techport HR Suite

The AI Act in Human Resources: High-Risk AI, Obligations and Deadlines

The EU AI Act (Regulation (EU) 2024/1689) treats AI in human resources particularly strictly. The reason: decisions concerning recruitment, promotion or termination shape career trajectories and livelihoods. Following the AI Omnibus, Regulation (EU) 2026/1744 applicable since 27 July 2026, the implementation deadlines have shifted.

This guide explains which HR AI is classified as high-risk, who counts as a provider or deployer, what obligations employers have and who oversees compliance. It does not constitute legal advice. For insights on strategically positioning AI in HR, visit our advisory page on AI in HR with governance.

In brief

AI used for recruitment, selection, promotion, termination, task allocation and performance evaluation constitutes high-risk AI (Annex III No. 4).
Employers using such AI are classified as deployers; software manufacturers are providers.
The high-risk obligations for HR apply from 2 December 2027.
Emotion recognition in the workplace has been prohibited since 2 February 2025.
Transparency obligations, such as disclosing the use of an AI assistant, have applied since 2 August 2026.
The competent supervisory authority in Germany is the Bundesnetzagentur (Federal Network Agency).

What constitutes an AI system

The Regulation defines an AI system as a machine-based system that operates with varying levels of autonomy and infers from the inputs it receives how to generate outputs such as predictions, content, recommendations or decisions (Art. 3(1)). Software that merely executes human-defined rules is not covered, according to Recital 12. Applicant tracking software with fixed filters is therefore generally not an AI system, whereas AI-assisted screening or scoring of CVs is.

When AI in HR is considered high-risk

Annex III No. 4 distinguishes two categories:

a) Recruitment and selection: AI intended to place targeted job advertisements, screen or filter applications, and evaluate candidates.
b) Employment: AI intended for decisions affecting terms of employment, promotion and termination, for allocating tasks based on individual behaviour or personal traits, and for monitoring and evaluating performance and behaviour.

Art. 6(3) provides for a derogation: a system is not high-risk if it poses no significant risk of harm, for instance because it performs a narrow procedural task or improves the result of a previously completed human activity. However, this exception never applies if the system performs profiling of natural persons. In our assessment, automated evaluation of candidate suitability constitutes profiling within the meaning of Art. 4(4) DSGVO (General Data Protection Regulation - GDPR).

Use case	Classification
Evaluating or ranking CVs against criteria	High-risk (No. 4 a)
Automatically pre-screening or filtering out applications	High-risk (No. 4 a)
Evaluating employee performance or behaviour	High-risk (No. 4 b)
Merely parsing CV data into form fields	Case-by-case basis, exception under Art. 6(3) possible
AI assistant answering queries on internal policies	Generally not high-risk, but subject to transparency obligations (Art. 50)
Inferring employee emotions from voice or facial expressions	Prohibited (Art. 5(1)(f))

The classification of pure data extraction and AI assistants reflects our assessment and depends on the specific, actual implementation.

Provider or deployer: who is considered what?

A provider is any natural or legal person who develops an AI system or has it developed and places it on the market under their own name or trademark (Art. 3(3)). This is typically the software vendor. A deployer is any person or entity using an AI system under their own authority (Art. 3(4)). This is the employer implementing HR software with AI capabilities.

Roles can change. Under Art. 25(1), a deployer is considered a provider if they place a high-risk system on the market under their own name, make a substantial modification to it, or modify its intended purpose such that it becomes a high-risk system. For example, an employer using a general-purpose chatbot to rank job applications may thereby assume provider obligations.

Obligations of employers as deployers

From 2 December 2027, deployers of high-risk AI in human resources must comply primarily with Art. 26:

Use the system in accordance with the provider's instructions for use (para. 1).
Assign human oversight to individuals who possess the necessary competence, training and authority (para. 2).
Ensure that input data is relevant and sufficiently representative, to the extent the employer controls it (para. 4).
Monitor the operation, report risks to the provider and market surveillance authority, and suspend use if necessary (para. 5).
Retain automatically generated logs for at least six months (para. 6).
Inform workers' representatives and affected employees before putting the system into service (para. 7). Codetermination rights under the Betriebsverfassungsgesetz (Works Constitution Act - BetrVG) continue to apply in parallel, see Works council and AI.
Use the provider's technical information to conduct a data protection impact assessment (para. 9).
Inform job applicants and other affected individuals that a high-risk system is in use (para. 11).

