Skip to content

Knowledge base · AI in HR

Is our AI tool for recruitment, selection or personnel management a high-risk system?

Probably. The AI Act expressly names AI for recruitment and selection, and for decisions on terms of employment, promotion, dismissal, task allocation and tracking performance and behaviour, as high-risk. Only a system without a significant risk, such as a narrow procedural task, falls outside, but never if it profiles persons. The duties apply from 2 December 2027.

Prepare; applies from 2 December 2027Trusq editorial · checked against the official textLast verified:

Next step: Map your AI tool

Which HR uses are in Annex III

Annex III, point 4, names two groups. First, AI for recruiting or selecting persons, in particular for placing targeted job advertisements, analysing and filtering applications and evaluating candidates [1]. Second, AI for decisions on terms of employment, promotion or termination, for task allocation based on behaviour or personal characteristics, and for monitoring and evaluating performance and behaviour [2]. Systems in Annex III are considered high-risk [3].

The exception, and where it stops

A system in Annex III is not a high-risk system if it does not pose a significant risk. That is possible only if it is intended to perform a narrow procedural task, to improve the result of a previously completed human activity, to detect deviations from decision-making patterns without replacing human assessment, or to perform a preparatory task [4]. A system that profiles persons is always high-risk [5]. Profiling is automated processing that evaluates personal aspects, in particular to analyse or predict performance at work, reliability or behaviour [6] [7]. A tool that ranks or scores candidates does so as a rule.

What to ask your supplier

If the provider considers that its HR tool falls under the exception, it must document that assessment before placing the system on the market, and register the system [8]. Ask for that assessment if your supplier says its tool is not high-risk.

From when

The high-risk rules apply to Annex III systems from 2 December 2027 [9].

Sources

  1. [1] AI Act, Annex III, point 4(a) (AI Act, Regulation (EU) 2024/1689). AI for recruitment or selection, such as placing targeted job advertisements, analysing and filtering applications and evaluating candidates, is listed in Annex III.
    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
    Source, retrieved on 2 October 2026.
  2. [2] AI Act, Annex III, point 4(b) (AI Act, Regulation (EU) 2024/1689). AI for decisions on terms of employment, promotion or termination, for task allocation based on behaviour or characteristics, and for monitoring and evaluating performance and behaviour is listed in Annex III.
    AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.
    Source, retrieved on 2 October 2026.
  3. [3] AI Act Art. 6(2) (AI Act, Regulation (EU) 2024/1689). AI systems referred to in Annex III are considered to be high-risk.
    In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.
    Source, retrieved on 2 October 2026.
  4. [4] AI Act Art. 6(3), first and second subparagraph (AI Act, Regulation (EU) 2024/1689). An Annex III system is not a high-risk system if it does not pose a significant risk, which is possible only for a narrow procedural task, improving the result of a previously completed human activity, detecting deviations from decision-making patterns without replacing human assessment, or a preparatory task.
    By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The first subparagraph shall apply where any of the following conditions is fulfilled: (a) the AI system is intended to perform a narrow procedural task; (b) the AI system is intended to improve the result of a previously completed human activity; (c) the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or (d) the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.
    Source, retrieved on 2 October 2026.
  5. [5] AI Act Art. 6(3), third subparagraph (AI Act, Regulation (EU) 2024/1689). An Annex III system that profiles natural persons is always a high-risk system.
    Notwithstanding the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons.
    Source, retrieved on 2 October 2026.
  6. [6] AI Act Art. 3(52) (AI Act, Regulation (EU) 2024/1689). The AI Act uses the notion of profiling from the GDPR.
    ‘profiling’ means profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679;
    Source, retrieved on 2 October 2026.
  7. [7] GDPR Art. 4(4) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Profiling is automated processing that evaluates personal aspects, in particular to analyse or predict performance at work, reliability or behaviour.
    ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
    Source, retrieved on 2 October 2026.
  8. [8] AI Act Art. 6(4) (AI Act, Regulation (EU) 2024/1689). A provider that considers its Annex III system not to be high-risk documents that assessment before placing it on the market and registers the system.
    A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service. Such provider shall be subject to the registration obligation set out in Article 49(2).
    Source, retrieved on 2 October 2026.
  9. [9] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 2 October 2026.

Related questions

From when do the high-risk duties apply to AI in HR?What duties do we have from December 2027 as a deployer of a high-risk HR system?We are buying an AI tool for HR. Are we then the provider or the deployer?Is our recruitment software with filters or matching an AI system under the AI Act?Is targeted advertising of job vacancies with AI covered by the high-risk rules?

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.