EUAICheck is an independent self-assessment tool. We are not a law firm and have no link with any official authority.
EUAICheck is an independent self-assessment tool published by Vival Solutions (EI). This content is informational, is not legal advice and may change: always check the official text on EUR-Lex.
EU AI Act and HR: what already applies, what arrives in December 2027
Updated 30 September 2026 · Annex III, point 4, and Articles 5, 26 and 86 of Regulation (EU) 2024/1689
Recruitment and workforce management are among the high-risk uses in Annex III (point 4). One prohibition already applies: emotion recognition in the workplace. High-risk obligations apply from 2 December 2027.
Whether the tool is built in-house or bought from a vendor, the company using it is its deployer and has its own obligations. The vendor, as provider, carries its own.
1. Which HR tools are covered?
Annex III, point 4 covers AI systems intended to:
- recruit or select people: targeted job ads, analysing and filtering applications, evaluating candidates;
- make decisions on working conditions, promotion or termination;
- allocate tasks based on behaviour or personal traits;
- monitor and evaluate employee performance and behaviour.
An Annex III system may exceptionally not be high-risk if it poses no significant risk (Article 6(3)), but never when it profiles natural persons. A tool that scores or ranks candidates generally profiles them: it stays high-risk, even if a recruiter makes the final decision.
2. What is prohibited since February 2025
- Emotion recognition in the workplace, including job interviews, except for medical or safety reasons (Article 5(1)(f)).
- Biometric categorisation to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation (Article 5(1)(g)).
- Subliminal or manipulative techniques causing significant harm (Article 5(1)(a)).
A video interview tool that infers emotions from face or voice to produce a score falls under the prohibited practice. Penalty ceiling: EUR 35 million or 7% of global turnover (for SMEs, the lower of the two).
3. The employer's (deployer's) obligations, from 2 December 2027
- Use the system according to its instructions and monitor its operation (Article 26(1) and (5)).
- Human oversight: assign it to competent, trained people empowered to override the system (Article 26(2)).
- Input data: ensure it is relevant and representative, to the extent you control it (Article 26(4)).
- Logs: keep automatically generated logs for at least six months (Article 26(6)).
- Inform employees and their representatives before putting the system into service at work (Article 26(7)).
- Inform candidates and employees subject to decisions assisted by the system (Article 26(11)), and right to an explanation (Article 86).
Already today, Article 4 requires measures to support AI literacy of HR teams using these tools. The GDPR, notably Article 22 on automated decisions, and employment law (works council consultation) also apply.
4. Timeline
| Date | What applies |
|---|
| 2 February 2025 | Prohibitions (including workplace emotion recognition); AI literacy |
| 2 August 2026 | Transparency: a recruitment chatbot must disclose that it is AI (Article 50) |
| 2 December 2027 | Annex III high-risk obligations, for providers and deployers |
5. HR checklist
- List the HR tools that use AI: ATS, online tests, video interviews, performance tools.
- Check now that no tool infers candidates' or employees' emotions.
- Ask each vendor for its compliance plan and future instructions for use.
- Name who oversees each tool and who can override its recommendations.
- Prepare information for candidates, employees and the works council.