In addition, affected persons have the right to request clear and meaningful explanations regarding the role of AI in decision-making (Art. 86). The GDPR applies in parallel: according to the CJEU, even an automated score can constitute an automated decision within the meaning of Art. 22 GDPR if it plays a decisive role in the final outcome (C-634/21). Genuine, substantive human review is therefore paramount.

A fundamental rights impact assessment (Art. 27) is only required for public bodies and private entities providing public services. Deployer registration in the EU database (Art. 49(3)) is also restricted to public authorities. Neither requirement applies to regular private-sector employers.

Art. 4 already applies: providers and deployers must take measures to ensure AI literacy among their staff, applicable since 27 July 2026 without an explicitly mandated competence level.

Deadlines under the AI Omnibus

Date	What applies
01/08/2024	AI Act enters into force
02/02/2025	Prohibitions (Art. 5) and AI literacy (Art. 4) apply
27/07/2026	AI Omnibus enters into force, Art. 4 revised
29/07/2026	KI-Marktüberwachungsgesetz enters into force, Bundesnetzagentur appointed
02/08/2026	General date of application, including transparency obligations (Art. 50)
02/12/2027	High-risk obligations for Annex III systems, including HR
02/08/2028	High-risk obligations for AI embedded in products under Annex I

Originally, high-risk obligations for HR were scheduled to apply from 2 August 2026. The Omnibus postponed them due to delays in European harmonised standards and guidelines. Under Art. 111(2), systems placed on the market prior to the cut-off date are only covered if they subsequently undergo significant changes. Employers should not rely on this exemption, as AI software is updated continuously.

Prohibited since February 2025

Since 2 February 2025, AI systems that infer the emotions of natural persons in the workplace have been banned, except where used for medical or safety reasons (Art. 5(1)(f)). Biometric categorisation systems intended to deduce sensitive attributes such as trade union membership or religious beliefs are likewise strictly prohibited (Art. 5(1)(g)). Violations of these prohibitions carry administrative fines of up to 35 million euros or 7 per cent of global annual turnover (Art. 99(3)).

Transparency since August 2026

Art. 50 has applied since 2 August 2026. AI systems that interact directly with natural persons must be designed and developed so that users are informed that they are interacting with an AI, unless this is obvious from the context. In human resources, this applies in particular to candidate chatbots and internal employee AI assistants, even if they are not classed as high-risk.

Supervision in Germany: the Bundesnetzagentur

Pursuant to § 2(1) of the KI-Marktüberwachungsgesetz (KI-MIG - AI Market Surveillance Act), the Bundesnetzagentur is designated as the competent market surveillance authority, unless specified otherwise by law. The agency explicitly identifies AI systems in personnel management as a core area of supervision. Its AI Service Desk provides an online tool for the initial assessment and classification of AI systems.

Breaches of deployer obligations under Art. 26 or transparency requirements under Art. 50 can incur fines of up to 15 million euros or 3 per cent of worldwide annual turnover (Art. 99(4)). For small and medium-sized enterprises (SMEs), the lower of the two amounts applies (Art. 99(6)).

What employers should do now

Audit and document all AI features across HR systems, including legacy software.
Classify each use case: high-risk, transparency obligation, prohibited or out of scope.
Involve the works council at an early stage and conclude a works agreement, see Works agreement on AI.
Designate and train personnel tasked with human oversight.
Request instructions for use, logging specifications and conformity assessment roadmaps from software vendors.
Conduct or update data protection impact assessments (DPIAs).
Draft clear transparency notices for employees and job applicants.

