EU AI Act recruitment: is CV screening high-risk?

The core message: AI in HR often falls under strict rules

During the first AI Supervision Congress in December 2025, organized by the Netherlands Authority for Digital Infrastructure (RDI) and the Dutch Data Protection Authority (AP), session 8 was entirely dedicated to AI in recruitment and selection. The message was clear: this is one of the most regulated application areas under the AI Act.

The reason? AI decisions in HR directly affect people's fundamental rights:

• Access to work and income
• Protection against discrimination
• Privacy and human dignity

Three categories: Prohibited, High-Risk, Low Risk

Prohibited: Emotion recognition in recruitment processes

Since February 2, 2025 it is prohibited to use AI that detects emotions in the workplace or during job application procedures, unless for medical or safety reasons.

This prohibition affects technologies that claim to:

• Detect nervousness or stress during interviews
• Infer "personality traits" from facial expressions
• Use voice analysis to measure motivation or reliability
• Deploy eye-tracking to assess focus or interest

The scientific basis for such tools is moreover very weak. The Dutch DPA concluded in their report on emotion recognition that these technologies often don't do what they promise and can have discriminatory effects.

High-Risk: Most AI in recruitment and selection

The AI Act classifies in Annex III, point 4 the following AI applications explicitly as high-risk:

Low risk: Supporting tools

Not all AI in HR is high-risk. Tools that have no direct impact on decisions about individuals often fall outside the strict requirements:

Note: Even "low risk" tools must comply with general AI Act obligations, such as transparency and AI literacy.

The AI value chain: Shared responsibility

A crucial message from the AI Supervision Congress was that responsibility doesn't rest solely with the software vendor. The AI Act introduces a value chain approach:

Obligations for providers of high-risk R&S AI

Obligations for deployers of high-risk R&S AI

As an employer using AI tools for recruitment and selection:

1. Check the vendor's conformity route: from 2 December 2027 a high-risk HR system needs a conformity assessment and CE marking before it is placed on the market
2. Follow the instructions for use: deploy the system as intended by the provider
3. Organize human oversight: ensure qualified people review the output
4. Use representative input data: prevent the data itself from introducing bias
5. Monitor the system: track performance and potential discrimination
6. Retain logs: according to Article 26 of the AI Act

Practical examples: What should you do concretely?

Scenario 1: You use a CV screening tool

The tool: A SaaS solution that automatically scores and ranks CVs based on job requirements.

Classification: High-risk (Annex III, point 4a)

Compliance checklist:

• Ask the vendor for proof of conformity planning and CE marking where applicable
• Request technical documentation and instructions for use
• Assign a person responsible for reviewing AI rankings
• Verify if training data was representative
• Monitor for potential discrimination patterns (gender, age, ethnicity)
• Document how you use the system and what decisions it supports
• Inform candidates that AI is used in the process

Scenario 2: You're considering a video interview tool with "personality analysis"

The tool: A platform that analyzes video interviews for facial expressions, voice patterns, and word choice to score "soft skills."

Classification: Prohibited if it detects emotions; high-risk if it analyzes other characteristics

Action:

• Stop immediately with tools that claim to recognize emotions
• Ask the vendor to clarify exactly what the tool measures
• When in doubt: don't use it

Scenario 3: You use AI to optimize shift planning

The tool: An algorithm that combines availability, preferences, and workload to create schedules.

Classification: Low risk (no individual assessment impacting careers)

Obligations:

• Transparency to employees about how the tool works
• AI literacy for system users

Timeline: When must everything be in place?

Who supervises this in the Netherlands is not settled yet. The cabinet intends the Dutch DPA (AP) and the RDI as coordinating supervisors, but the implementing act was still at the consultation stage in 2026 and has not yet been adopted (Rijksoverheid, 20 April 2026). The dates themselves follow from Article 113 and Article 111 of the AI Act as amended by Regulation (EU) 2026/1744.

What does this mean for HR software vendors?

For providers of AI tools in recruitment and selection:

1. Start now with conformity preparation: 2 December 2027 leaves little time for documentation, testing and a quality management system
2. Use the quality management standard: prEN 18286 is now EN 18286:2026. Update October 2026: it has been a harmonized standard since 14 October 2026 (Implementing Decision (EU) 2026/2274); applying it is voluntary and gives a presumption of conformity only for the requirements it covers
3. Document proactively: technical documentation, risk management, data governance
4. Prepare CE marking: the procedure is an internal assessment for HR-AI
5. Register timely: the EU database of AI systems will become the norm

Digital Omnibus: more time, same obligations

The AI Supervision Congress also mentioned the Digital Omnibus, then still a proposal. It is now law: Regulation (EU) 2026/1744 was published on 24 July 2026 and has applied since 27 July 2026. It moved the Annex III high-risk date, and with it HR-AI, from 2 August 2026 to 2 December 2027.

The core obligations for HR-AI did not change. The Omnibus gives more time, not fewer duties. Read our Digital Omnibus fact check for the full overview.

Concrete steps for HR departments

This week

1. Inventory which AI tools you use in recruitment, selection, and HR
2. Check for emotion recognition: stop immediately with tools that do this
3. Ask vendors about their AI Act roadmap

This month

4. Classify your tools: prohibited, high-risk, or low risk?
5. Start AI literacy for HR staff
6. Document current processes and how AI plays a role

This quarter

7. Set contract requirements for vendors (CE marking, documentation)
8. Design human oversight: who reviews AI output and how?
9. Begin monitoring: measure discrimination indicators

Conclusion: Start now, not in December 2027

The AI Act sets strict requirements for AI in recruitment and selection, and for good reason. The impact of automated HR decisions on people's lives is too significant to leave to black-box algorithms.

Three key messages:

1. Emotion recognition is already prohibited: check today if your vendors do this
2. Human oversight is mandatory: AI may advise, not autonomously decide
3. The value chain shares responsibility: even as a buyer, you have obligations

Organizations that take action now are not only building compliance capacity, but also trust with applicants and employees. In a tight labor market, that can be a significant competitive advantage.

Need an HR implementation route? Start with the LearnWize HR readiness scan for training evidence. If you already use CV screening, candidate ranking or people analytics, run the Embed AI HR-AI Risk & Evidence Sprint to map deployer obligations. If your blocker is a renewal or vendor claim, add the AI vendor and contract check.