Skip to content

Knowledge base · AI in HR

What do we agree with the supplier of an AI tool for HR?

If the supplier processes personal data of applicants or employees for you, you conclude a data processing agreement with the subjects the GDPR prescribes, and you choose only a supplier that provides sufficient guarantees. If the tool is a high-risk system from 2 December 2027, the supplier must supply instructions for use covering, among other things, the intended purpose, the accuracy, the human oversight measures and the logs. Ask for that information now: you need it for your DPIA and for correct use.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified:

Next step: Record your HR AI tools in Trusq

The data processing agreement

You engage only processors that provide sufficient guarantees [1]. The agreement provides, among other things, that the supplier processes the data only on your documented instructions, including with regard to transfers to a country outside the EU [2], and it is set out in writing or in electronic form [3]. Ask where the data is processed: a transfer outside the EU is allowed only under the conditions of the GDPR [4].

What a provider of high-risk AI supplies

A high-risk system comes with instructions for use containing concise, complete, correct and clear information [5], including the intended purpose and the level of accuracy [6], the human oversight measures [7] and how you can collect, store and interpret the logs [8].

Why you need that information

You must use the system in accordance with the instructions for use [9], and you use the provider's information for your DPIA [10]. Those duties start on 2 December 2027 [11], but a DPIA may already be needed now. So include in the contract that the supplier provides and updates this information.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Use per instructions and monitoring AI Act 26, AI Act 73
  • DPIA using the provider's information AI Act 13, AI Act 26

Sources

  1. [1] GDPR Art. 28(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The controller engages only processors that provide sufficient guarantees.
    1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
    Source, retrieved on 3 October 2026.
  2. [2] GDPR Art. 28(3)(a) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The data processing agreement provides that the processor processes only on documented instructions, including for transfers.
    That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation,
    Source, retrieved on 3 October 2026.
  3. [3] GDPR Art. 28(9) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The agreement is drawn up in writing, including in electronic form.
    9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.
    Source, retrieved on 3 October 2026.
  4. [4] GDPR Art. 44 (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A transfer to a third country is allowed only under the conditions of Chapter V.
    Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor,
    Source, retrieved on 3 October 2026.
  5. [5] AI Act Art. 13(2) (AI Act, Regulation (EU) 2024/1689). High-risk systems come with instructions for use containing concise, complete, correct and clear information.
    2. High-risk AI systems shall be accompanied by instructions for use in an appropriate digital format or otherwise that include concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers.
    Source, retrieved on 3 October 2026.
  6. [6] AI Act Art. 13(3)(b) (AI Act, Regulation (EU) 2024/1689). The instructions for use state, among other things, the intended purpose and the level of accuracy.
    (b) the characteristics, capabilities and limitations of performance of the high-risk AI system, including: (i) its intended purpose; (ii) the level of accuracy,
    Source, retrieved on 3 October 2026.
  7. [7] AI Act Art. 13(3)(d) (AI Act, Regulation (EU) 2024/1689). The instructions for use state the human oversight measures.
    (d) the human oversight measures referred to in Article 14, including the technical measures put in place to facilitate the interpretation of the outputs of the high-risk AI systems by the deployers;
    Source, retrieved on 3 October 2026.
  8. [8] AI Act Art. 13(3)(f) (AI Act, Regulation (EU) 2024/1689). The instructions for use describe how deployers can collect, store and interpret the logs.
    (f) where relevant, a description of the mechanisms included within the high-risk AI system that allows deployers to properly collect, store and interpret the logs in accordance with Article 12.
    Source, retrieved on 3 October 2026.
  9. [9] AI Act Art. 26(1) (AI Act, Regulation (EU) 2024/1689). Deployers use the system in accordance with the instructions for use.
    Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.
    Source, retrieved on 3 October 2026.
  10. [10] AI Act Art. 26(9) (AI Act, Regulation (EU) 2024/1689). Deployers use the information under Article 13 for their DPIA.
    Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679
    Source, retrieved on 3 October 2026.
  11. [11] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 3 October 2026.

Related questions

Do we have to carry out a DPIA before we use AI in recruitment or personnel management?What duties do we have from December 2027 as a deployer of a high-risk HR system?We are buying an AI tool for HR. Are we then the provider or the deployer?May recruiters paste CVs or candidate data into ChatGPT or another AI chatbot?

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.