The EU AI Act and recruitment

Start with the text, because a lot of the confusion comes from paraphrase. Annex III point 4(a) covers “AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements”, and goes on to name analysing and filtering job applications and evaluating candidates. Point 4(b) covers AI used to make decisions on terms of the working relationship, promotion and termination, to allocate tasks, and to monitor and evaluate performance and behaviour.

Systems inside Annex III are high-risk by default under Article 6(2). So the honest list of what is high-risk in recruitment is not short, and this page is not going to pretend otherwise:

• CV screening and application filtering where the system applies evaluative weight.
• Candidate scoring, matching and ranking, including suitability scores and shortlisting.
• Candidate evaluation: assessments, structured scoring, automated interview grading.
• Targeted placement of job advertisements, where an algorithm decides which people see the vacancy.
• Promotion, pay and termination decisions, and anything that materially feeds them.
• Task allocation based on individual behaviour or personal traits.
• Monitoring and evaluation of performance and behaviour of people at work.

If your tooling does any of those, the rest of this page will not help you avoid the high-risk regime, and you should be planning for December 2027 rather than looking for an exit. What follows is about the one category that is routinely swept in and does not belong there.

The phrase “place targeted job advertisements” in point 4(a) is doing a specific job, and on 19 May 2026 the Commission published draft guidelines on the classification of high-risk AI systems that explain which one. The Annex III volume runs to 148 pages of worked examples. Targeted consultation closed on 23 July 2026 and the final text is expected around the end of 2026.

The relevant passage explains the point in terms of advertisements “algorithmically tailored to reach certain groups of individuals”, because that determines who becomes aware of a vacancy and who is encouraged to apply. The mischief is audience determination. Not asset creation. Generating a picture, a script or a headline does not decide who sees the job.

The guidelines then say it directly. Employer branding and generic company advertising “which do not in practice relate to a vacancy, fall outside the use case listed in point 4(a)”. Contextual placement (choosing a website or a location rather than identified people or groups) is treated as outside the point too.

The counter-argument, stated properly. Para. (245) says the activity must relate to or impact the substance of the recruitment process, and lists preparatory steps including “special advertising”. A footnote in the same document warns that job advertisements can strongly influence who succeeds, especially where they set out required qualifications, and that drafting them from biased data can increase discrimination risk. That is a real argument, and it lands on vacancy-specific creative whose imagery or wording is derived from historical hiring data. A generic employer-brand film is comfortably out. The middle of that spectrum is not settled by anything published.

The clearest thing in the draft guidelines for anyone building or buying job-ad tooling is a worked example on AI-generated job descriptions, and it turns on one fact: who supplies the criteria.

A system that generates job descriptions from a list of tasks and a set of qualifications and skills previously defined by a human recruiter is treated as performing a narrow procedural task under Article 6(3)(a), and is exempt. A system where “the AI system itself generates the necessary qualifications and skills based on a high-level description”, or which additionally evaluates CVs against the description it created, cannot rely on the filter and should be classified as high-risk.

That is a crisp, product-shaped test. “Here are the requirements, write me the ad” is on one side. “Here's a job title, work out what the role should require” is on the other. The framing test the guidelines use is whether the system impacts in substance career prospects or workers' rights.

Article 6(3) lets a provider conclude that an Annex III system is not high-risk where it performs only a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns without replacing human assessment, or performs a preparatory task; and where it does not pose a significant risk of harm.

Two things are widely missed about it.

First, profiling closes it. Article 6(3)'s final subparagraph provides that an Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”. There is no balancing exercise and no assessment to write. If the system evaluates personal aspects of identified people, the filter is gone.

Second, claiming it costs you paperwork. Article 6(4) requires the provider to “document its assessment before that system is placed on the market or put into service”, and Article 49(2) requires registration in the EU database even where the provider concluded the system is not high-risk. The derogation converts a heavy regime into a lighter documentation-and-registration regime. It does not produce nothing.

One open point. Whether Article 49(2) registration survived the Digital Omnibus unchanged is something we have not been able to confirm from the amending regulation itself. Secondary commentary says the proposal to remove it did not succeed. If the answer matters to you, verify it against the consolidated text rather than against this page.

