Annex III • employment
EU AI Act compliance for HR, recruitment and workforce AI
Employment is a core Annex III area. AI used for recruitment, candidate evaluation, employment decisions, task allocation or worker monitoring can fall within the high-risk framework depending on intended purpose and the Article 6 analysis.
Updated and legally reviewed: 27 September 2026 · Reviewed by Constantin Razvan Gospodin.
Direct answer
HR AI can require both EU AI Act high-risk analysis and separate GDPR review.
Recruitment, candidate evaluation, promotion, termination, task allocation and worker monitoring are central Annex III employment use cases. Where the same systems process personal data, profiling, Article 22, DPIA, transparency and lawful-processing questions may arise separately under GDPR.
U.S. company scenario
A U.S. HR software vendor can face EU AI Act obligations without moving its development team to Europe.
If the product is placed on the EU market or otherwise falls within Article 2, employment-related intended purposes can require Annex III classification analysis. Separately, candidate or worker personal-data processing can trigger GDPR obligations.
Annex III employment uses
The AI Act specifically lists several HR use cases.
Recruitment and selection
AI intended for recruitment or selection, including targeted job advertising, analysing/filtering applications and evaluating candidates, is within the Annex III employment category.
Employment decisions
AI intended for decisions affecting terms of work, promotion or termination can fall within the high-risk listing.
Task allocation
AI allocating tasks based on individual behaviour or personal traits/characteristics is specifically relevant to the Annex III employment category.
Monitoring and evaluation
Systems intended to monitor or evaluate performance and behaviour of persons in employment relationships can fall within the listed use case.
Free HR AI screen
Does your hiring or workforce use case map to Annex III?
Screen recruitment, candidate evaluation, employment decisions, task allocation and worker monitoring by intended purpose.
Classification nuance
Not every HR tool is automatically high-risk.
Classification depends on whether the system falls within the listed use case and on the Article 6 filter/qualifications. Providers relying on a non-high-risk conclusion for an Annex III-listed system should document the assessment. Profiling of natural persons receives specific treatment under Article 6.
Current timeline
The main Annex III high-risk regime applies from 2 December 2027.
Regulation (EU) 2026/1744 moved the employment/high-risk application timetable. But organisations using HR AI should not wait: Article 50, AI literacy, GDPR/employment law and other currently applicable obligations can already matter.
Readiness controls
What employers and HRTech providers should build now
Use-case inventory
Map each HR AI system to recruitment, screening, scoring, monitoring, promotion, termination, task allocation and other intended purposes.
Role mapping
Separate the HRTech provider's duties from the employer/deployer's duties and document upstream/downstream dependencies.
Data/bias testing
Assess data quality, performance, discriminatory impacts, error patterns and subgroup outcomes appropriate to the system/use context.
Human oversight
Define when and how human reviewers can understand, challenge, override or stop AI-supported employment decisions.
Candidate/worker transparency
Map AI Act, GDPR, employment-law and local notice obligations rather than relying on a single generic AI disclosure.
Vendor evidence
Require documentation, change notices, performance information and compliance cooperation sufficient for your own deployer obligations.
Cross-border HR
U.S. employers can face overlapping regimes.
An organisation hiring in Europe can face EU AI Act and GDPR obligations; a New York City use case can separately raise NYC Local Law 144 questions. Do not assume one audit or notice satisfies every regime.
Primary sources
Official sources for HR AI classification and data-protection analysis
EUR-Lex — consolidated EU AI Act and Annex III employment uses
EDPB — automated decision-making and profiling guidance
EUAIACTUS.COM official EU source library →
Legal status reviewed: 27 September 2026. Employment-related Annex III classification depends on intended purpose and Article 6 analysis; not every HR tool is automatically high-risk.