What does the EU AI Act require for employers using AI in recruitment?

Prepare the employer's responsibilities

For an in-scope high-risk use, plan how to follow the supplier's instructions, assign people with the competence and authority to oversee the system, monitor performance and retain logs under your control. Article 26 includes information duties for affected workers and their representatives, and for individuals subject to relevant AI-assisted decisions. Human oversight must be capable of changing the outcome, with an escalation route when a ranking or recommendation appears unreliable.

Avoid importing provider duties wholesale

A private employer does not automatically have to perform the provider's conformity assessment or register itself in the EU database just because it buys recruitment AI. Public-authority deployers have particular registration duties. An employer may acquire provider duties if it rebrands or substantially modifies a system or changes its intended purpose in the circumstances set out by the Act. Assess that separately. Review GDPR Article 22 where decisions are solely automated and legally or similarly significant, including its exceptions and safeguards.

Reviewed 4 October 2026. Sources: Commission AI Act overview and timetable, classification, deployer duties, literacy guidance and AI Office of Ireland.