HR AI evidence pack: four templates for AI in recruitment, selection and workforce management

Systems intended for the recruitment or selection of natural persons are listed in Annex III point 4(a) and are high-risk in principle (Article 6(2)). The Article 6(3) exception only applies where the system meets one of four narrow conditions, poses no significant risk of harm and does not perform profiling. A system that scores or ranks candidates performs profiling and therefore stays high-risk.

No. Since 2 February 2025 it has been prohibited to infer emotions of people in the workplace from biometric data such as face or voice (Article 5(1)(f)), except for medical or safety reasons. According to the Commission guidelines of 4 February 2025, job applicants are covered too. The prohibition binds the provider and you as deployer.

For Annex III systems from 2 December 2027, the date set by Regulation (EU) 2026/1744. Systems placed on the market or put into service before then only fall under the rules if their design changes significantly afterwards; systems for public authorities must comply by 2 August 2030 (Article 111(2)). The prohibitions and the GDPR already apply.

That can happen. If your organisation uses a system not intended for recruitment to select or rank candidates, it becomes the provider of a high-risk system (Article 25(1)(c)). The Article 16 obligations apply from 2 December 2027; the GDPR, including Article 22 on automated decisions, applies now.

A fundamental rights impact assessment (Article 27) is required in HR only for bodies governed by public law and private entities providing public services, from 2 December 2027. A DPIA under Article 35 GDPR is often needed now, because profiling with significant effects and systematic monitoring of employees are typical high-risk processing.

For a high-risk system, from 2 December 2027 you inform workers' representatives and the affected workers before putting it into service (Article 26(7)). National law often adds rights now: in the Netherlands, for example, the works council must consent to arrangements on staff appraisal and on monitoring behaviour or performance (Article 27(1) of the Works Councils Act).

The deployer assigns human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. In HR this means they know the job requirements and the system's limitations, may disregard or reverse its outcome without permission, and have time to do so. For Annex III systems this applies from 2 December 2027.

If you have reason to consider that use in accordance with the instructions may result in the system presenting a risk to fundamental rights, such as equal treatment, Article 26(5) requires you to suspend use and inform the provider or distributor and the market surveillance authority without undue delay. Certainty is not required. Ongoing procedures continue manually.

The Article 26 obligations apply to high-risk systems in Annex III from 2 December 2027 (Article 113, as amended by Regulation (EU) 2026/1744). Systems placed on the market or put into service before then are only covered if their design changes significantly afterwards; systems intended for public authorities must comply by 2 August 2030 (Article 111(2)). The prohibition of emotion recognition and the GDPR apply now.

Whoever uses the system under its own authority (Article 3, point 4). If the agency uses the system under its own authority, the agency is the deployer; if you use the system yourself and the agency only supplies people, you are. Record in the contract who carries out the Article 26 obligations. Under the GDPR the employer is usually the controller.

Member states designate their own market surveillance authorities for the AI Act. On 6 October 2026 the Netherlands, for example, had not yet designated one or adopted its implementing act. Inform the provider or distributor, record when you did so, and check at every review of the playbook whether the authority is known. A personal data breach is notified to your data protection supervisory authority within 72 hours, unless it is unlikely to result in a risk to individuals (Article 33 GDPR); that applies now.

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Yes. The GDPR already requires you as controller to explain which data you process and why, and for automated decisions also the logic involved (Articles 13 and 14 GDPR). From 2 December 2027 the deployer of a high-risk system under Annex III that makes or assists in making decisions about people must also inform them that they are subject to the system (Article 26(11)).

Since 2 August 2026 (Article 50(1)). It is an obligation of the provider: if you buy in the chatbot, the supplier builds in the notice. If you build it yourself or put it into service under your own name, also on another party’s language model, you are the provider.

Article 26(7) applies from 2 December 2027 to high-risk systems under Annex III; that date follows from Regulation (EU) 2026/1744, in force since 27 July 2026. National rules on informing, consulting or obtaining the consent of workers’ representatives apply now and are not replaced by it.

No. AI that infers the emotions of applicants or employees in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons (Article 5(1)(f)). An automatic score on the content of the answers is not prohibited by Article 5, but it is a high-risk use under Annex III, point 4(a).

Yes. Under Article 15(1)(h) GDPR you as controller give understandable information about the logic involved in automated decision-making (CJEU 27 February 2025, C-203/22), within one month (Article 12(3) GDPR). For high-risk systems under Annex III, Article 86 adds a right to obtain from the deployer an explanation of the role of the system and the main elements of the decision. Notice 3.6 is a reply that meets both rules.

No. Systems intended for recruitment and selection (Annex III point 4(a)) or for decisions on terms of work, promotion, termination, task allocation or monitoring (point 4(b)) are in principle high-risk. A chatbot for general HR questions is not. A point 4 system that profiles people is always high-risk (Article 6(3), last subparagraph).

For providers and deployers of Annex III systems, from 2 December 2027, as set by Regulation (EU) 2026/1744. A system placed on the market or put into service before then only falls under the rules if its design changes significantly afterwards; systems intended for use by public authorities must comply by 2 August 2030 (Article 111(2)). The prohibitions have applied since 2 February 2025 and the GDPR applies now.

Only if, as deployer, you are a body governed by public law or a private entity providing public services, such as care, education or social services (Article 27 and recital 96), and the system is high-risk. You then carry out the FRIA before first use, from 2 December 2027. As controller, you often need a DPIA under Article 35 GDPR already.

Since 27 July 2026 Article 4a has provided a legal basis for providers and deployers, but only where strictly necessary and all six conditions are met, such as that other or anonymised data do not suffice and that the data are deleted afterwards. The GDPR continues to apply. A bias check with these data is not mandatory.

The workbook then shows the signal 'Investigate': a group clearly gets a positive outcome less often than the reference group. The threshold comes from the US four-fifths rule and is not an EU or national legal standard. It is a reason to investigate, not proof of discrimination, and with fewer than 30 people per group the ratio says little.

From 2 December 2027, as a deployer who is an employer, you inform workers' representatives and the affected workers before a high-risk system is put into service or used at the workplace (Article 26(7)). National law often goes further: in the Netherlands, for example, the works council must consent to schemes on recruitment, appraisal, personnel data and monitoring (Article 27(1) Works Councils Act), and it can invoke the nullity of a decision taken without its consent within one month.