Skip to content

Knowledge base · AI in HR

Who is responsible if a temporary employment or recruitment agency uses AI to select candidates for us?

For the AI Act, it is whoever uses the system under their own authority; usually that is the agency. For personal data, the GDPR role decides: if the agency itself determines the purpose and means, it is a controller itself; if it processes only on your behalf, it is your processor; if you jointly determine purpose and means, you record the allocation of responsibilities. Record in the contract who uses which tool.

In force nowTrusq editorial · checked against the official textLast verified:

Next step: Record your HR AI tools in Trusq

The AI Act: who uses the system

A deployer is anyone who uses an AI system under their own authority [1]. If an agency selects candidates with its own tool, the agency is that. AI for recruitment and selection is a high-risk application from 2 December 2027 [2] [3], also if an agency deploys it for you.

The GDPR: who determines purpose and means

The controller is whoever, alone or jointly with others, determines the purposes and means of the processing; the processor is whoever processes on behalf of the controller [4]. If you determine purpose and means together with the agency, you are joint controllers and you record who fulfils which duty [5]. If the agency is your processor, you conclude a data processing agreement [6].

What you agree

  • whether and which AI tools the agency uses when selecting for you
  • who informs the candidates about the processing and any automated decisions
  • that you know the selection criteria, so that you can prevent prohibited distinction

Sources

  1. [1] AI Act Art. 3(4) (AI Act, Regulation (EU) 2024/1689). Definition of deployer.
    ‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;
    Source, retrieved on 3 October 2026.
  2. [2] AI Act, Annex III, point 4(a) (AI Act, Regulation (EU) 2024/1689). AI for recruitment or selection is listed in Annex III.
    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
    Source, retrieved on 3 October 2026.
  3. [3] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.
  4. [4] GDPR Art. 4(7) and (8) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Definitions of controller and processor.
    (7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; […] (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
    Source, retrieved on 3 October 2026.
  5. [5] GDPR Art. 26(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Joint controllers record their responsibilities in an arrangement between them.
    1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation,
    Source, retrieved on 3 October 2026.
  6. [6] GDPR Art. 28(3)(a) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The data processing agreement provides that the processor processes only on documented instructions.
    That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation,
    Source, retrieved on 3 October 2026.

Related questions

We are buying an AI tool for HR. Are we then the provider or the deployer?What do we agree with the supplier of an AI tool for HR?May an AI selection tool distinguish between candidates on the basis of sex, origin or other characteristics?What do we have to tell applicants if we use AI to process their data?

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.