The EU AI Act — Regulation (EU) 2024/1689 — sorts AI systems by the harm they can do, not by how clever they are. Annex III lists the uses that count as high-risk, and point 4 covers employment: recruitment and selection, placing targeted job ads, filtering applications and evaluating candidates.
The reasoning is straightforward. A system that decides who gets seen by a human decides who gets work. If it is wrong in a consistent direction, it is wrong about a whole group of people at once, and nobody in the chain necessarily notices.
This catches agencies, not just software vendors. If you use a tool to rank candidates, you are a deployer under the Act and you carry deployer obligations, even though you did not build the tool.
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and the AI literacy duty (Article 4) | In force now |
| 2 August 2026 | Transparency duties (Article 50): telling people they are dealing with AI | In force now |
| 2 December 2027 | Full high-risk obligations for Annex III systems, including recruitment | Ahead |
The high-risk date is the one that moved. It was originally 2 August 2026; the European Parliament voted the change through on 16 June 2026 and the Council confirmed it on 29 June 2026. The transparency duties were not postponed with it.
Penalties for prohibited practices reach €35 million or 7% of worldwide annual turnover, whichever is higher. Agencies outside the EU are in scope when they recruit into the EU.
Article 5(1)(f) prohibits AI that infers the emotions of a person in the workplace, and candidate assessment counts. This has applied since 2 February 2025. There is no grace period left for it and no high-risk paperwork that makes it allowed.
In practice this rules out video interview tools that score facial expression or micro-expression, voice analysis that reads tone or pitch for emotional state, and webcam monitoring of agents’ mood. The narrow exception is medical or safety use, such as detecting fatigue to prevent an accident — not hiring.
The awkward part for agencies: several interview products still market exactly this. Using one does not become legal because the vendor says it is compliant. The deployer is in scope too.
We build screening that produces a shortlist with its reasoning attached, and a person makes the decision. That is not a legal hedge bolted on afterwards — it is the only design that survives both the Act and an angry client asking why a candidate was dropped.
We do not build emotion or sentiment scoring of candidates. We will say no to it, including when a client asks for it directly.
Every automated step writes a log you can read later: what the system saw, what it scored, who overrode it. That log is a compliance artefact under the Act and a debugging tool for you on every other day.
The dates above are the ones to plan against. Agencies that wait for December 2027 to start will be rebuilding under pressure; the ones that build it in now get the audit trail as a side effect.
If you place candidates into EU jobs, yes. The Act follows the use of the output inside the Union, not the address of the company using the system.
No. Provider and deployer obligations are separate. A compliant tool used without human oversight, logging or candidate transparency still puts you outside the rules.
If it scores or ranks candidates, yes — it falls under Annex III point 4. If it only collects answers and passes them to a human unchanged, the risk picture is different. The line is whether the system evaluates.
Yes, with care: targeted placement of job advertisements is itself named in Annex III point 4. Drafting copy that a human reviews is not the same as deciding who sees the ad.
As of mid-2026 no public enforcement action under Article 5 has been announced, though investigations are reported. Planning on non-enforcement is a bet with a €35 million downside and no upside.
Start with a short brief — we reply with an estimate.