The EU AI Act and Recruitment: What Employers Must Do, and When

Is AI used in recruitment high-risk?

Yes. AI used to recruit or select people is high-risk under Annex III of the EU AI Act. After the Digital Omnibus on AI (Regulation (EU) 2026/1744), the main high-risk duties apply from 2 December 2027. Some rules already apply: the ban on inferring emotions at work from biometric data such as face or voice (since 2 February 2025), AI literacy duties (since 2 February 2025), and the duty to tell people when they are interacting with an AI system (since 2 August 2026).

Annex III, point 4(a) of the AI Act, Regulation (EU) 2024/1689, names in particular systems that:

Under Article 6(3), an Annex III system can fall outside the high-risk category only in narrow cases, and never when it profiles people. A system that evaluates candidates' answers against job requirements should be assumed to be high-risk. That includes Radius Hire's own interviewer.

Under Annex III we treat Radius Hire as a high-risk AI system and design it for human oversight ahead of 2 December 2027. Our guide to AI in hiring sets out what technology should evaluate and what people must decide.

Provider or deployer: which one are you?

The AI Act gives different duties to different roles.

Most employers are deployers. Your duties are different from your vendor's, but they are real.

Two situations can make you a provider, with the provider's duties (Article 25). The first is putting your own name or trademark on a high-risk system, or substantially modifying it. The second is putting a general-purpose AI system, such as a chatbot, to a high-risk use, for example asking it to filter CVs or evaluate candidates. Take legal advice before doing either.

What changed with the Digital Omnibus on AI?

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. It moved:

The Digital Omnibus on AI amends the AI Act. It does not amend the GDPR. A separate Commission proposal from November 2025, also called the Digital Omnibus, would change parts of the GDPR, including the rules on automated decisions. As of August 2026 it was still at an early stage: neither the Parliament nor the Council had adopted a position. Until it is adopted, the GDPR rules described below apply unchanged.

Why the delay is not a reprieve

Our view. It is tempting to read the Digital Omnibus as "we have more time". We think that is the wrong lesson.

A later date changes the timing, not the direction. A tool you adopt now will be judged under the GDPR and equal treatment law today. Whether the AI Act's high-risk duties also reach a system already in use before December 2027 depends on how much it changes after that date. Ask counsel. Either way, the records you need are the same.

Those records cover:

They overlap substantially with the records that make a hiring process defensible under equal treatment law today. That is an argument for documenting your process now, whatever tools you choose.

Which AI Act rules already apply to recruitment?

Three rules and one permission already apply: the ban on emotion recognition at work, the duty to tell people they are dealing with AI, AI literacy, and a permission to use sensitive data to detect bias.

1. The ban on emotion recognition at work

Since 2 February 2025, Article 5(1)(f) has banned AI systems that infer the emotions of people in the workplace. The ban covers inferring emotions from biometric data such as a face or voice, with exceptions for medical or safety reasons. The European Commission's guidelines, which are not binding, say it also covers job candidates (C(2025) 5052 final).

2. Must candidates be told they are dealing with AI?

Yes. Since 2 August 2026, Article 50(1) requires providers to design AI systems intended to interact directly with people so that those people are told they are interacting with an AI system, unless this is obvious from the circumstances. The Commission approved draft guidelines on these transparency duties on 20 July 2026 (C(2026) 5054 final). This is a duty on the provider: as an employer, check that your provider meets it before candidates meet the system. From 2 December 2027, employers using high-risk recruitment AI must also inform candidates themselves (Article 26(11)), and GDPR information duties apply today.

3. AI literacy

Article 4 has applied since 2 February 2025. The Digital Omnibus replaced its text. Providers and deployers must take measures to support the development of AI literacy among staff and others who operate or use AI systems on their behalf, taking account of their knowledge, the context of use and the people affected. The amended text adds that this does not require them to ensure any specific level of literacy for any individual.

