The duty
Deployers of a high-risk system from Annex III that takes or helps to take decisions about natural persons inform those persons that the system is used on them. This applies without prejudice to Article 50 [1].
From when
This duty applies to Annex III systems from 2 December 2027 [2].
What already applies now
Separately, the GDPR already requires now that you inform applicants about the processing of their data and about automated decision-making; see the page on information for applicants.