Skip to main content

Article 13 Transparency for HR Tech AI — EU AI Act

How Article 13 of the EU AI Act applies to HR technology: instructions for use, who informs candidates and workers, provider and employer roles, dates and fines.

Providers of high-risk HR-technology AI must make systems transparent enough for deployers to interpret their output (Article 13).

HR technology is not a category in the Act. Systems in Annex III point 4 (employment and workers’ management), for example CV filters, are high-risk (Article 6(2)). An exception exists (Article 6(3)). The rules apply from 2 December 2027 (Article 113(c)(i)). Fines reach EUR 15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: check your instructions for use against the list in Article 13(3).

Article 13 has no HR-specific rule: the same transparency duties apply to every high-risk system

Article 13 addresses deployers, such as employers. It names no accuracy metric and no fairness metric.

  • Transparency to interpret the output

    High-risk systems must be designed so that their operation is sufficiently transparent for deployers to interpret the output and use it appropriately (Article 13(1)).

  • Instructions for use

    Instructions in an appropriate digital format or otherwise must contain concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers (Article 13(2)).

  • Provider, purpose, accuracy and risks

    Article 13(3) says the instructions contain at least these items. The instructions state the provider’s identity and contact details (Article 13(3)(a)). They describe the system’s intended purpose, characteristics, capabilities and limitations. They give the level of accuracy, with its metrics, robustness and cybersecurity against which the system was tested and validated. They list known or foreseeable circumstances that may lead to risks to health, safety or fundamental rights (Article 13(3)(b)(i) to (iii)).

  • Explanation, groups, data, changes, oversight and maintenance

    The same list continues in Article 13(3). Where applicable, the instructions describe the technical capabilities to explain the output and the information to interpret it (point (b)(iv) and (vii)). When appropriate, they give the performance for specific persons or groups, and the specifications for input data or the data sets used (point (b)(v) and (vi)). They list changes pre-determined at the initial conformity assessment, if any (point (c)). They describe the human oversight measures, and the hardware needed, the expected lifetime and the maintenance (points (d) and (e)). Where relevant, they describe how deployers collect, store and interpret logs (point (f)).

HR technology can be high-risk through Annex III point 4

The Act has no category called HR technology. What counts is the use listed in Annex III point 4, “Employment, workers’ management and access to self-employment”.

  • Point 4(a): recruitment and selection

    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.

  • Point 4(b): work-related relationships

    AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships.

  • An exception exists, and it never covers profiling

    An Annex III system is not high-risk if it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The derogation applies only where any one of the four conditions in Article 6(3), points (a) to (d), is fulfilled. A system that performs profiling of natural persons is always high-risk. A provider that considers its system not high-risk must document the assessment before placing it on the market or putting it into service (Article 6(4)). The Commission was to provide guidelines with practical examples by 2 February 2026 (Article 6(5)).

  • The software developer is the provider, the employer using it is a deployer

    The provider is the natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3, point 3). Providers of high-risk systems must ensure that the systems comply with the requirements of Section 2, Articles 8 to 15 (Article 16(a)). A deployer is a natural or legal person, public authority, agency or other body using an AI system under its authority, except in the course of a personal non-professional activity (Article 3, point 4). An employer that uses an HR system is a deployer with the duties of Article 26. A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to it, or changes the intended purpose of a system so that it becomes high-risk (Article 25(1)).

  • Dates, older systems and what the Act excludes

    The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A high-risk system placed on the market or put into service before that date is covered only if it is subject to significant changes in its design as from that date. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)). The Act does not apply to areas outside the scope of Union law (Article 2(3)), to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before a system is placed on the market or put into service; testing in real-world conditions is not excluded (Article 2(8)). It does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Article 2(10)). AI systems under free and open-source licences are outside it unless placed on the market or put into service as high-risk systems or as systems under Article 5 or 50 (Article 2(12)).

  • Candidates and workers affected by decisions are informed under other articles

    Article 13 does not oblige anyone to inform candidates or workers. Deployers of Annex III high-risk systems that make decisions or assist in making decisions related to natural persons must inform those persons that they are subject to the use of the system (Article 26(11)). A person subject to a decision taken by the deployer on the basis of the output of an Annex III system (except point 2), which has legal effects or similarly significantly affects the person in a way they consider to have an adverse impact on their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision (Article 86(1)). This applies only to the extent the right is not otherwise provided for under Union law (Article 86(3)).

  • Employers inform workers’ representatives and affected workers

    Before putting into service or using a high-risk AI system at the workplace, deployers who are employers must inform workers’ representatives and the affected workers that they will be subject to the use of the system. This information is provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives (Article 26(7)).

What the Act leaves open

  • No required accuracy or fairness metric

    The Act names no accuracy metric and no fairness metric. The instructions must state the level of accuracy and its metrics against which the system was tested and validated (Article 13(3)(b)(ii) and Article 15(3)). When appropriate, they state the system’s performance regarding specific persons or groups of persons on which it is intended to be used (Article 13(3)(b)(v)).

  • The Act names no standard; harmonised standards and guidelines exist

    The Act itself names no standard for transparency. It asks for the generally acknowledged state of the art to be taken into account (Article 8(1)). High-risk systems in conformity with harmonised standards whose references are published in the Official Journal are presumed to conform with the Section 2 requirements those standards cover (Article 40(1)). The Commission is to develop guidelines on the application of the requirements in Articles 8 to 15 (Article 96(1)(a)). Any other standard a provider uses is a voluntary design choice.

Example: what the instructions for a CV-screening tool could say

These are examples, not requirements.

  • Example: performance by group (Article 13(3)(b)(v))

    Where appropriate, the instructions state how the tool performs for the groups of applicants on which it is intended to be used, for example by language of the application.

  • Example: oversight and logs (Article 13(3)(d) and (f))

    The instructions describe how a recruiter reviews and can override a ranking, and how the employer collects, stores and reads the tool’s logs.

Common questions: metrics, notices to candidates, dates and fines

Must the instructions state a fairness metric?

The Act names no metric. The instructions must state the level of accuracy and its metrics against which the system was tested and validated (Article 13(3)(b)(ii) and Article 15(3)). When appropriate, they state its performance regarding specific persons or groups of persons on which the system is intended to be used (Article 13(3)(b)(v)).

Must candidates be told that AI was used?

Article 13 does not require it. Deployers of Annex III high-risk systems that make decisions or assist in making decisions related to natural persons must inform those persons that they are subject to the use of the system (Article 26(11)). Employers must inform workers’ representatives and the affected workers before using a high-risk system at the workplace (Article 26(7)), where applicable in accordance with Union and national rules and procedures on information of workers and their representatives. Article 50(1) separately requires providers to design systems that interact directly with natural persons so that these are informed they are interacting with an AI system, unless this is obvious.

When do the Article 13 rules apply to HR technology?

The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A high-risk system placed on the market or put into service before that date is covered only if it is subject to significant changes in its design as from that date. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

What are the fines, and are they lower for small companies?

Article 16 sets the provider duties, which include compliance with the requirements of Articles 9 to 15. Breaches are fined up to EUR 15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, and small mid-cap enterprises (Article 3(14b)), each fine is up to the lower of the two amounts (Article 99(6) and (6a)). The turnover percentage applies if the offender is an undertaking (Article 99(4)). Each Member State lays down to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).

Read next: the article for all sectors, the HR technology overview and related guides

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.