Screening, interviews and worker management — the most litigated Annex III area.
Candidate screening is high-risk under Annex III point 4. A rejected candidate can ask for an explanation (Art. 86), and you owe candidates and workers information you almost certainly are not sending today.
- Annex
- Annex III · 4 — employment, worker management and access to self-employment
- Provisions
- Art. 26(7) · Art. 26(11) · Art. 86 · Annex III 4
- Pack
- €149/month add-on · 5 duties · 3 notice templates
Why this sector is different
HR is where the AI Act meets employment law. The duties are specific and dated: workers' representatives must be informed *before* a high-risk system is put into service, candidates must be told when they are subject to AI-assisted assessment, and an affected person has a right to a meaningful explanation of an individual decision.
Inform workers' representatives before any high-risk HR system goes live
The duty is pre-deployment, not after. A works-council notification sent after go-live is a breach even if the system is compliant.
Art. 26(7) · due within 14 days of activation
Publish the candidate AI notice on every application route
Notice must reach the candidate before the assessment, not in the rejection email.
Art. 26(11) · Art. 50 · due within 30 days of activation
Define how a candidate requests and receives an Art. 86 explanation
A named route, a service level and a template. Improvising this under a deadline is how cases escalate.
Art. 86 · due within 45 days of activation
Run and record a bias check on the screening model and its inputs
Input relevance and representativeness are deployer duties where you control the data.
Art. 10 · Art. 15 · Art. 26(4) · due within 60 days of activation
Review automated rejections before they are sent
An automated rejection with no human review is both an oversight failure and a GDPR Art. 22 problem.
Art. 14 · Art. 22 GDPR · due within 21 days of activation
The notices you owe
Unlocked with the pack, rendered with your own facts, blanks kept where you must decide.
Applicants, before assessment
Candidate notice — AI-assisted assessment
We use an AI-assisted tool to help review applications for this role. It scores how closely your application matches the requirements we published. A human recruiter reviews every recommendation before any decision is made, …
Employees and workers' representatives, before deployment
Worker information — high-risk AI in the workplace
{company} intends to use an AI system for {purpose} from {date}. The system is classified as high-risk under Annex III of the EU AI Act. Among other things it informs decisions about {affected}. Human …
A candidate or worker who requests an explanation
Art. 86 explanation template
You asked how the AI-assisted assessment of your application was carried out. The system scored your application against the published requirements on {dimensions}. Your application received a score of {score}. {human_note} The system's role …
What your buyers will ask
The questions that stall a deal or trigger an audit. Each one is a control in the matrix.
- ?How do you inform candidates that AI is involved, and when?
- ?Who reviews an automated rejection, and what record exists?
- ?How do you answer a candidate's request for an explanation?
- ?Show the bias testing on your screening model.
Straight answers
Does candidate screening need a FRIA?
No. Article 27 applies to public bodies, private providers of public services, and creditworthiness and life/health insurance deployers. A private employer screening CVs owes the Article 26 duties — including informing workers' representatives and candidates — and the Article 86 explanation, but not a fundamental rights impact assessment. Our control matrix says so explicitly rather than selling you one.
What changed with the Digital Omnibus?
Annex III high-risk duties, including those for HR systems, moved to 2 December 2027 under Regulation (EU) 2026/1744. That is a deferral of the high-risk regime, not of Article 4 literacy or Article 50 transparency, and the Article 6(4) duty to document a 'not high-risk' assessment applies already.
We only use a recruitment platform; the vendor handles compliance.
As the deployer you carry your own duties under Article 26. The vendor cannot inform your workers' representatives, review your rejections, or answer your candidate's Article 86 request. Those are yours.
Know where you stand before the questions arrive.
Four minutes, no card. You get your exposure score and the exact articles that apply to a hr & recruitment organisation.