer handovers from recruitment into onboarding and ongoing workforce administration. This connected approach can improve consistency while allowing for local requirements. It can also make gaps in supplier responsibilities and records easier to identify. Specific EU AI Act assessments should still involve qualified legal, privacy, and technical specialists.

---