AI in HR

• As a private employer, do we have to carry out a fundamental rights impact assessment (FRIA) for our HR AI?

  If you are not a body governed by public law and do not provide a public service: no. The FRIA applies from 2 December 2027 to bodies governed by public law, to private organisations providing public services, and to deployers of AI for creditworthiness or for life and health insurance. A DPIA may well be mandatory.

• Can an applicant or employee demand an explanation of a decision taken with AI?

  Yes, if you take the decision on the basis of a high-risk system from Annex III (except point 2) and it has legal effects or a similarly significant adverse effect. Article 86 has applied since 2 August 2026, but the classification rules for those systems apply only from 2 December 2027, and a transitional rule applies to systems already in use. Assess per system, therefore, whether the right already applies. If it does, you give clear and meaningful explanations of the role of the system and the main elements of the decision.

• Do our employees need an AI literacy certificate or a mandatory course?

  No. The AI Act does not prescribe a certificate, an exam or a fixed course. You take measures that support the development of AI literacy of your staff, tailored to who uses which AI systems; you do not have to guarantee a particular level. Training can be such a measure, but you choose the form yourself.

• Do we have to carry out a DPIA before we use AI in recruitment or personnel management?

  A DPIA is mandatory when the processing is likely to result in a high risk. That is the case, among other things, for systematic and extensive automated evaluation of persons, or for large-scale processing or systematic monitoring of employees as described in the Dutch Data Protection Authority's list. Carry out the DPIA before the processing.

• Do we have to inform employees and their representatives before we use a high-risk AI system?

  Yes, from 2 December 2027. An employer that is about to use a high-risk AI system in the workplace informs the workers' representatives and the workers concerned in advance, in accordance with the rules and practice on informing workers.

• Do we have to label job ads or recruitment images made with AI as AI content?

  For text, the labelling duty applies only if you publish text to inform the public on matters of public interest, and it lapses if a human has reviewed or edited the text and someone holds editorial responsibility. If you use AI to make images, audio or video that could pass for real, a deepfake, you must disclose it. This has applied since 2 August 2026.

• Do we have to make our HR team AI literate if we use AI tools?

  Yes. Since 2 February 2025, every organisation that uses AI systems professionally must take measures that support the AI literacy of its staff. Since 27 July 2026 a simplified text applies: you must support the development of AI literacy, but you do not have to guarantee a particular level.

• Do we have to register our HR AI in the EU database?

  As a private employer using an HR tool from a supplier: no. Registration in the EU database is a duty of the provider; deployers register only if they are a public authority or a Union institution, or act on their behalf. If you become a provider yourself, for example because you have your own high-risk HR tool built or change the intended purpose of a system so that it becomes high-risk, you do register. You can check with your supplier whether the system is registered.

• Do we have to tell applicants that a high-risk AI system takes part in deciding about them?

  Yes, from 2 December 2027. If you use a high-risk system from Annex III that takes or helps to take decisions about persons, you inform those persons that the system is being used on them. That comes on top of the transparency duties of Article 50, and the GDPR already requires information about automated decision-making now.

• Does our recruitment chatbot have to say that candidates are talking to AI?

  Yes, since 2 August 2026 a chatbot must be designed so that people know they are communicating with AI, unless that is already obvious. That duty lies with the provider of the chatbot. If you built the chatbot yourself, including on a third party's model, and deploy it under your own name, you are the provider.

• Does our works council have a right of consent if we introduce an AI tool for HR?

  Often, yes. The employer needs the works council's consent for a scheme on the processing and protection of personnel data and for facilities suitable for observing or monitoring personnel's attendance, behaviour or performance. A decision without consent is void if the works council invokes that in writing within a month.

• Does the AI Act also apply if we use an HR tool from an American or other non-European supplier?

  Yes. The Regulation applies to deployers established in the EU, so to you as a Dutch employer, wherever the supplier is based. The supplier is also covered itself if it places the system on the market or puts it into service in the EU; for high-risk systems a non-European provider appoints an authorised representative in the EU. For personal data, the GDPR rules on transfers outside the EU apply as well.

• From when do the high-risk duties apply to AI in HR?

  From 2 December 2027. Originally that was 2 August 2026, but Regulation (EU) 2026/1744 has moved the date for Annex III systems, including HR AI. If the system type was already on the market before that date, the high-risk duties, including yours as a deployer, apply only after a significant change in the design. AI literacy, the prohibition of emotion recognition in the workplace and the transparency duties of Article 50 already apply now.

• How long do we have to keep the logs of a high-risk AI system for HR?

  From 2 December 2027, as a deployer you keep the automatically generated logs under your control for a period appropriate to the intended purpose, and at least six months, unless other law provides otherwise, in particular the GDPR. If the logs contain personal data of candidates or employees, you do not keep them longer than necessary for the purpose.

