--- title: "AI in HR and Recruitment | Pitch" description: "Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the…" url: https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI in HR and Recruitment Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Employment is one of the areas the AI Act treats most strictly, because AI decisions can shape a person's livelihood. Two rules matter. ### Prohibited: emotion recognition at work Article 5(1)(f) of Regulation (EU) 2024/1689 prohibits AI systems that infer the emotions of a person in the workplace or in education, except for medical or safety reasons. The ban has applied since 2 February 2025. A video interview tool that scores a candidate's facial expressions or tone to infer mood or enthusiasm falls under it. ### High-risk: Annex III, point 4 Annex III lists as high-risk the AI systems intended to be used for: - recruitment or selection of persons, in particular to place targeted job advertisements, to analyse and filter applications and to evaluate candidates; - decisions affecting the terms of work-related relationships, promotion or termination; - allocating tasks based on individual behaviour or personal traits; and - monitoring and evaluating the performance and behaviour of persons in such relationships. Under Article 6(3), a system in that list is not high-risk if it does not pose a significant risk to health, safety or fundamental rights, for example because it only performs a narrow procedural or preparatory task. The provider must document that assessment, and a system that profiles natural persons is always high-risk. Do not assume the exception applies to a tool that ranks people. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the application date for Annex III high-risk systems from 2 August 2026 to 2 December 2027. The prohibitions and the AI literacy duty already apply. Check the [timeline](https://www.pitch.law/academy/ai-act-compliance-timeline) before acting on any date. ### Employer duties as deployer An employer using a high-risk HR system is a [deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). Article 26 requires it to: - use the system in accordance with the instructions for use; - assign human oversight to people with competence, training and authority; - ensure that input data under its control is relevant and representative; - monitor the system and keep the automatically generated logs for at least six months; - inform workers' representatives and the affected workers before putting the system into use at work; and - inform persons subject to decisions that the system is used (Article 26(11)). A person affected by a decision based on a high-risk system's output that has legal or similarly significant effects has a right to a clear explanation of the system's role (Article 86). An employer that substantially modifies a system, or puts its own name on it, may become a provider (Article 25). ### National labour law and the GDPR The AI Act does not replace labour law, and member states may keep or introduce rules that are more favourable to workers. Information and consultation duties towards works councils and rules on monitoring employees differ per country. Check the national rules, including collective agreements, where you employ people. The GDPR runs in parallel: a lawful basis for processing candidates' data, transparency, a DPIA for systematic evaluation (Article 35), and the ban on decisions based solely on automated processing with significant effects (Article 22). The Court of Justice held in _SCHUFA_ (C-634/21) that even producing a score on which a third party strongly relies can amount to an automated decision. The fundamental rights impact assessment of Article 27 applies to public bodies, private bodies providing public services and some credit and insurance uses, not to private employers in general. A DPIA, however, is often needed. See [the AI Act and the GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ## In practice A retailer buys a recruitment platform that ranks applicants against the job profile and suggests who to invite. Because it ranks and filters candidates, it is high-risk. The retailer asks the vendor for the instructions for use and confirmation of the provider's own obligations, appoints two recruiters to review every rejection recommendation, tells candidates in the job posting that AI supports screening, informs the works council, and carries out a DPIA. It stops using an add-on that scores video interviews for enthusiasm, because that infers emotions. ## Frequently asked questions ### Is a CV parser always high-risk? Not necessarily, but if it filters or ranks candidates it is within Annex III. A tool that only extracts text into fields may fall under the Article 6(3) exception, with documented reasoning. ### Does the AI Act apply to small employers? Yes. There is no size threshold for the high-risk rules. ### Can we let the tool decide automatically who is rejected? This is risky under both the GDPR (Article 22) and the AI Act's human oversight rule. Keep a person with real authority in the loop. ### Who is liable if the vendor's system is biased? Both can be. The provider must design and test for bias, and the employer must use the system correctly and oversee it. Contract terms allocate recourse between them. ## How this connects Our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) service covers HR tools alongside the rest of your AI estate. [Our AI Act register](https://www.pitch.law/technologies/ai-act-governance-toolkit) classifies each system and records obligations by role, and [our DPIA tool](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) supports the impact assessment that recruitment tools usually need. See also [building an AI governance framework](https://www.pitch.law/academy/building-an-ai-governance-framework). ## In short - Which HR uses are high-risk or prohibited - What employers must do as deployers - Information of workers and works councils - How the GDPR applies to the same tools ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)