The EU AI Regulation, Regulation (EU) 2024/1689, usually called the EU AI Act, has been in force since August 2024 and applies in stages. For high-risk systems in the employment context the date was 2 August 2026. That date has moved: the Digital Omnibus, Regulation (EU) 2026/1744 of 24 July 2026, sets it at 2 December 2027, and at 2 August 2028 for embedded systems. A separate article explains what the delay means in practice. The prohibitions under Article 5 apply unchanged, and have done since 2 February 2025.
You do not have to become a lawyer to work in HR. But you should know three things: which systems are meant, what is required of whom, and which role you play yourself.
Why personnel selection is in Annex III
The AI Act works with risk classes. At the bottom sit systems with minimal risk, at the top prohibited practices. In between lies the class this article is about: high-risk systems, listed in Annex III.
Annex III expressly names the field of employment, including AI systems used to select or filter applications, and systems that influence decisions on promotion, termination or the allocation of tasks.
The legislator’s reasoning is plausible: these decisions concern access to working life. Mistakes are hard for those affected to correct, and often not even visible to them.
What does not fall under it in practice
This is where the most common confusion arises. “We use software in personnel selection” does not automatically mean “we operate a high-risk system”.
What matters is whether the system carries out or materially influences an assessment, a filtering step or a decision about people. A scheduling tool that compares calendars and allocates rooms does not judge anyone. A suggestion as to which psychologist is available and qualified on a given day concerns resource planning, not a candidate’s suitability.
A system that sorts applications automatically by likelihood of success is a different matter. So is a system that infers personality traits from a video interview.
Drawing that line cleanly is the first piece of homework: where in your process does software act on the assessment of people, and where does it merely organise the sequence?
Which role you take
The AI Act distinguishes above all between providers, who develop a system and place it on the market, and deployers, who use it in their own name. As an employer you are usually a deployer.
Deployers have obligations of their own. They include using the system in line with the instructions for use, ensuring human oversight by suitable and trained people, monitoring operation and keeping logs. Employees affected by such a system have to be informed, and individuals have rights to an explanation of decisions based on such systems.
Important in practice: if you substantially modify a purchased system or use it under your own name, you can slip into the role of provider, with considerably wider obligations.
Why structured procedures now have the advantage
In several places the AI Act asks for something that good aptitude diagnostics has asked for over decades: traceability.
Anyone working to the principles of DIN 33430 already has most of the building blocks: defined requirement profiles, standardised procedures, documented observations, qualified assessors, established decision rules. What the AI Act adds is, at heart, cleaner documentation of where technology takes part and where people decide.
The reverse also holds: organisations whose selection procedures consist of grown practice, experience and spreadsheets now have a double problem. They not only have to meet new requirements, they first have to find out how their own process actually works.
Five questions for your next meeting
- Where in our selection process does software act on the assessment of people? Not: where do we use software.
- For those systems, are we the deployer or the provider? And do the suppliers know that too?
- Who exercises human oversight, and is that person qualified and named for it? Oversight assigned to nobody does not happen.
- Can we show, for a single decision from last year, how it came about? If that takes three people and two days, the answer is no.
- Do the works council and the data protection officer know which systems we use? The AI Act comes on top of existing obligations from the GDPR and co-determination; it does not replace them.
Our position
At flynne we decided early not to use AI to judge people. Our assistant plans, warns and drafts; it does not assess candidates and makes no selection decisions. That was a professional decision first: diagnostic authority belongs with the psychologists, not in a model.
That the decision has since become convenient in regulatory terms was a welcome side effect, not the reason for it.
This article reflects our own reading of the regulation and is not legal advice. For an assessment of your specific systems and processes, please involve your legal department or a specialist lawyer.