• Is our AI tool for recruitment, selection or personnel management a high-risk system?

  Probably. The AI Act expressly names AI for recruitment and selection, and for decisions on terms of employment, promotion, dismissal, task allocation and tracking performance and behaviour, as high-risk. Only a system without a significant risk, such as a narrow procedural task, falls outside, but never if it profiles persons. The duties apply from 2 December 2027.

• Is our recruitment software with filters or matching an AI system under the AI Act?

  That depends on how the software works. An AI system infers from the input itself how to generate output, such as a ranking, a score or a prediction. Software that only runs rules that people have fully defined, for example a filter on a category C driving licence or on postcode, is according to the recitals not covered. Matching or scoring based on machine learning is, as a rule, covered.

• Is software that allocates tasks or trips to warehouse staff or drivers a high-risk AI system?

  If it is an AI system that allocates tasks on the basis of individual behaviour or personal traits or characteristics, yes: such a system is on the high-risk list from 2 December 2027. A schedule that only distributes work on the basis of orders, locations and fixed rules is not automatically covered. If the system weighs employees' performance or behaviour, that is profiling and the exception for systems without a significant risk does not apply. The works council already has a right of consent over such a system now.

• Is targeted advertising of job vacancies with AI covered by the high-risk rules?

  Yes, from 2 December 2027. The AI Act expressly names AI systems for placing targeted job advertisements as a high-risk application in recruitment. The duties lie with whoever uses the system under their own authority; for advertising via a platform you must check whether that is the platform or yourself. Already now, the choice of target group must not lead to prohibited distinction when offering a position.

• May an AI selection tool distinguish between candidates on the basis of sex, origin or other characteristics?

  No. The General Equal Treatment Act prohibits direct and indirect distinction when offering and filling a vacancy, when entering into and terminating an employment relationship and in promotion. An apparently neutral criterion that particularly affects people with a protected characteristic is also prohibited, unless it is objectively justified. For age and for disability or chronic illness, separate acts with a comparable prohibition apply to recruitment and selection.

• May an AI tool infer an applicant's origin, religion or sexual orientation from photos or videos?

  No. Since 2 February 2025 it has been prohibited to use a system that categorises people individually on the basis of biometric data in order to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Apart from that, such data is a special category of personal data and discrimination on those grounds is prohibited in recruitment.

• May an applicant request their AI score or assessment?

  Yes. An applicant has the right of access to the personal data you process about them, and a score or assessment about them is personal data. You provide a copy. If you take decisions in a fully automated way, you also give meaningful information about the logic involved and the envisaged consequences. Access must not adversely affect the rights of others.

• May recruiters paste CVs or candidate data into ChatGPT or another AI chatbot?

  Only within the limits of the GDPR. You use candidate data only for the purpose for which you received it and no more than necessary. An external chatbot service that processes that data for you is a processor; for that you need a data processing agreement, and where processing takes place outside the EU the rules on transfers apply. An account without such agreements is not suitable for this. If you let the chatbot assess or filter candidates, from 2 December 2027 you can also become the provider of a high-risk system yourself.

• May software automatically reject applicants without a person looking at it?

  In principle, no. An applicant has the right not to be subject to a decision based solely on automated processing that significantly affects them; the GDPR itself gives e-recruiting without human intervention as an example. It is allowed only under one of three exceptions, and then with at least human intervention, the opportunity to express a point of view and the right to contest the decision.

• May we use AI in performance reviews, promotion or dismissal?

  As an aid, yes, but with safeguards. A decision on promotion or dismissal that is based solely on automated processing and significantly affects the employee is in principle not allowed. A scheme for staff appraisal or for the promotion and dismissal policy requires the consent of the works council. From 2 December 2027, AI for such decisions is also a high-risk system.

• May we use AI that infers the emotions of applicants or employees, for example in video interviews?

  No. Since 2 February 2025 it has been prohibited to use AI to infer a person's emotions in the workplace, unless the system is intended for medical or safety reasons. The Regulation aims the prohibition at situations related to the workplace; a job application procedure is part of that, so a tool that infers candidates' emotions in a video interview falls under the prohibition. The prohibition also applies to someone who only uses such a system, not only to its maker.

• May we use AI to screen applicants' online profiles or social media?

  Only to a limited extent. Public data about an applicant is also personal data. You need a legal basis, usually legitimate interest; you collect no more than the position requires; you leave sensitive data such as religion or political preference out of account; and you tell the applicant which source you use. An AI tool that analyses profiles or assesses candidates is also covered by the high-risk rules from 2 December 2027.

• May we use AI to track employees' productivity or behaviour?