How the techport HR Suite helps

The techport HR Suite is built specifically around the requirements of the EU AI Act. In practice, this means for AI candidate evaluation:

The AI suggests, a human decides. The system does not modify candidate stages, filter applicants out automatically or dispatch rejection emails. Individual criteria can be overridden at any point, with mandatory reasoning.
Comprehensive audit log of every AI interaction and human decision; evaluation criteria and audit trails can be exported at any time.
Version-controlled criteria: The AI extracts role criteria from the job specification; a human reviews and approves them. Every approval generates an immutable version.
Criteria vetted against the AGG (General Equal Treatment Act), personal data stripped before assessment: Name, contact details, date of birth, marital status, nationality, religion and profile photos are excluded from the AI evaluation.
Transparent, explainable results: Each candidate receives an explanation including the scoring logic, extracted facts and verbatim citations cross-referenced against the CV. CVs that cannot be evaluated are listed separately with a stated reason.
Protection against manipulation: Invisible text, prompt injections and hidden instructions in CVs are reliably detected, sanitised and flagged.
Deployer compliance documentation: Complete instructions for use and templates for candidate transparency notices.
Full oversight for the works council: Via the works council assistant, employee representatives can inspect approved criteria, audit trails and system versions.
CVs remain inside the installation: The language model for CV assessment runs on the installation's dedicated infrastructure. Candidate data is never transmitted to third-party AI services.

Within corporate knowledge bases, every response is explicitly flagged as AI-generated (Art. 50). Operated on secure servers in Germany, or available as a private on-premises installation.

In our assessment, the AI candidate evaluation feature qualifies as a high-risk AI system under Annex III No. 4 of the AI Act. We are preparing internal conformity assessments ahead of 2 December 2027. Under Art. 43(2), HR AI is subject to internal control without involving a notified body; external certification marks do not exist for this category. Request demo

Frequently asked questions

Which AI systems in human resources are high-risk?

High-risk AI systems include those intended for recruitment and selection as well as for making decisions in employment relationships (Annex III No. 4 KI-VO [AI Act]). This encompasses AI that screens, filters or evaluates CVs, influences decisions on promotions or terminations, allocates tasks based on personal traits, or monitors and evaluates performance and conduct. If an AI system performs profiling, the exception under Art. 6(3) does not apply.

Who is considered a deployer of AI systems under the AI Act?

A deployer is any natural or legal person using an AI system under their own authority in a professional context (Art. 3(4) KI-VO). In HR, the employer is the deployer, while the software vendor is the provider. A deployer is deemed a provider if they make substantial modifications to a high-risk system, distribute it under their own brand or repurpose a general AI system for a high-risk function (Art. 25).

When do high-risk obligations apply to HR?

High-risk obligations for HR AI apply from 2 December 2027. They were originally scheduled for 2 August 2026. The AI Omnibus, Regulation (EU) 2026/1744, extended the deadline for all Annex III systems. Irrespective of this extension, prohibitions have been in effect since 2 February 2025, and transparency obligations under Art. 50 apply from 2 August 2026.

What requirements apply to high-risk AI systems?

Providers must implement risk management, validated training and test datasets, technical documentation, automatic logging, clear instructions for use, human oversight, and high levels of accuracy, robustness and cybersecurity (Art. 9 to 15 KI-VO). They must also maintain a quality management system, complete a conformity assessment and register the system. Deployers must use systems according to instructions, ensure human oversight, retain logs and notify affected individuals (Art. 26).

Do employers have to carry out a fundamental rights impact assessment?

Standard private employers are not required to conduct a fundamental rights impact assessment under Art. 27 KI-VO. This obligation is restricted to public authorities, private entities providing public services, and specific banking/insurance use cases. However, a data protection impact assessment (DPIA) under Art. 35 DSGVO (GDPR) is regularly required for AI applicant evaluation due to systematic evaluation of personal aspects. Employers may utilise provider documentation to complete this assessment (Art. 26(9) KI-VO).

Who enforces the AI Act in Germany?

In Germany, the Bundesnetzagentur acts as the national market surveillance authority, unless sectoral statutes allocate competence elsewhere (§ 2(1) KI-MIG, in force since 29 July 2026). It explicitly includes HR AI within its supervisory mandate, handles complaints and provides initial guidance via its AI Service Desk. Data protection authorities remain responsible for supervising GDPR compliance.

Sources

Retrieved on 23/10/2026.