EU AI Act for HR Technology Companies
For HR tech providers and employers: recruitment AI is high-risk, emotion inference at work is banned, and Scanara supports the work.
Recruitment and worker-management AI can be high-risk
Annex III point 4 covers AI for recruitment and selection (4(a)) and for decisions on work-related relationships, task allocation and performance monitoring (4(b)). The high-risk rules apply from 2 December 2027. Article 5(1)(f) has banned inferring emotions at work and in education since 2 February 2025, with medical and safety exceptions. Next step: check your HR systems against point 4 and Article 5.
What lands on HR tech providers and employers
Providers meet Articles 8 to 15
HR software vendors that provide high-risk systems meet Articles 8 to 15 and the other provider duties of Article 16 from 2 December 2027, unless the Article 6(3) exception applies. A system that profiles natural persons is always high-risk.
Employers are deployers
An employer that uses an HR system is a deployer. It uses the system as instructed, assigns human oversight and keeps logs under its control for at least six months, unless other law provides otherwise. It informs workers’ representatives and affected workers before use (Article 26).
Inferring emotions at work is prohibited
Article 5(1)(f) prohibits AI that infers emotions in the workplace and in education institutions, except for medical or safety reasons. Fines reach EUR 35 million or, for an undertaking, 7% of worldwide annual turnover, whichever is higher (Article 99(3)). The Act does not define “workplace”, so whether it covers job candidates in interviews is open.
What Scanara supports for HR tech providers and employers
Inventory with recorded classification
You register each AI system. Scanara records its risk classification, your reasoning on point 4 and any Article 6(3) assessment. You make the decision.
Prohibited-practice screening
A guided Article 5 screening runs for each registered system, and code rules flag detectable patterns. The judgement on purpose and context stays with you.
Code and document checks
Code rules cover Articles 9, 10, 12, 14 and 15. A document scan checks instructions for use (Article 13) for required content, not for truthfulness.
Deployer assessments
Guided assessments cover deployer duties (Article 26) and the fundamental rights impact assessment (Article 27) for deployers that must perform one, such as public bodies.
Two fine ceilings to know
EUR 35 million or 7%
Ceiling for prohibited practices, such as emotion inference at work: up to EUR 35 million or, for an undertaking, up to 7% of worldwide annual turnover, whichever is higher (Article 99(3)).
EUR 15 million or 3%
Fine ceiling for breaches of provider and deployer duties: up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs and small mid-caps the lower amount is the cap (Article 99(6) and (6a)).
Questions HR teams ask
Is my recruitment AI high-risk?
Yes, if it is intended for the purposes in Annex III point 4(a) or 4(b), unless the Article 6(3) exception applies. A system that profiles natural persons is always high-risk. Point 4 does not name tools such as job-description drafting or shift scheduling; their intended purpose decides.
Is emotion analysis in video interviews allowed?
Check Article 5(1)(f) first. It prohibits AI that infers emotions in the workplace and in education institutions, except for medical or safety reasons. The Act does not define “workplace”, so whether it reaches job candidates is open. Emotion recognition that is not prohibited is high-risk under Annex III point 1(c) where the law permits its use.
What must employers do before using HR AI?
Before using a high-risk system at the workplace, employers inform workers’ representatives and the affected workers (Article 26(7)). Deployers of Annex III systems that make or assist decisions about natural persons also inform those persons that they are subject to the system (Article 26(11)).
Do private employers need a fundamental rights impact assessment?
Not through Annex III point 4 alone. Article 27(1) covers deployers that are bodies governed by public law or private entities providing public services. An employer that is neither is not covered for point 4.
When do the rules apply?
Article 5 applies since 2 February 2025. The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A system placed on the market or put into service earlier is covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
Read next
See a sample scan report
The demo shows a real, anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.