Knowledge base · AI in HR

Does the AI Act also apply if we use an HR tool from an American or other non-European supplier?

Yes. The Regulation applies to deployers established in the EU, so to you as a Dutch employer, wherever the supplier is based. The supplier is also covered itself if it places the system on the market or puts it into service in the EU; for high-risk systems a non-European provider appoints an authorised representative in the EU. For personal data, the GDPR rules on transfers outside the EU apply as well.

In force now (since 2 February 2025)Trusq editorial · checked against the official textLast verified: 3 October 2026

Next step: Map your AI tool

Who the Regulation applies to

The Regulation applies, among others, to providers placing AI systems on the market or putting them into service in the EU, wherever they are established, to deployers that are established in the EU, and to providers and deployers outside the EU where the output is used in the EU ^[1].

An authorised representative in the EU

A provider from a third country appoints an authorised representative in the EU before placing a high-risk system on the market ^[2]. For HR systems that applies from 2 December 2027 ^[3]. Ask your supplier who that is.

Personal data outside the EU

If data of applicants or employees is processed outside the EU, that is allowed only under the conditions for transfers ^[4]. Include that in the data processing agreement.

Your own duties

Your duties as a deployer, such as AI literacy now ^[5] and the high-risk duties from 2027, do not depend on where the supplier is based.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

Literacy programme AI Act 4

Sources

[1] AI Act Art. 2(1)(a) to (c) (AI Act, Regulation (EU) 2024/1689). Scope: providers placing on the market in the EU, deployers in the EU, and parties outside the EU where the output is used in the EU.
1. This Regulation applies to: (a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country; (b) deployers of AI systems that have their place of establishment or are located within the Union; (c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;
Source, retrieved on 3 October 2026.
[2] AI Act Art. 22(1) (AI Act, Regulation (EU) 2024/1689). Providers from third countries appoint an authorised representative in the EU for high-risk systems.
1. Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.
Source, retrieved on 3 October 2026.
[3] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
Source, retrieved on 3 October 2026.
[4] GDPR Art. 44 (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A transfer to a third country is allowed only under the conditions of Chapter V.
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor,
Source, retrieved on 3 October 2026.
[5] Regulation (EU) 2026/1744 Art. 1(5) (replaces AI Act Art. 4(1)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Deployers take measures that support the development of AI literacy.
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
Source, retrieved on 3 October 2026.

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.