AI in hiring: what an EU employer has to sort out before December 2027

Your applicant tracking system got an update. It now ships a "matching" feature that ranks applications by fit. Nobody asked you, and your HR team already uses it because it saves two hours per open role. Here is the catch: that feature is exactly the kind of tool the EU AI Act lists as high-risk, and data protection regulators are already looking at recruitment.

The short answer, as the law stands on 12 October 2026: yes, you can hire with AI in the EU. One practice is already banned, reading a candidate's emotions. A rejection decided by the machine alone is already restricted by the GDPR. The obligations that apply to tools which screen or score candidates start on 2 December 2027. Getting an HR tool compliant takes months, so the work starts now.

Banned since February 2025

Inferring the emotions of a candidate or an employee. Article 5 of Regulation (EU) 2024/1689, in application since 2 February 2025, prohibits AI systems that infer emotions in the workplace, except for medical or safety reasons. A video interview tool that claims to measure a candidate's motivation or honesty from their face or voice falls squarely inside it.

This is the prohibited-practices tier, with the heaviest fines in the Act: up to 35 million euros or 7% of worldwide turnover. If a vendor still sells you that feature, the conversation is short.

Already enforced, without waiting for the AI Act

The GDPR already applies to every CV that enters your tool. Article 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. A rejection email sent before any human has actually looked at the application is exactly that.

France shows where enforcement is heading. The CNIL, the French data protection authority, put recruitment on its list of priority inspections for 2026 (published 3 April 2026, in French). Inspections target large companies and recruitment firms first, and focus on automated decision-making and the information given to candidates. The CNIL says this work prepares its future role as the AI Act market surveillance authority for employment.

One more rule already in force: if your careers site runs a chatbot that answers candidates, it has to disclose that it is an AI. That is Article 50 of the AI Act, applicable since 2 August 2026. The duty sits with the tool's provider. If you had the chatbot built for you, the provider is you.

2 December 2027: what the AI Act requires from screening and scoring tools

Annex III of the AI Act classifies as high-risk the AI systems used for recruitment or selection, including those that filter applications or evaluate candidates. These rules were due on 2 August 2026. The AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026 according to the European Commission, moved them to 2 December 2027. We covered the delay in Is the EU AI Act delayed?

Your company is then the "deployer" of the tool, and Article 26 sets out its duties. In plain words:

• use the tool as the provider's instructions say, without stretching it: a pre-screening tool does not become the tool that makes the final call;
• give oversight to a trained person who has real authority to overrule the machine (an automatic approval click does not count);
• inform workers' representatives and affected employees before the tool goes live, not after;
• tell candidates that an AI system is involved in decisions about them;
• keep the tool's logs for at least six months and report serious incidents.

Why not wait until late 2027

Because none of this gets fixed in a week. You need to renegotiate the vendor contract to settle who carries what, train the recruiters who oversee the tool, go through your employee representatives and document all of it. And the GDPR has no postponed deadline: regulators are already checking candidate information and automated decisions.

The trap is the sensitive tool nobody decided on: a feature the vendor added to software the company was already paying for. That is why an inventory starts with the list of software, not the list of AI projects. One case we described in our EU AI Act article: at an industrial group, thirty minutes of inventory with the HR director turned up a CV pre-screening tool that sat in the high-risk tier. Nobody knew.

We ran the exercise on ourselves first: our own products, Story Studio and Micro Drama, screen no candidates and assess no employees. That was a design choice. Mapping your uses also tells you where you refuse to go.

The move for this week: four written questions to your vendor

You don't need a law firm to get started. Take your recruitment software and send the vendor these four questions in writing:

• Does your tool score or rank candidates, and is that feature switched on for us?
• Do you classify it as high-risk under Annex III of the AI Act?
• Who is responsible for what between us, and which instructions for use do you provide?
• Where are the operating logs kept, and how do we access them?

Keep the answers in a register. A spreadsheet is enough. A vendor who doesn't answer has already told you something.

Then train the recruiters. Article 4 of the AI Act, in application since February 2025 and softened by the Omnibus, already asks companies to take measures to build their teams' AI literacy, and the human oversight required in 2027 only works if the person overseeing knows what the tool does. For the board-level view, read the EU AI Act for executives.

Read next

Is the EU AI Act delayed? What still applies to your company AI governance and the EU AI Act: what your leadership team must decide now Shadow AI: your teams already use AI without you