EU AI Act Compliance for HR Tech

EU AI Act compliance for HR technology and AI-powered hiring systems, covering high-risk obligations and bias requirements.

Updated 22 October 2026

AI for recruitment and workers’ management can be high-risk under Annex III point 4.

From 2 December 2027, providers of high-risk systems must meet Articles 8 to 15 (Article 113(c)(i)). Employers have the deployer duties of Article 26; older systems: Article 111(2). Since 2 February 2025, Article 5(1)(f) prohibits AI that infers emotions in workplaces and education institutions, with medical and safety exceptions. Fines reach EUR 15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: check HR systems against Annex III point 4 and Article 5.

HR technology can be high-risk through Annex III point 4

The Act has no category called HR technology. What counts is the use listed in Annex III point 4, “Employment, workers’ management and access to self-employment”.

Point 4(a): recruitment and selection

AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.

Point 4(b): work-related relationships

AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships.

An exception exists, and it never covers profiling
An Annex III system is not high-risk if it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The derogation applies only where any one of the four conditions in Article 6(3), points (a) to (d), is fulfilled. A system that performs profiling of natural persons is always high-risk. A provider that considers its system not high-risk must document the assessment before placing it on the market or putting it into service (Article 6(4)). The Commission was to provide guidelines with practical examples by 2 February 2026 (Article 6(5)).
The four conditions of Article 6(3)
The derogation applies where any one of these conditions is fulfilled, except for systems that perform profiling: (a) the system is intended to perform a narrow procedural task; (b) it is intended to improve the result of a previously completed human activity; (c) it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; (d) it is intended to perform a preparatory task to an assessment relevant for the use cases listed in Annex III.

Prohibited practices to check first, for example

Article 5 applies from 2 February 2025, except points (ba) and (bb) and paragraphs (1a) and (1b), which apply from 2 December 2026 (Article 113(a)). The list below is not complete; Article 5 has further prohibitions.

Emotion inference at work: Article 5(1)(f)
The Act prohibits placing on the market, putting into service for this specific purpose, or using AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended to be put in place or into the market for medical or safety reasons. The Act does not define “workplace”. Whether the ban reaches job candidates in video interviews is a question of interpretation that this page does not settle.
Biometric categorisation by sensitive traits: Article 5(1)(g)
The Act prohibits biometric categorisation systems that categorise individually natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. The prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images, based on biometric data or categorizing of biometric data in the area of law enforcement.
Social scoring: Article 5(1)(c)
The Act prohibits AI systems for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, where the social score leads to detrimental or unfavourable treatment in social contexts unrelated to the contexts in which the data was originally generated or collected, or to detrimental or unfavourable treatment that is unjustified or disproportionate to their social behaviour or its gravity.
Emotion recognition that is not prohibited
Emotion recognition systems and biometric categorisation systems that are not prohibited are not exempt from the Act. Annex III point 1(b) and (c) list biometric categorisation according to sensitive or protected attributes or characteristics, and emotion recognition, as high-risk in so far as their use is permitted under relevant Union or national law. Deployers of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it of its operation and process the personal data in accordance with data protection law (Article 50(3)). An emotion recognition system identifies or infers emotions or intentions of natural persons on the basis of their biometric data (Article 3, point 39).

Who must do what: provider and employer

The software developer is the provider, the employer using it is a deployer
The provider is the natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3, point 3). Providers of high-risk systems must ensure that the systems comply with the requirements of Section 2, Articles 8 to 15 (Article 16(a)). A deployer is a natural or legal person, public authority, agency or other body using an AI system under its authority, except in the course of a personal non-professional activity (Article 3, point 4). An employer that uses an HR system is a deployer with the duties of Article 26. A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to it, or changes the intended purpose of a system so that it becomes high-risk (Article 25(1)).
Provider steps before the market
Before placing on the market or putting into service a high-risk system listed in Annex III (except point 2), the provider registers itself and the system in the EU database (Article 49(1)). For systems referred to in points 2 to 8 of Annex III, the provider follows the conformity assessment procedure based on internal control (Annex VI), which does not provide for the involvement of a notified body (Article 43(2)). A provider that has concluded that its Annex III system is not high-risk under Article 6(3) documents the assessment (Article 6(4)) and registers itself and the system in the EU database before placing it on the market or putting it into service (Article 49(2)).
Employer duties as deployer
Deployers of high-risk systems take appropriate technical and organisational measures to use them in accordance with the instructions for use (Article 26(1)), assign human oversight to natural persons with the necessary competence, training and authority (Article 26(2)), monitor the operation of the system on the basis of the instructions for use (Article 26(5)) and keep the logs under their control for at least six months, unless other law provides otherwise (Article 26(6)). Employers inform workers’ representatives and the affected workers before using the system at the workplace (Article 26(7)), where applicable in accordance with Union and national rules and procedures on information of workers and their representatives. Deployers of Annex III systems that make or assist in making decisions related to natural persons inform those persons that they are subject to the system (Article 26(11)). Affected persons have a right to an explanation in the cases described in Article 86(1). Providers and deployers of AI systems also take measures to support the AI literacy of their staff and other persons dealing with the operation and use of the systems on their behalf; this does not require them to guarantee any specific level of AI literacy of any individual (Article 4(1)).
Public employers have further duties
Deployers that are public authorities, or Union institutions, bodies, offices or agencies, comply with the registration obligations of Article 49 (Article 26(8)). Before deploying a high-risk system referred to in Article 6(2), with the exception of systems in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or private entities providing public services, perform an assessment of the impact on fundamental rights (Article 27(1)). An employer that is neither a body governed by public law nor a private entity providing public services is not covered by Article 27(1) for Annex III point 4.