4. A permission to detect bias

A new Article 4a allows providers and deployers to process special categories of personal data where strictly necessary to detect and correct bias, under strict conditions. It is a permission, not a duty, and it does not endorse any method.

What must employers do from 2 December 2027?

From 2 December 2027, employers that deploy a high-risk recruitment system will have duties under Article 26. These include:

Candidates may also have a right to an explanation of a decision based on the output of a high-risk system (Article 86). Ask counsel whether and when this applies to your process.

The fundamental rights impact assessment in Article 27 applies mainly to public bodies and to private entities providing public services. It will therefore not apply to most private employers.

Who enforces the AI Act, and what are the fines?

Under Article 99 of the AI Act, Regulation (EU) 2024/1689, fines can reach €35 million or 7% of worldwide annual turnover for prohibited practices, such as emotion recognition at work, and €15 million or 3% for breaches of other duties, including those of deployers. In the Netherlands, supervision is organised around the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur (RDI).

How does the GDPR apply to AI recruitment today?

The AI Act dates do not change your GDPR duties. These apply now, whatever screening method you use.

What this means for frontline and high-volume hiring

Most guidance on the AI Act is written for large corporate recruitment teams. Frontline hiring has its own pressure points.

Volume screening is where the high-risk classification bites. The tools frontline employers adopt to cope with volume, such as application filters, automated first interviews and answer evaluation, are exactly the uses Annex III names. If a tool is doing the work of a first screen at scale, assume it is high-risk and plan for the deployer duties.

Voice and video interviews need a specific check. Asynchronous voice and video interviews are increasingly used for shift-based roles. The ban on inferring emotions from a face or voice already applies, and the Commission's guidelines say it covers candidates. Ask every provider directly whether the system infers emotions or assesses tone, accent or appearance.

Candidate information has to work for your candidates. Frontline applicants often apply on a phone, and many are not native Dutch speakers. The GDPR already requires information in concise, clear and plain language, and EU data protection guidance says it should be translated where you target people who speak other languages (WP260rev.01). Telling candidates that they are speaking with an automated interviewer, what is recorded and who decides only works if they can understand it.

Oversight has to be designed for volume. Human oversight by competent people is easy to promise and hard to deliver at 200 applications a week. If one recruiter "oversees" hundreds of automated outputs without time to look at the evidence, the oversight exists on paper only. Plan the reviewer hours as part of the process: our guide on how to run structured interviews at high volume shows the arithmetic, and human oversight in hiring sets out what real oversight looks like.

Staffing agencies should clarify their role. An agency that uses a recruitment AI system under its own authority to screen candidates is likely to be a deployer for that use. An agency that offers a screening system to clients under its own name, or substantially modifies it, may take on provider duties (Article 25). Where the agency and its client both use the outputs, for example when a client selects from an AI-assisted shortlist, the roles and duties of each party should be assessed with counsel and set out in the contract.

Dutch law: where things stand

No Dutch law currently requires employers to use a documented recruitment and selection procedure. Equal treatment law, including the Algemene wet gelijke behandeling, already prohibits discrimination in recruitment.

The bill that would have introduced such a duty, the Wet toezicht gelijke kansen bij werving en selectie (35673), passed the Tweede Kamer on 14 March 2023. The Eerste Kamer rejected it on 26 March 2024, by 38 votes to 37.

A new bill by MPs Ergin and Van Baarle (36908), submitted on 3 March 2026, would require employers and intermediaries with 25 or more employees to use a working method that makes recruitment and selection objective, and those with 50 or more to put it in writing. The Raad van State advised on 4 May 2026 not to proceed with the bill unless it is amended. The initiators consulted on a revised version from 4 June to 3 July 2026. At the time of writing, no parliamentary debate or vote had been scheduled.

Your works council may also have a say. Introducing an AI screening tool can change your hiring policy, and Article 27(1)(d) of the Wet op de ondernemingsraden covers hiring policy. Ask counsel whether your works council has a right of consent.

A preparation checklist for employers