All of this bites from 2 December 2027, not 2 August 2026. That includes the Article 6(4) documentation and the Article 49(2) registration.

Roles matter more than product categories here. A provider develops a system and places it on the market or puts it into service under its own name or trademark (Art. 3(3)). A deployer uses a system under its own authority (Art. 3(4)). The same campaign can involve four different companies in three different roles.

Party	Function	Role	From
Ad platform	Targeting and delivery of employment ads	Provider of an Annex III 4(a) system	2 Dec 2027
Employer or agency running the campaign	Buys and directs the targeting	Deployer of that high-risk system	2 Dec 2027
Creative generation tool	Produces the asset from a human brief	Not the Annex III 4(a) actor on the analysis above; provider for Art. 50(2) marking	Art. 50 live now
Employer publishing the creative	Puts the asset in front of people	Deployer for Art. 50(4) labelling	Live now

The practical consequence: the high-risk actor in the job-advertising chain is almost always the platform whose model decides who sees what. Content that tells employers they are carrying Annex III provider obligations because they used a generative tool to make a video has the roles wrong.

Article 50 sits outside the risk tiers entirely. It attaches to a function (conversational, generative, emotion-detecting or deepfake-producing) rather than to a risk classification, which is why the Digital Omnibus deferral missed it. It applied on 2 August 2026.

Two duties matter for recruitment marketing.

Article 50(2), on providers. Outputs of a generative system must be “marked in a machine-readable format and detectable as artificially generated or manipulated”. Systems placed on the market before 2 August 2026 have a transitional period to 2 December 2026. That grace is provider-side, marking-only, and legacy-only.

Article 50(4), on deployers. Whoever publishes a deep fake must disclose that the content is artificially generated or manipulated. There is no transitional period for this one. If you are an employer or an agency publishing AI-generated creative in the EU, the duty is on you today.

Two findings from the Commission's Article 50 guidelines of 20 July 2026 tend to surprise people. First, the deep-fake definition is read broadly enough to cover realistic AI-generated avatars and personas: a photorealistic presenter who is nobody in particular still counts. Second, and more operationally, “deployers cannot rely on the machine-readable marking embedded in the content by the provider under Article 50(2)”, because it is not clear and distinguishable to a person. Machine marking is the provider's duty. A visible label is the deployer's, and it is a separate one.

Article 4 has applied to providers and deployers since 2 February 2025. It is the oldest live obligation in this whole area and it is the one most recruitment teams have never been told about, because it does not carry a headline penalty tier.

The Digital Omnibus softened it rather than removing it. As amended, providers and deployers must “take measures to support the development of AI literacy” of their staff and others operating AI systems on their behalf, with an express statement that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. The Commission is also tasked with publishing practical compliance examples.

That shifts it from an outcome duty to an effort duty, which has a practical implication: the evidence of the measure is the compliance. A dated, role-appropriate briefing for whoever operates the tool (what it does, what it does not do, what has to be labelled, when to escalate) is the deliverable. Note that the AI Act text still displayed on some popular reference sites is the pre-amendment wording; check EUR-Lex for the consolidated position.

Article 5's bans have applied since 2 February 2025 and carry the top penalty tier: up to €35m or 7% of worldwide annual turnover, whichever is higher. Two are directly relevant to recruitment, and one is widely misread.

Emotion recognition in the workplace (Art. 5(1)(f)). Inferring emotions of a natural person in the workplace is prohibited outside medical and safety purposes. The Commission's guidelines on prohibited practices read “workplace” to extend to “candidates during the selection and hiring process”, and give emotion recognition during recruitment as a prohibited example, along with inferring emotions from voice and imagery on video calls. Inferring customers' emotions in a call centre is not caught. If a video-interview or assessment vendor scores enthusiasm, confidence or engagement from face or voice, that is not a high-risk system to be documented; it is a prohibited one.

Biometric categorisation to infer protected attributes (Art. 5(1)(g)). Categorising individuals from their biometric data to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited. There is a carve-out for labelling or filtering lawfully acquired biometric datasets, but it is drafted around datasets, not around inference about an identified person.

