AI used to analyse or filter job applications or evaluate candidates is within the Annex III employment category. Assess the actual system and intended purpose against Article 6, including its limited exceptions. A human making the final hiring decision does not by itself remove a system from high-risk classification.
Why recruitment AI is high-risk
Annex III of the AI Act lists the areas the EU legislator decided carry serious risk to people’s rights and livelihoods, and employment and worker management is one of them. It covers AI used for recruitment and selection, placing job ads, analysing and filtering applications, evaluating candidates, and AI used on existing staff for task allocation, monitoring, evaluation, promotion or termination decisions. The logic is straightforward: a system that decides who gets shortlisted decides who gets a livelihood, and errors or bias at that point are hard for the affected person to even see, let alone challenge.
The human-in-the-loop myth
Human review is not a blanket exemption. In a fictional example, a recruiter only sees the candidates ranked highest by an AI tool; their final interview decision does not undo the effect of the earlier ranking. Article 6(3) has a limited route for systems without significant risk or material influence on decisions where its conditions are met. Annex III systems profiling natural persons remain high-risk. Ask the provider for the documented assessment rather than assuming a human sign-off resolves classification.
Where the tools hide
Few SMEs buy something labelled “AI recruitment system”. The screening function usually arrives inside something else:
- An applicant tracking system with “candidate matching” or “fit scores” switched on.
- A job-board or LinkedIn feature that pre-ranks applicants before you see them.
- A recruitment agency using AI screening on your behalf, your candidates, their tool, questions you still need answered.
- HR software that scores performance, flags attrition risk or allocates shifts, the same Annex III category covers existing workers, not just applicants.
What being a high-risk deployer requires
If you use the tool as supplied by the vendor, you are a deployer, the lighter role, but not a light one. (If you are unsure which side of the line you sit on, start with deployer or provider.) Article 26 requires deployers of high-risk systems to:
- Use the system in line with the provider’s instructions.
- Assign human oversight to a named person with the training and authority to override or stop the system.
- Check input data is relevant and representative, to the extent you control it.
- Retain the system’s logs, where under your control.
- Inform workers and their representatives before use, and monitor operation, suspending use and reporting serious incidents.
The timeline, and why waiting is a mistake
The main Annex III high-risk provisions apply from 2 December 2027 under the enacted amendment. Prepare the relevant oversight, instructions and monitoring arrangements for systems in scope, checking transitional provisions. Literacy measures and other applicable law need attention now.
Find the trap before it finds you
Use the register to record the intended purpose, provider evidence and reasons for your classification. Guided questions help organise the assessment; they should not replace advice when a use or exception is uncertain. See how it works.
Legal references checked 4 October 2026: AI Omnibus in force; Article 4 guidance; Current application dates; Article 50 transparency; High-risk classification; Irish Act and AI Office. Check the provision and any transition that applies to your particular system.