The EU AI Act and recruitment agencies: what applies, and from when (updated September 2026)

The European AI Regulation classifies AI-based CV screening and candidate evaluation as "high-risk" systems. The "Digital Omnibus" (Regulation (EU) 2026/1744, published on 24 July 2026) postponed the application of the corresponding obligations to 2 December 2027; the prohibitions and the AI-literacy duty already apply. Here, in plain words, is what changes for a recruitment agency, small or large.

Why recruitment is covered

Regulation (EU) 2024/1689, known as the AI Act, lists in Annex III the AI systems "intended to be used for the recruitment or selection of natural persons, in particular to analyse and filter job applications and to evaluate candidates". A tool that scores CVs, ranks applications or proposes a shortlist is therefore a high-risk system, whatever the size of the agency using it.

The timeline unfolded in three steps: prohibited practices from February 2025, obligations for general-purpose AI models in August 2025, then, for Annex III high-risk systems (including recruitment), an application originally set for 2 August 2026 and postponed to 2 December 2027 by Regulation (EU) 2026/1744. The postponement suspends neither the prohibited practices nor the staff AI-literacy duty (Article 4), both already in force; systems already on the market are also subject to transitional provisions to be checked case by case. Article 86 (right to explanation) follows its own logic and sets no response deadline: the one-month period we recommend is the GDPR one.

Two roles, two levels of obligations

The text distinguishes the provider (the vendor who designs the system) from the deployer (the agency that uses it). Most of the technical burden falls on the provider: training data governance, documentation, logging, robustness, built-in human oversight (Article 14). But the deploying agency has its own obligations, set out in Article 26.

What an agency must actually do

1. Use the system according to its instructions. A match score is decision support, not a decision. Using it for anything other than its intended purpose exposes the agency to liability.
2. Assign oversight to competent people. The agency designates who supervises the tool, with the training and authority needed to ignore or reverse a recommendation.
3. Keep the logs. Logs automatically generated by the system must be kept for at least six months, unless applicable law provides otherwise.
4. Inform candidates. Any person subject to a decision based on the system must know that an AI was involved.
5. Inform affected workers and their representatives when the system is used internally, before putting it into service.
6. Carry out the GDPR impact assessment where required, relying on the provider's documentation.
7. Honour the right to explanation. Article 86 allows a rejected candidate to obtain a clear explanation of the role played by the AI and the main elements of the decision.
8. Monitor operation and report any incident or risk to the provider.

The link with the GDPR

The AI Act does not replace the GDPR; it adds to it. The legal basis of processing, data minimisation, CV retention periods, access and erasure rights remain governed by the GDPR. In practice, a compliant agency combines both: scoring on anonymised data, automatic CV purge, decision register, and a documented final human decision.

Penalties

Non-compliance with deployer obligations can be fined up to €15 million or 3% of worldwide turnover, the higher amount applying to large companies and the lower to SMEs. Beyond the fine, the real risk for an agency is contractual: key accounts now ask for proof of compliance before signing.

One-page checklist

• Does the vendor present my tool as AI Act compliant, with technical documentation?
• Can I export a register of every AI-assisted decision, with the human decision-maker?
• Is every decision contradicting the AI's recommendation justified and traced?
• Can scoring run on anonymised CVs?
• Can I produce in one click the explanation sheet requested by a rejected candidate?
• Are my candidates informed that AI assists pre-screening?
• Are CVs purged automatically after a defined period?
• Have I signed a data processing agreement (DPA) with the vendor?

This article is informational and does not constitute legal advice. For your own situation, consult your counsel or your data protection officer.

← All articles