Is hiring AI high-risk under the EU AI Act? A plain-English explanation

If you run AI anywhere in your hiring process, the most common question is the simplest one: is this tool high-risk under the EU AI Act? For recruitment and selection, the answer is almost always yes. This article explains why, what counts as in-scope, and how to tell quickly. It is a practical orientation, not legal advice; for decisions about your specific situation, speak to your own advisers.

What does "high-risk" mean under the EU AI Act?

The EU AI Act takes a risk-based approach. Rather than treating all AI the same, it sorts systems into tiers: a small set of prohibited practices, a larger high-risk category that carries the heaviest obligations, and lower-risk uses with lighter transparency duties. Annex III is the list that names the high-risk use cases, and employment is on that list explicitly. AI systems intended to be used for the recruitment or selection of people, in particular to place targeted job adverts, to filter applications, and to evaluate candidates, fall in the high-risk category. [Source: artificialintelligenceact.eu, Annex III, accessed 2026-06-18.]

High-risk does not mean banned. It means the system is permitted, but only if a defined set of obligations is met: risk management, data governance, human oversight, record-keeping, transparency to the people affected, and accuracy and robustness testing. The point of the classification is that a hiring tool shapes people's livelihoods, so the law asks for evidence that it is built and used responsibly.

When does the high-risk obligation actually apply?

This is where the timeline matters, and where you should be careful. The high-risk obligations covering Annex III systems, which include hiring, currently apply from 2 August 2026. [Source: artificialintelligenceact.eu, application timeline, accessed 2026-06-18.] However, on 7 May 2026 the EU reached a provisional Digital Omnibus agreement that would defer stand-alone Annex III systems, recruitment AI among them, to 2 December 2027. That agreement is not yet formally adopted. As of 18 June 2026 the legal date still stands at 2 August 2026, but a single confident date could be out of step within weeks. [Source: Gibson Dunn, Travers Smith, EU AI Act Service Desk, accessed 2026-06-18.]

The practical takeaway does not depend on which date wins. Vendor due diligence, oversight design and candidate-facing transparency all take longer than the gap between either date and today, so the work is the same regardless. Treat the date as in flux, prepare now.

Which hiring tools count as in-scope?

The classification is broader than most people assume. It is the function that matters, not the label on the product. A tool is in scope when its output influences who progresses through your process. In practice that includes:

• Application screening and filtering. Anything that sorts, knocks out or auto-tags candidates against criteria.
• Ranking and shortlisting. Tools that order candidates or surface a "top" set for a recruiter to look at first.
• Scoring and assessment. Skills tests, video analysis, or psychometric scoring where a model produces a number or grade that feeds a decision.
• CV parsing that feeds a shortlist. Even "just parsing" is in scope when the parsed output drives matching, ranking or filtering downstream.
• Targeted advertising of roles. Deciding who sees a job advert is named in Annex III alongside selection. [Source: artificialintelligenceact.eu, Annex III, accessed 2026-06-18.]

The common thread is influence over the candidate's path. If a human reads the output and it changes who they look at, the system is in scope.

What is usually out of scope?

Not every piece of software in a hiring stack is high-risk. Tools that do not evaluate or sort people tend to sit outside the classification: interview scheduling, calendar coordination, payroll, or a plain applicant database that stores records without scoring them. A grammar checker that tidies a job advert is not evaluating candidates. The line is whether the AI assesses people or merely supports logistics around the process.

Be careful with "it is just an ATS" reasoning, though. Many applicant tracking systems now embed ranking, match scores or AI summaries. The presence of any scoring or ranking feature pulls that feature into scope even if the surrounding product feels administrative. Inventory by function, not by product name.

How do I tell quickly if my tool is in scope?

Three questions usually settle it. Does the tool produce an output, such as a score, rank, match or filter, about a candidate? Does that output influence who a human looks at or progresses? Is the role being hired for, or the output being used, connected to the EU or the UK in a way that brings the Act or domestic law into play? If the first two are yes, treat the system as high-risk for planning purposes and ask your vendor for the evidence a high-risk system requires.

It is also worth remembering that UK-only hiring is not a free pass. The Equality Act 2010 applies to every stage of recruitment, automated or not, and an AI tool that produces worse outcomes for a protected group creates exposure under UK law today, before any EU enforcement question arises. [Source: Equality Act 2010, gov.uk, accessed 2026-06-18.]

What this means for your next step

If you have concluded that one or more of your hiring tools is high-risk, the obligations do not all fall on you. Responsibility splits between the provider that builds the system and the deployer that uses it, and that split decides what you must produce versus what you must demand from your vendor.

Part of: EU AI Act and recruitment.

For the duty split, read provider vs deployer obligations for hiring AI. For the assessment you may need to run, see a fundamental rights impact assessment template for recruitment.

The employers who find the enforcement date uneventful are the ones who classified their tools early and built the evidence as they hired, rather than assembling it in a panic when someone asks.