EU AI Act High-Risk Rules for Recruitment Take Effect
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
As of 2 August 2026, any organisation using AI to screen, rank, match, or evaluate candidates must comply with the EU AI Act's high-risk system obligations. The requirements are substantial: mandatory conformity assessments, technical documentation, bias testing, human oversight procedures, transparency disclosures, and registration in the EU's public database. The Act reaches beyond EU borders: if an AI system's output affects a candidate in the Union, the regulation applies regardless of where the deploying company is headquartered. Taleva Research's compliance tracker shows how far most companies still have to go: 62% have started an AI system inventory, but only 28% have completed it. Just 9% have completed bias testing and audits. 11% have finished technical documentation. Penalties for high-risk system violations reach €15 million or 3% of annual global turnover. The Act treats recruitment AI — CV screening, candidate ranking, automated interview analysis, hiring decision support — as high-risk by default under Annex III, Category 4.
Why It Matters
This is the most significant regulatory moment for recruitment technology since GDPR. The Taleva compliance data tells a blunt story: the gap between 'started' and 'completed' on every compliance activity is wide, and the deadline has now passed. For TA leaders, this changes vendor procurement fundamentally. Every AI screening tool, chatbot, video interview analyser, and matching algorithm in your stack now needs auditable documentation — not from the vendor alone, but from you as the deployer. Companies that treat this as a legal checkbox exercise rather than an operational capability will find themselves exposed. The companies that move now — building AI governance as an operating muscle rather than a one-off project — will have a competitive advantage in EU talent markets where candidates increasingly expect to know how AI is being used on them.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your General Counsel or Data Protection Officer: Confirm whether your organisation qualifies as a 'deployer' under Article 3 of the Act and map every AI tool in the recruitment supply chain. Ask specifically about extraterritorial exposure — even if your HQ is outside the EU, do any of your roles or candidates touch the Union?
Your head of TA operations: For each AI tool in use, can you document who exercises human oversight, how they were trained, and when they can override the system's output? A policy document alone won't satisfy the oversight requirement. Compare your progress against the Taleva benchmarks — if you haven't completed an AI system inventory, you're behind even the median.
Inspect
What to take a closer look at
Audit your AI vendor contracts this week. For each tool used in candidate screening, ranking, or evaluation, ask the vendor: (1) Has the system undergone independent bias testing with results you can share? (2) Will they provide the technical documentation required under Annex IV? (3) Do your SLAs include ongoing monitoring obligations? If the answer to any of these is 'we'll get back to you,' you have a compliance gap that needed closing before 2 August — which has now passed.
Reflect
What to think about more deeply
The EU AI Act treats recruitment AI as high-risk by default. But the alternative — human-only screening at scale — has its own well-documented bias problems. Five years from now, which will produce fairer outcomes: audited, transparent AI or unaudited, opaque human judgment?