AI in hiring is the highest-scrutiny use case in the EU AI Act. Aegis Firma helps HR tech companies and enterprise HR teams document, audit, and demonstrate compliance before regulators come calling.
€15M / 3%
max EU AI Act fine, high-risk non-compliance (Art. 99(4))
High-risk
AI Act class for hiring AI
Annex III §4
covers hiring, monitoring & evaluation
AI used in hiring, promotion, and employee monitoring falls under the highest scrutiny tier of the EU AI Act (Annex III §4). Vendors and deployers of these systems face mandatory conformity assessments, candidate notification obligations, and human oversight requirements — with fines up to €15M or 3% of global turnover for high-risk non-compliance (Art. 99(4)), higher for prohibited practices.
Hiring AI is mandatory high-risk
CV screening, candidate scoring, and automated interview tools are high-risk under EU AI Act Annex III §4(a). A conformity assessment is required before deployment. No exceptions for SMEs.
Candidate notification obligation
Candidates must be told if AI is used to assess them in the hiring process. Failing to disclose this is a violation of both EU AI Act transparency rules and GDPR.
Employee monitoring AI
Productivity monitoring, performance scoring, and email analysis tools are high-risk under Annex III §4(b) where they affect employment decisions. Works council consultation is required in the EU.
Algorithmic bias and protected characteristics
EEOC (US), EHRC (UK), and national DPAs are actively investigating AI hiring tools for discrimination. Bias audits and evidence of fairness testing are required.
GDPR automated profiling restrictions
GDPR Article 22 prohibits solely automated decisions with significant effects on candidates. Human review in the loop is mandatory — and must be genuine, not rubber-stamping.
Works council rights in the EU
In Germany (BetrVG), France, and other EU countries, deploying monitoring or evaluation AI requires mandatory consultation with the works council before rollout.
EU AI Act conformity assessment toolkit
Guided documentation for hiring AI systems: technical documentation, risk management system records, and logging requirements per Regulation Art. 9–19.
Candidate disclosure generator
Generate GDPR and EU AI Act-compliant candidate disclosure notices in 27 EU languages, explaining how AI is used in their assessment.
AI bias testing framework
Document your algorithmic impact assessment process, track bias testing results by protected characteristic, and generate reports for regulatory inspections.
GDPR Article 22 compliance toolkit
Templates and audit trails for documenting the human review element of AI-assisted hiring decisions to demonstrate that decisions are not "solely automated".
Employee AI policy — bulk send
Deploy your AI use policy to all employees, collect e-signatures, and track completion. Satisfies works council documentation requirements.
EU AI Act database registration
Guidance and pre-filled templates for registering high-risk hiring AI systems in the EU AI Act database (required before deployment).
We use a third-party ATS with AI screening — are we liable under the EU AI Act?
Yes. Under the EU AI Act, both providers (who build the system) and deployers (who use it in hiring decisions) have obligations. As a deployer, you must conduct due diligence on the vendor's conformity documentation, implement human oversight, and notify candidates. You cannot outsource your compliance obligations to the vendor.
Is AI-assisted scheduling or job matching also high-risk?
Not automatically. AI tools that simply schedule interviews or recommend job listings are generally not high-risk. High-risk triggers when the AI output materially influences whether a candidate progresses in the selection process or receives a job offer.
What is "meaningful human oversight" for EU AI Act hiring compliance?
The EU AI Act requires that a human can understand, override, and is genuinely empowered to reject AI recommendations. Simply having a recruiter click "approve" on 200 AI-ranked candidates without reviewing them does not meet the standard. Aegis Firma helps you design and document an oversight process that satisfies the requirement.
Do we need a DPIA for hiring AI?
Yes. Processing job candidates' personal data using AI for profiling or automated decision-making triggers GDPR Article 35 DPIA requirements. The DPIA should assess risks including discrimination, data security, and accuracy of the AI model.
Cancel anytime · 7-day refund eligibility · no contracts