  Not without preparation. Systematic monitoring of employees is on the list of mandatory DPIAs, a monitoring system requires the consent of the works council, inferring emotions is prohibited, and from 2 December 2027, AI for monitoring and evaluating performance and behaviour is a high-risk system.

• May we use fingerprint or face recognition for time registration or access?

  For time registration, as a rule not. Biometric data used to uniquely identify a person is a special category of personal data. The Dutch implementing act allows it only if necessary for authentication or security, and only to the extent necessary for a substantial public interest in lawful access to certain places, buildings or systems. The Dutch Data Protection Authority fined a company that used fingerprints for attendance and time registration, and according to the AP, employees' consent is in principle no way out. A scheme on this requires the works council's consent.

• We are buying an AI tool for HR. Are we then the provider or the deployer?

  If you use a supplier's tool under your own responsibility, you are a deployer. You are a provider if you develop an AI system, or have one developed, and put it into service under your own name, including for your own use. From 2 December 2027 you also become the provider of a high-risk system if you put your name on such a system, substantially modify it, or change the intended purpose of a system so that it becomes high-risk; that can be the case if you use a general-purpose chatbot to filter applications or assess candidates.

• We have fewer than 50 employees and no works council. Do we have to arrange employee participation for an AI tool?

  A works council is mandatory from, as a rule, 50 persons employed. With 10 to 50 persons and no works council or staff representation body, you hold a staff meeting at least twice a year and let the staff give advice on decisions that lead to a significant change for at least a quarter of them. A staff representation body has no consent right over personnel data or monitoring systems by operation of law.

• What do we agree with the supplier of an AI tool for HR?

  If the supplier processes personal data of applicants or employees for you, you conclude a data processing agreement with the subjects the GDPR prescribes, and you choose only a supplier that provides sufficient guarantees. If the tool is a high-risk system from 2 December 2027, the supplier must supply instructions for use covering, among other things, the intended purpose, the accuracy, the human oversight measures and the logs. Ask for that information now: you need it for your DPIA and for correct use.

• What do we do if a high-risk AI system for HR does not work properly or causes a serious incident?

  From 2 December 2027 you monitor its operation on the basis of the instructions for use. If you have reason to consider that using it may present a risk, you inform the provider or distributor and the market surveillance authority without undue delay and suspend the use. You report a serious incident immediately, first to the provider and then to the importer or distributor and the market surveillance authority; the provider also reports it itself to the market surveillance authority.

• What do we have to tell applicants if we use AI to process their data?

  Under the GDPR you tell applicants, among other things, what you use their data for and on what legal basis, and whether automated decision-making takes place, with meaningful information about the logic involved and the envisaged consequences. If you obtain data elsewhere, you also state the source, at the latest within a month or at the first contact.

• What do we, as an SME, have to arrange now if we use AI in HR?

  Five things already apply: AI literacy of the people who work with the tools, no emotion recognition in the workplace, including for applicants, the transparency rules of Article 50, the GDPR (information, no solely automated rejections without safeguards, a DPIA where one is mandatory) and, if you have a works council, the council's consent for personnel data and monitoring systems. Use the time until 2 December 2027 to prepare for the high-risk duties.

• What does human oversight of a high-risk AI system for HR mean in practice?

  From 2 December 2027 you assign human oversight to people with the necessary competence, training and authority, who are given support. They must be able to monitor the operation, remain aware of the tendency to rely too much on the outcome, interpret the output correctly and, in any situation, decide not to use the outcome or to reverse it. A recruiter who just clicks 'agree' does not meet that.

• What duties do we have from December 2027 as a deployer of a high-risk HR system?

  You use the system in accordance with the instructions for use and monitor it, assign human oversight to competent and authorised people, ensure that the input data you control is relevant and representative, keep the logs for at least six months and inform employees and the people the system decides about. These duties of Article 26 apply from 2 December 2027.

• Where can an applicant or employee lodge a complaint about an AI system?

  Since 2 August 2026, anyone who considers that the AI Act has been infringed can lodge a complaint with the relevant market surveillance authority. On 9 October 2026 the AP announced that it is the intended market surveillance authority for AI but has not yet been designated. Its powers for AI market surveillance follow once the implementing act applies. If the complaint concerns the processing of personal data, the data subject can lodge a complaint with the Dutch Data Protection Authority.

• Who is responsible if a temporary employment or recruitment agency uses AI to select candidates for us?

  For the AI Act, it is whoever uses the system under their own authority; usually that is the agency. For personal data, the GDPR role decides: if the agency itself determines the purpose and means, it is a controller itself; if it processes only on your behalf, it is your processor; if you jointly determine purpose and means, you record the allocation of responsibilities. Record in the contract who uses which tool.

This page gives general information based on the text of the law. It is not legal advice for your situation.