EU AI Act for recruiters: the complete 2026 implementation playbook
EU AI Act for recruiting: what you actually need to do before August 2026. Article checklist, FRIA template, vendor questions, and timeline.
EU AI Act for recruiters:
the complete 2026 implementation playbook
August 2, 2026: high-risk AI Act provisions become enforceable. Recruiting AI is high-risk by definition (Annex III). If you use AI for sourcing, screening, scoring, interview analysis, or candidate matching — that's you. This playbook covers what each Article requires, what your vendor must provide, what you must do as the deployer, and the exact implementation timeline to be compliant before enforcement.
In this guide
What's in scope (and what isn't)
EU AI Act Annex III, point 4 covers AI systems used for:
- Recruitment or selection of natural persons (placing advertisements, analyzing applications, evaluating candidates)
- Making decisions affecting work-related relationships (promotion, termination, task allocation, monitoring/evaluation)
In scope
- AI screening of CVs / applications
- AI sourcing agents
- AI scoring / ranking candidates
- AI interview analysis / notetakers
- AI generating interview questions or scorecards
- AI bias detection in JDs
- AI for diversity sourcing
Likely in scope
- AI-drafted reject reasons
- AI-generated offer letters with comp-band integration
- AI fraud detection on CVs
Out of scope
- Non-AI ATSes (pre-AI Greenhouse, basic Workday Recruiting)
- Generic productivity tools (Notion, Google Docs)
- Pure transcription with no scoring or evaluation
Article-by-article requirements
Article 11 — Technical documentation
Who: the AI provider (vendor) creates this; the deployer (you) must obtain it. What: documentation of training data, model architecture, performance metrics, known limitations, failure modes. Action: request from your vendor in writing. If not available, escalate or replace vendor.
Article 12 — Automatic logging
Who: provider builds the logging; deployer maintains access. What: every AI decision must be logged with timestamp, model version, input hash, output, and the human action taken on it. Action: verify your vendor's log is accessible to you as deployer, not just internal to vendor. Logs must be retained for at least 6 months.
Article 13 — Transparency and provision of information
Who: provider documents; deployer informs users. What: recruiters/HM must be informed they're using AI, told its capabilities and limitations. Action: training program for all users of the AI system. Document training delivery.
Article 14 — Human oversight
Who: provider designs the UX; deployer operates it. What: meaningful human ability to review, override, and correct AI outputs. UX must surface reasoning, not just rubber-stamp button. Action: audit your AI workflow — can recruiters actually understand and override? Document the oversight procedure.
Article 15 — Accuracy, robustness, cybersecurity
Who: provider technical concern primarily. What: AI system must meet accuracy and robustness standards. Action: review vendor's published performance metrics.
Article 26 — Obligations of deployers
Who: you, the deployer. What: documented oversight procedures, designated responsible person, monitor system in use, suspend if needed, retain logs. Action: SOP document, designated AI accountable owner, monitoring procedure, suspension authority.
Article 27 — Fundamental Rights Impact Assessment (FRIA)
Who: deployer. Required for: public sector entities + private companies in certain sensitive contexts. What: assess impact on fundamental rights before deployment. Action: use the FRIA template (tenperzent provides one); complete before go-live; refresh annually or on material change.
Article 29 — Right to lodge a complaint
What: affected persons (candidates) can complain to market surveillance authorities. Action: have a documented appeal process; respond within 30 days; document outcome.
Questions to ask your vendor
Use this as a one-page vendor scorecard:
- Is your Article 11 technical documentation published? Send me the link.
- Is your Article 12 log accessible to me as deployer? Show me where.
- What's your Article 14 human oversight UX? Walk me through a reject workflow.
- Do you provide a FRIA template?
- What's your DPA? Send me a copy.
- Who are your sub-processors?
- Where's data hosted? EU residency options?
- What's your Article 29 appeal workflow? How fast do you resolve?
- What's your accuracy/bias-audit performance? Send latest report.
- Have you been audited by any DPA or market surveillance authority?
A vendor that can't answer 8/10 should not be used for EU recruiting AI deployment in 2026.
Implementation timeline (start ASAP)
Month 1: Inventory and assess
- Inventory all AI systems used in recruiting workflow
- Classify each: high-risk (Annex III) vs not
- For each high-risk system: request Article 11 docs from vendor
- Designate AI accountable owner
Month 2: Document and design
- Draft Article 26 SOP for each high-risk system
- Run FRIA for each system
- Update candidate-facing privacy notices (GDPR Art 13/14)
- Design Article 22 appeal workflow
Month 3: Train and test
- Train all users (Article 13 transparency)
- Test Article 14 oversight UX with real cases
- Verify Article 12 log access
- Pilot appeal workflow
Month 4-5: Operationalize
- Move from pilot to full deployment
- Establish monitoring + reporting cadence
- Quarterly bias audit (4/5 rule)
- Document everything for regulator audit
Month 6: Pre-enforcement readiness
- External audit / readiness review
- Tabletop exercise: regulator audit simulation
- Fix gaps
If you start in May 2026, you have ~3 months. Start now.
Pricing reflects public listings and customer-reported estimates as of Q2 2026. Vendors change pricing without notice — always verify. tenperzent publishes pricing at tenperzent.com/pricing.
Frequently asked questions
When does the EU AI Act apply to recruiting?
August 2, 2026 for high-risk AI provisions (Annex III recruiting use cases). Some provisions (prohibited AI practices, GPAI obligations) applied earlier. If you use AI for sourcing, screening, scoring, or interview analysis — August 2026 is your deadline.
Is AI sourcing covered by the EU AI Act?
Yes — Annex III explicitly covers AI for recruiting/selection. AI sourcing agents are clearly in scope. Tools like HireEZ, Metaview Sourcing, SeekOut, and tenperzent's sourcing all need to comply.
What is FRIA and is it required?
Fundamental Rights Impact Assessment. Required for public sector deployers + private companies in certain contexts. Best practice: do one regardless. tenperzent provides templates; if your vendor doesn't, find another vendor.
What's the difference between Article 14 (AI Act) and Article 22 (GDPR)?
Article 14 (AI Act): the AI system must enable meaningful human oversight by the deployer's staff (recruiters). Article 22 (GDPR): the candidate has the right to human review if their decision is solely automated. Both apply to AI recruiting.
Do I need to disclose AI use to candidates?
Yes — multiple legal bases require it: GDPR Article 13/14 (information about processing), EU AI Act Article 13 (transparency), Italian Garante guidance (explicit notice). Standard practice: paragraph in application-form privacy notice.
What if my AI vendor isn't EU AI Act compliant?
You as deployer remain liable. Options: pressure vendor for documentation, switch vendors, or stop using the AI system. Don't deploy non-compliant AI hoping the vendor catches up. tenperzent ships a complete pack today; most others have roadmap commitments.
What are penalties for non-compliance?
Up to €35M or 7% of global annual turnover (whichever higher) for the most serious violations. Less severe: €15M or 3%. The fines are designed to bite — far higher than GDPR maximums. Compliance is not optional.
Does the EU AI Act apply to non-EU companies?
Yes — extraterritorial. Any AI system whose output is used in the EU is covered, regardless of where the system or company is based. US vendors selling to EU buyers are in scope. EU buyers cannot escape obligations by using US vendors.
Stop fighting your ATS. Start hiring.
Focus on people, not paperwork. Screen your first 100 CVs free. No credit card, no setup call.