AI in HR and recruitment: what is allowed, and what becomes high-risk?
Short answer
AI that selects candidates, assesses them or evaluates employees is high-risk AI under the AI Act. After the Digital Omnibus, those rules apply from 2 December 2027 and include human oversight, logging and informing employees and their representatives in advance. Emotion recognition at the workplace has been banned since February 2025. The GDPR, its limits on fully automated decisions and works council rights already apply today.
Which HR applications are high-risk?
Annex III of the AI Act explicitly lists employment. High-risk are AI systems used for:
- placing targeted job ads and analysing, filtering and evaluating applications;
- decisions on hiring, promotion or termination;
- allocating tasks based on behaviour or personal traits;
- monitoring and evaluating the performance and behaviour of employees.
An assistant that rewrites a job ad does not fall under this. A tool that ranks CVs or turns interview notes into an assessment does.
What applies when?
| Since / from | What |
|---|---|
| Already (GDPR) | No fully automated decisions with legal or similarly significant effects without human involvement (Article 22 GDPR); a DPIA when evaluating people |
| Already (works councils) | Co-determination rights for systems that can monitor behaviour or performance, in countries such as the Netherlands and Germany |
| 2 February 2025 | Ban on emotion recognition at the workplace; AI literacy |
| 2 December 2027 | High-risk requirements for the HR applications in Annex III |
The delay to 2027 is no reason to wait. Whoever buys an HR tool now is buying something that must meet the high-risk requirements a year from now.
What you will have to do as an employer
As a deployer of high-risk AI (Article 26 AI Act) you must, among other things:
- use the system in line with the provider’s instructions;
- assign human oversight to people who are trained for it and have the authority to intervene;
- make sure input data is relevant and sufficiently representative;
- keep the automatically generated logs for at least six months;
- inform workers’ representatives and affected workers in advance that the system will be used;
- monitor its operation and report serious incidents.
Candidates and employees also have a right to an explanation of decisions based partly on high-risk AI.
AI in HR you can justify
Much HR work can be supported by AI without AI judging people: writing job ads, searching policy, answering employee questions about schemes and benefits, summarising interview notes that a manager assesses personally.
HR data is particularly sensitive, though: salaries, sick leave, appraisals. It does not belong at an external AI service. With werqly, the AI runs on a dedicated node in your server room; in werqly AI Control you give the HR role access to the HR sources and other roles not. Record the use in your AI register and involve the works council early. See May you read employees’ prompts? and The EU AI Act in 2026.
Frequently asked questions
Questions on this topic
Is AI for CV screening banned?
No, but it is high-risk AI under the AI Act. From 2 December 2027, strict requirements apply to human oversight, logging and informing the people involved. Already today, a rejection may not be fully automated without human involvement (Article 22 GDPR).
Does the works council have to agree to AI in HR?
Often, yes. In countries such as the Netherlands and Germany, works councils have co-determination rights over appraisal schemes and systems that can monitor behaviour or performance. Under the AI Act, workers’ representatives must also be informed in advance about high-risk AI.
May AI analyse the mood of employees?
No. Emotion recognition at the workplace has been banned under the AI Act since 2 February 2025, except for medical or safety reasons. Analysing messages or conversations for someone’s emotional state quickly falls under that ban.
Which HR tasks can use AI without being high-risk?
Tasks where AI does not judge people: writing job ads, searching HR policy, answering questions about schemes and summarising notes that a person assesses. Keep the data within your own environment, though.
Sources
- AI Act — Regulation (EU) 2024/1689, Article 26 and Annex III
- GDPR (Regulation (EU) 2016/679), Article 22
- Artificialintelligenceact.eu — Article 26: Obligations of deployers of high-risk AI systems
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.