The one that is misread: untargeted scraping of facial images (Art. 5(1)(e)). This prohibits creating or expanding facial recognition databases through untargeted scraping. The prohibited-practices guidelines describe such a database as one capable of matching a face against a database of faces, and limit the prohibition to tools placed on the market for that specific purpose. A generative image model trained on scraped web images is not, without more, that thing. The real exposure for scraped training data is data-protection law, not Article 5. That is a distinction a lot of vendor content gets wrong in the alarming direction.

Article 2(1) catches providers placing systems on the Union market wherever they are established, deployers established or located in the Union, and providers and deployers in a third country “where the output produced by the AI system is used in the Union”. That third limb is the one that matters for UK and US employers.

The Commission's Article 50 guidelines read the deployer limb broadly, extending it to entities outside the Union that themselves foresee dissemination and use of the outputs in the Union, including by posting deep fakes on the globally accessible internet, with a limit where content reaches EU audiences through channels that are unforeseeable and outside the deployer's control.

Applied to recruitment: a US or UK employer running an AI-generated job ad aimed at EU-based candidates is caught. A geo-fenced domestic campaign that a VPN user happens to see is not. Whether a single EU viewer of a globally accessible careers page is enough is genuinely unresolved: Article 2(1)(c) says “is used”, Recital 22 says “intended to be used”, no guidance interprets the article directly and no court has construed it. Geo-fencing is a meaningful mitigation. Labelling by default is usually the cheaper answer than the argument.

The UK has no equivalent statute. It has not adopted the AI Act, has no cross-sector AI legislation in force, and continues to run the 2023 pro-innovation approach through existing regulators. The ICO is the one that has actually done work here: its AI tools in recruitment audit outcomes report of 6 November 2024 audited developers of AI sourcing and screening tools, and its recommendations put weight on employers having oversight of their provider's compliance rather than only their own.

Penalties under Article 99: Article 5 breaches up to €35m or 7% of worldwide annual turnover, whichever is higher; most other obligations including Article 50 up to €15m or 3%, whichever is higher. For SMEs and start-ups, Article 99(6) inverts it: each cap is whichever of the euro figure and the percentage is lower. Adherence to an adequate code of practice is a mitigating factor in setting a fine.

The gap is national. Article 70 required Member States to designate notifying and market surveillance authorities by 2 August 2025, and the Digital Omnibus extended nothing about that deadline. The European Parliament's research service reported eight single points of contact out of twenty-seven as of March 2026. The Commission's own register of national market surveillance authorities was last updated on 26 September 2025, which makes the authoritative EU-level list of who enforces this nationally close to a year stale.

Germany moved: the KI-MIG implementing law has been in force since 29 July 2026, with the Bundesnetzagentur as central market surveillance authority and single point of contact on a residual basis, and specialised authorities retaining competence in their own fields. The Netherlands has not: the Uitvoeringswet AI-verordening went through internet consultation in spring 2026 and the Raad van State in July 2026, and had not been submitted to the Tweede Kamer at the time of writing.

The obligations bind everywhere. The apparatus to fine does not yet exist everywhere. For anyone operating across several Member States, that asymmetry is more operationally relevant than the headline penalty figures.

A page that tells you only the parts with clean answers is not useful for planning. Five things in this area are open, and the honest position on each is that nobody knows yet.

• The guidelines are draft. The classification guidelines of 19 May 2026 are the best available signal on Annex III point 4(a) and practitioners are relying on them, but consultation closed on 23 July 2026 and the final text could move.
• Where employer branding stops. Para. (251) puts branding outside the point where it does not in practice relate to a vacancy. Real campaigns run from always-on brand films that link to a vacancies page, through role-family campaigns, to single-vacancy ads. No guidance addresses the middle.
• How far the deep-fake definition reaches. The Commission reads it to cover wholly invented photorealistic people. That is an expansive reading of “existing persons” and no court has tested it. Until one does, the safe course is to label.
• Whether Article 49(2) registration survived the Digital Omnibus. It decides whether claiming the Article 6(3) filter still costs you an EU database entry.
• Whether passive EU viewing triggers Article 2(1)(c). The article says “is used”; the recital says “intended to be used”. Practitioner advice converges on assuming you are caught if your escape depends on a fine reading.