EU's AI Act Flags Hiring Software As High Risk, Fines Reach €35M

Employers are scrambling to determine whether AI-powered recruitment tools are high-risk under the EU Artificial Intelligence Act (AI Act) ahead of compliance deadlines beginning after August 2024.

Key Takeaways

AI systems used in hiring, including resume screening, candidate ranking and interview analysis, are classified as high-risk under Article 6
High-risk hiring systems require risk assessment, human oversight and data governance under the AI Act
Employers must conduct conformity assessments, maintain technical documentation and ensure meaningful human review of automated decisions affecting candidates
Penalties for noncompliance can reach €35 million or 7% of global annual turnover, whichever is higher

The official text, published in the Official Journal of the European Union and searchable through the AI Act Explorer, classifies AI systems used in hiring, including resume screening, candidate ranking and interview analysis software, as high-risk under Article 6, according to EUR-Lex.

Searches for the full text of the law surged this week, including for the document in PDF form.

That classification triggers obligations around risk assessment, human oversight and data governance that employers must meet on a staggered timeline tied to the law’s entry into force in August 2024. The spike in searches reflects a practical scramble.

Compliance officers, HR departments and employment lawyers are treating the regulation’s text as a working reference rather than background reading, cross-checking specific annexes against existing hiring software contracts.

Also Read: EU’s AI Act Gap: 21 Of 24 AI Giants Hide Scraped Websites In Data Filings

Why Recruitment Tools Draw Extra Scrutiny

The AI Act places hiring systems in Annex III, the list of high-risk use cases that face the strictest obligations short of an outright ban. Employers deploying such systems must conduct conformity assessments, maintain technical documentation and ensure meaningful human review of automated decisions that affect job candidates.

That requirement sits alongside existing obligations under the General Data Protection Regulation, Europe’s data privacy law, which already requires a lawful basis for processing candidate data and grants individuals the right to contest purely automated decisions.

The two frameworks overlap but are not identical, and lawyers reviewing the Act’s text say employers cannot assume GDPR compliance alone satisfies the newer law.

What Employers Are Checking For

Legal teams combing the PDF are focused on definitions. Whether a tool merely sorts applications or actively influences a hiring decision determines its risk tier, and the text’s wording on “significant influence” has become a key reference point for vendors and employers alike. Penalties for noncompliance can reach €35 million or 7% of global annual turnover, whichever is higher, giving the document’s fine print direct financial consequence.