AI in HR and recruitment: what may be automated and what may not

Artificial intelligence in HR can be used for the administration around recruitment, that is logging applications, answering practical questions and moving data between systems. Assessing candidates, selection and rejection should stay with a person. This is not just our rule: the European AI Act classifies systems for recruiting and selecting people as high-risk.

This article is not legal advice. It explains what we have read in the regulations. For your company’s specific situation, consult a lawyer.

What does the AI Act say about recruitment?

Regulation (EU) 2024/1689, known as the AI Act, lists in Annex III, point 4 the area of “employment, workers’ management and access to self-employment”. According to the wording we checked on artificialintelligenceact.eu, this covers:

“AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”

Note the word “intended”. What counts is what the system is intended for. A tool that filters applications or evaluates candidates is high-risk. A tool that tells a candidate when the interview takes place does not evaluate candidates. The line is always judged by the specific use, so when in doubt, ask a lawyer.

Point 4 also covers another part of the employment relationship: systems that decide on working conditions, promotion or termination, allocate tasks based on behaviour or personal traits, or monitor and evaluate people’s performance.

What does “high-risk” mean for a company?

Put simply: such a system is subject to stricter obligations than ordinary software, and responsibility also lies with the company that uses it. We have not verified the specific obligations (documentation, human oversight, informing the people concerned) for this article and will not describe them from memory. If you are considering AI for assessing candidates, it is a decision that needs legal assessment, not an ordinary tool purchase.

When does it apply from?

Originally, the obligations for high-risk systems were to start applying on 2 August 2026. The simplification of the AI Act (the “AI Omnibus”) came into force on 27 July 2026 and, according to the European Commission, the rules for the high-risk areas under Annex III, which include employment, will apply from 2 December 2027 (digital-strategy.ec.europa.eu).

So there is more time than it first seemed, but not unlimited time. A company that deploys a CV-sorting tool today will, in a little over a year, have to meet the rules for high-risk systems with it. Deadlines in this area have already changed once, so check the current state before you decide.

What can be safely automated in HR?

Administration in which AI does not assess anyone:

• Logging applications in the records. An application arrives by e-mail and the details are entered into the recruitment system without manual retyping.
• Answering candidates’ practical questions. When the interview takes place, which documents to bring, what stage the process is at. The assistant answers from materials the company has given it and passes more sensitive questions to a person.
• Invoices from job portals and suppliers. They are read and prepared for posting, as with other invoices (how it works).
• Moving data between systems. E-mail, form, recruitment system and accounting pass data to each other on their own.

This administrative layer does not make a decision about a person. Even so, the usual rule for personal data applies: know in advance where the data is and who has access to it (AI in your company, safely).

What should stay with a person?

• Assessing candidates. Scoring CVs, ranking candidates, estimating “suitability”.
• Selection. Who goes through to an interview and who does not.
• Rejection. Nobody should receive a “no” just because a model decided so.
• The job offer.

Besides the AI Act, the GDPR also applies here. Its Article 22(1) says:

“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”

We checked the wording on gdpr-info.eu. Whether rejecting a candidate is assessed this way in a specific case is a legal question. The practical conclusion is simple: if a person makes the decision and AI only hands them material that they verify themselves, the risk is lower than with automatic rejection.

How we do it

In our AI automation for HR and recruitment service, we promise only administration: AI does not screen out or score candidates, does not assess CVs and does not reject anyone automatically. The assistant for candidates (AI assistant) answers routine questions from the materials and passes on whatever is missing from them to a person. For the wider context of how we approach processes in companies, see the AI automation page.

If you have few vacancies a year, the deployment will probably not pay off. We would rather say so upfront than sell automation for a handful of interviews.

What to watch out for when choosing a tool

When a supplier offers you “AI for candidate selection”, ask:

• Does it assess, filter or rank candidates? If so, it is an area the AI Act designates as high-risk.
• Who decides on the outcome, and can a person change the decision?
• Where is candidates’ data stored?
• Which of this can the supplier confirm in writing?

If you do not get a clear answer to any of these questions, that is a reason to wait.