The EU AI Act in Employment

Employment AI systems covered by the Act

How a system is used determines which requirements apply. Some uses are prohibited. Many employment applications are classified as high-risk and require additional safeguards, subject to the narrow carve-out in Article 6(3). Certain systems also have transparency requirements. Annex III identifies the covered employment uses.

1. Recruitment and selection. Tools that target job advertisements, find candidates, screen resumes, or score and rank applicants.
2. Performance and task allocation. Systems that evaluate performance or behavior, or assign work based on personal characteristics, behavior, or output.
3. Worker monitoring. AI systems that track and analyze how employees work. Workplace emotion recognition is addressed separately under the prohibited-practices rules.
4. Promotion and termination. Systems that support decisions about promotions, employment terms, or ending employment.

Review the features enabled in your recruiting and HR platforms. An automated resume screener or interview-scoring feature may fall within the high-risk category. The software provider and employer have separate responsibilities under the Act.

Key dates

The Act takes effect in stages. These are the dates employers should plan around.

The Act entered into force on 1 August 2024. The original deadline for high-risk employment systems was 2 August 2026. The Digital Omnibus moved that deadline to 2 December 2027. It was agreed on 7 May 2026 and formally adopted in June 2026 (Parliament 16 June, Council 29 June, signed 8 July 2026). The Article 50 transparency requirements apply from 2 August 2026, with a grace period through 2 December 2026 for machine-readable marking by certain generative systems already on the market. Use the 2 December 2027 date to organize your review of high-risk employment systems. The prohibited-practice and AI literacy requirements have applied since February 2025.

What applies now

Start with prohibited uses and AI literacy requirements. The Act’s prohibited-practices rules have applied since 2 February 2025.

For employers, one important provision is the workplace emotion-recognition ban. It covers systems that infer a worker’s emotions from their face, voice, or body, including video-interview tools that infer a candidate’s emotional state from facial or voice data.

The ban applies to emotion recognition based on biometric data. Sentiment scoring of written text falls outside that prohibition. Workplace emotion recognition is prohibited, with narrow exceptions for medical or safety reasons.

Check recruiting and workforce technology for these capabilities, including features provided by third-party vendors.

AI literacy requirements also apply now. Providers and deployers both have responsibilities for helping the people who work with these systems understand them. Focus training on employees who select, operate, or oversee the technology. They should understand what it does, its limitations, and when human judgment is needed.

What vendors and employers are responsible for

High-risk systems require risk management, data governance, and quality checks for data used to train and operate them. They also require technical documentation, automatic activity logging, transparency, and clear instructions for use.

Human oversight must be built into the system so a person can understand and override it. The system must meet accuracy and robustness requirements appropriate to its intended use.

Your organization's responsibilities depend on whether it is the provider or deployer.

Provider Typically the software developer or supplier

The provider develops the system or places it on the market under its own name. Its responsibilities include technical safeguards, risk management, documentation, quality management, conformity assessment, CE marking, and registration in the EU database. For most employers purchasing commercial software, the vendor fills this role.

Deployer Typically the employer using the system

Employers using high-risk systems have their own responsibilities. These include following the instructions for use, assigning oversight to competent people with the authority to act, retaining required logs, and monitoring performance. Employers must also provide the required information to affected workers and their representatives before using covered systems. Certain deployers must complete a fundamental-rights impact assessment first.

Workers and candidates People affected by employment decisions

A worker or candidate significantly affected by a decision made or supported by a high-risk system may have the right to an explanation of the system's role and the main factors behind the decision.

AI literacy Both roles, now

Providers and employers both have responsibilities for helping people who work with these systems understand them. This duty already applies.

When your organization uses commercial software for employment decisions, it is the deployer. The vendor retains its separate provider responsibilities.

How the Act affects employers outside the EU

Employers headquartered outside the EU can fall within the Act’s scope in two situations. The first is operating in the EU. If you have staff, a subsidiary, a branch, or remote employees in a member state, the rules cover the AI you use on them. The second concerns where the system’s output is used. If the output your AI system produces is used in the EU, you are in scope even without an EU office. For example, a company based elsewhere may need to assess coverage when automated screening or candidate scores are used in an EU hiring process. If your organization operates entirely outside the EU, review where each system operates, where its outputs are used, and which employees or candidates are affected.

Four steps for employers

• Check the systems you already use for workplace emotion-recognition features and AI literacy requirements. Both requirements already apply to relevant HR technology. Include vendor documentation and oversight arrangements in your review.
• Confirm responsibilities with your software vendors. As a deployer, the employer remains responsible for competent human oversight, monitoring, logging, informing affected workers, and, in some cases, a fundamental-rights impact assessment. These duties remain with the employer when it uses commercial software.
• Review where your systems and their outputs are used. The Act reaches you if you have staff in the EU or your AI output is used in the EU. A recruiter based outside the EU who scores EU-based candidates can fall within the Act’s scope, regardless of where the employer is headquartered.
• Distinguish high-risk systems from prohibited uses. The employment AI most often banned outright is emotion recognition in the workplace, and biometric categorization that infers traits such as union membership is banned too. Systems listed in Annex III may be used when the applicable requirements are met.