Key dates

2 February 2025

Article 5 applies, including the ban in point (f) on inferring emotions in the areas of workplace and education institutions (Article 113(a)).

2 August 2026

Article 50 applies, including Article 50(3) for deployers of emotion recognition and biometric categorisation systems (Article 113).

2 December 2027

The requirements and obligations of Chapter III, Sections 1 to 3, with the exception of Article 6(5), apply to systems classified as high-risk under Article 6(2) and Annex III (Article 113(c)(i)).

2 August 2030

Providers and deployers of high-risk systems intended for use by public authorities must take the necessary steps to comply by this date (Article 111(2)). Other systems placed on the market or put into service before 2 December 2027 are covered only if they are subject to significant changes in their design as from that date.

Fines

Non-compliance with Article 5 is fined up to EUR 35 million or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)). Non-compliance with the obligations of providers (Article 16), deployers (Article 26) and the transparency obligations of Article 50 is fined up to EUR 15 million or, for an undertaking, up to 3%, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is up to the lower of the percentage or the amount (Article 99(6)); for small mid-cap enterprises (Article 3(14b)) the same applies to the fines of Article 99(4) and (5) (Article 99(6a)). Each Member State lays down to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)). The penalty rules of Chapter XII apply from 2 August 2025, except Article 101 (Article 113(b)).

A selection of requirements, article by article (not complete)

Art. 9
Risk management system
A risk management system is established, implemented, documented and maintained as a continuous iterative process across the lifecycle (Article 9(1) and (2)).
Art. 10
Data and data governance
Training, validation and testing data sets meet the quality criteria and are subject to data governance practices that include examination for possible biases (Article 10(2) to (4)).
Art. 12
Record-keeping
High-risk systems technically allow for the automatic recording of events (logs) over the lifetime of the system (Article 12(1)).
Art. 13
Transparency and information to deployers
Operation is sufficiently transparent for deployers to interpret the output and use it appropriately, and instructions for use accompany the system (Article 13(1) to (3)).
Art. 14
Human oversight
Systems are designed so that natural persons can effectively oversee them while they are in use (Article 14(1)).
Art. 15
Accuracy, robustness and cybersecurity
Systems achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently in those respects throughout their lifecycle; accuracy levels and metrics are declared in the instructions for use (Article 15(1) and (3)).
Art. 26
Obligations of deployers
Deployers use the system in accordance with the instructions for use, assign human oversight, monitor operation on the basis of the instructions for use, keep the logs under their control and inform persons subject to decisions (Article 26(1), (2), (5), (6) and (11)). Employers inform workers’ representatives and affected workers, where applicable in accordance with Union and national rules and procedures on information of workers and their representatives (Article 26(7)).
Art. 50
Transparency obligations
Providers ensure that AI systems intended to interact directly with natural persons inform those persons that they are interacting with an AI system, unless this is obvious (Article 50(1)). Deployers of emotion recognition or biometric categorisation systems inform the persons exposed to them (Article 50(3)).

Common questions: high-risk systems, emotion analysis, informing workers, dates and fines

Which HR AI systems are high-risk?

Systems intended to be used for the purposes listed in Annex III point 4(a) and (b), unless the exception of Article 6(3) applies. A system that performs profiling of natural persons is always high-risk. Annex III point 4 does not name tools such as job-description drafting, shift scheduling or HR chatbots; whether a tool falls under it depends on its intended purpose. A chatbot that interacts directly with people has the disclosure duty of Article 50(1).

Is emotion analysis in video interviews allowed?

Check Article 5(1)(f) first. It prohibits AI systems that infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended to be put in place or into the market for medical or safety reasons. The Act does not define “workplace”, and whether it reaches job candidates in interviews is a question of interpretation that the Act does not answer. Emotion recognition that is not prohibited is listed as high-risk in Annex III point 1(c) in so far as its use is permitted under Union or national law, and deployers must inform the persons exposed (Article 50(3)).

Must an employer tell workers about an HR AI system?

Before putting into service or using a high-risk system at the workplace, employers must inform workers’ representatives and the affected workers (Article 26(7)), where applicable in accordance with Union and national rules and procedures on information of workers and their representatives. Deployers of Annex III systems that make decisions or assist in making decisions related to natural persons must also inform those persons that they are subject to the system (Article 26(11)). Member States may keep or introduce rules more favourable to workers (Article 2(11)).

When do the rules apply?

Article 5 applies from 2 February 2025, except points (ba) and (bb) and paragraphs (1a) and (1b), which apply from 2 December 2026 (Article 113(a)). The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A high-risk system placed on the market or put into service before that date is covered only if it is subject to significant changes in its design as from that date. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

What are the fines, and are they lower for small companies?

Breaches of Article 5 are fined up to EUR 35 million or, for an undertaking, up to 7% of worldwide annual turnover, whichever is higher (Article 99(3)). Breaches of provider duties (Article 16), deployer duties (Article 26) and Article 50 are fined up to EUR 15 million or, for an undertaking, up to 3%, whichever is higher (Article 99(4)). For SMEs, including start-ups, each fine is up to the lower of the percentage or the amount (Article 99(6)); small mid-cap enterprises (Article 3(14b)) have the same cap for the fines of Article 99(4) and (5) (Article 99(6a)). Each Member State lays down to what extent fines may be imposed on public authorities (Article 99(8)).

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.

See how Scanara scans your repos