Which HR systems are actually covered
Annex III, point 4 of the AI Act classifies two categories of workplace AI systems as high-risk, whether your company builds them in-house or buys them from a vendor:
- 4(a) — Recruitment and selection: systems intended to be used to place targeted job advertisements, to analyze or filter job applications, and to evaluate candidates.
- 4(b) — Managing the employment relationship: systems intended to be used to make decisions affecting terms of work, promotion or termination of employment relationships, to allocate tasks based on individual behavior, personal traits or characteristics, or to monitor and evaluate the performance and behavior of people in that context.
In practice, that covers an applicant tracking system (ATS) that scores resumes, software that analyzes video interviews, a people-analytics tool that measures performance, or any system that helps decide who gets promoted or let go.
Article 6(3) sets out an exception for systems that only perform a narrow procedural task and don't materially influence the outcome. But that exception doesn't apply if the system profiles individuals — and resume screening, candidate scoring or performance evaluation almost always involve profiling the person. In practice, most HR systems of this kind remain high-risk even when they're framed as "just a first filter" or "just an indicative score."
What it requires, and from whom
Being high-risk doesn't mean the same thing for the software provider as it does for the company using it — the "deployer," in the Regulation's language. Here's how the obligations split:
| Obligation | Who it falls on, and what it means |
|---|---|
| Technical documentation (Annex IV, Art. 11) | The provider's responsibility, not the employer's. |
| EU database registration (Art. 71) | Also the provider's job; a typical private employer does not have to register the system's use. |
| Human oversight (Art. 14) | Falls on the employer: it must be assigned to staff with the competence, training and authority to detect automation bias and to interpret or override the system's outputs. |
| Use per instructions and representative input data (Art. 26) | The employer must use the system per the provider's instructions and ensure input data is relevant and sufficiently representative. |
| Monitoring and serious incidents (Art. 26) | The employer must monitor the system's operation and notify the provider and the market surveillance authority of any serious incident. |
| Log retention (Art. 26) | The employer must keep the logs automatically generated by the system, when under its control, for at least 6 months. |
| Prior notice to staff (Art. 26.7) | The employer must inform workers' representatives and affected staff before putting the system into service. |
| Notice to individuals affected by a decision (Art. 26) | The employer must inform a candidate or employee when the system takes part in an individual decision affecting them. |
One more nuance: Article 27 requires a fundamental rights impact assessment before the system is used, but only for public-law bodies, entities providing public services, and a handful of specific cases in credit and insurance. A typical private employer running an ATS isn't required to do one by default, though doing it anyway is good practice.
Timeline: when does this actually kick in?
The Annex III high-risk obligations — HR included — were due to apply from August 2, 2026, but the "Digital Omnibus," in force since July 27, 2026, pushed that date to December 2, 2027. The extra runway shouldn't be read as a reason to wait: inventorying your systems, confirming whether they profile, and preparing staff communications is work that takes months, not days, and it's worth having it done well ahead of the deadline.
The obligation to inform staff
Before putting a high-risk AI system into service or using it in the workplace, Article 26(7) requires the employer, as deployer, to inform workers' representatives and the workers who will be subject to the system that it will be used on them, following the labor-information channels already provided for under national and EU law.
This is a prior obligation, not a follow-up one. Rolling out the system first and explaining it afterward doesn't satisfy Article 26(7): the information has to reach workers' legal representatives and the affected staff before the system goes into operation.
This sits on top of — it doesn't replace — GDPR's obligations around automated decision-making (Article 22): they're separate, cumulative requirements, and the AI Act doesn't exempt you from GDPR, nor the other way around.
How to get ready: 4 steps
Step 1 — Inventory which HR systems you actually use
List everything that plays a role in hiring, performance evaluation, promotion or dismissal: the ATS, video-interview software, your people-analytics tool, even AI features baked into the HRIS that nobody remembers switching on.
Step 2 — Confirm whether they profile (and are therefore high-risk)
For each system on the inventory, ask whether it scores, ranks, predicts or classifies people based on their behavior, performance or characteristics. If the answer is yes, the Article 6(3) exception doesn't apply and the system is high-risk under Annex III.
Step 3 — Prepare the notice to staff
Work with workers' legal representatives to design the content and channel for informing people about each system before it goes live — what it does, on what data, and what decisions it affects — as required by Article 26(7).
Step 4 — Assign qualified human oversight
Name the person or team responsible for monitoring the system, with enough training to spot automation bias and real authority to override an output, as Article 14 requires.
Frequently asked questions
Is an AI-powered ATS that filters resumes automatically "high-risk"?
Yes. Annex III, point 4(a) of the AI Act explicitly covers systems that analyze or filter job applications and evaluate candidates, and the Article 6(3) exception doesn't apply because these systems typically profile candidates.
Do we have to notify staff before rolling out an AI performance-review tool?
Yes. Article 26(7) requires the employer to inform workers' representatives and the affected workers before putting the system into service or using it, not afterward.
Who prepares the technical documentation, us or the software vendor?
The Annex IV technical documentation (Article 11) is the provider's obligation, not the employer's. As deployer, the employer has separate obligations under Article 26, such as human oversight and informing staff.
Does this replace GDPR's notice requirement for automated decisions?
No. These are separate, cumulative obligations: GDPR Article 22 on automated decision-making still applies in full, and the AI Act adds its own (Articles 26.7 and 26.11) on top of it, not instead of it.