What HR leaders need to do under the EU AI Act

The Act distinguishes providers, which build AI, from deployers, which use it.[1] Carlsson says employers are responsible for how AI is used, including oversight, informing people and recordkeeping, while providers take on testing, documentation and accountability duties.[1] AI used to recruit, select, evaluate, promote or dismiss people is classified as high-risk.[1] The Commission identifies automated job-matching and ranking tools as examples.[4] Carlsson cautions that an employer can also become a provider if it uses a vendor tool for a purpose the tool was not designed for.[1]

Deployers of high-risk HR AI must follow provider instructions, train people to oversee the system, keep logs, monitor for problems and inform affected candidates and employees, according to Carlsson.[1] Workers’ representatives, including unions or works councils, must be informed before a high-risk system goes live.[1] Carlsson also says people must be told when they are interacting with AI, so a recruiting chatbot should identify itself as AI.[1] The European Commission likewise says interactive AI systems must tell users they are dealing with AI rather than a human.[3]

Not every recruiting-related tool has the same classification.[1][4] The Commission says interview-scheduling AI can qualify for an exception when it performs only logistical tasks and does not influence candidate selection.[4] Carlsson contrasts interview-scheduling and job-post grammar tools with systems that decide who gets an interview.[1] Her article also describes software that infers people’s emotions at work.[1] She recommends asking vendors whether a tool infers emotions and how it supports human oversight and keeps logs.[1]

The Commission’s timeline says the Act’s prohibitions began applying on February 2, 2025, and sets December 2, 2027, as the application date for rules covering Annex III high-risk AI systems.[2] Carlsson says the AI Act does not replace GDPR, which already governs handling of candidate and employee data.[1] She recommends asking vendors where AI is used and what documentation they provide, then recording answers in one inventory.[1] She also advises setting rules for AI-generated content, including where human approval is needed and how content should be labeled.[1] Vendor agreements signed now may still be in force when the high-risk rules take effect.[1]