EU AI Act for HR Teams: High-Risk Rules, Prohibited Tools, and Deployer Duties
EU AI Act for HR teams: high-risk tools under Annex III point 4, the emotion-recognition ban (Art 5), deployer duties, and the 2 December 2027 deadline.
HR is one of the most exposed functions in any organisation under the EU AI Act. Annex III explicitly lists employment and worker-management AI as high-risk — and one category of HR tool is not just high-risk but outright banned. If your company deploys algorithmic hiring tools, performance-monitoring software, or any AI that touches workers' daily lives, you are already a regulated party under Regulation (EU) 2024/1689.
The obligations that apply to you as the employer depend on whether you build the tool (provider, Article 16) or buy and deploy it (deployer, Article 26). Most companies are deployers. The deployer obligations are lighter than the provider stack, but they are not light — and two of them are specific to the workplace and are frequently overlooked.
Which HR AI Systems Are High-Risk?
Article 6 sets the classification rules. An AI system is high-risk if it falls within one of the eight areas listed in Annex III. For HR, that is Annex III, point 4: employment, workers management, and access to self-employment.
Point 4 has two sub-categories:
Point 4(a) — Recruitment and selection. Systems used to place targeted job advertisements, filter or sort applications, or evaluate candidates during the hiring process. A CV-parsing tool that ranks applicants before any human sees them is a textbook 4(a) system. So is a tool that predicts "candidate fit" from video interviews.
Point 4(b) — In-employment decisions. Systems used to make or support decisions on promotion, termination, and task allocation where the allocation is driven by monitoring of behaviour or personal traits. Systems used to monitor workers' performance and behaviour also fall here.
The Article 6(3) filter does allow a provider to document that a specific Annex III system poses no significant risk of harm and therefore should not be treated as high-risk. In practice, this exemption is a narrow escape — any system that profiles natural persons is always high-risk regardless of that filter. Most HR tools that rank, score, or sort individuals are profiling by definition.
One Hard Line: Emotion Recognition in the Workplace Is Prohibited
Article 5(1)(f) bans AI systems that infer emotions of natural persons in the workplace and in educational institutions — with limited exceptions for medical and safety purposes. This is not a high-risk classification with extra paperwork. It is a prohibition, in force since 2 February 2025.
Any tool that reads facial expressions, analyses voice patterns, or claims to detect stress or engagement levels during work hours — including some productivity-monitoring and video-meeting analytics tools — falls directly under Article 5(1)(f). Deploying such a system, or continuing to operate one already live, exposes your organisation to fines up to €35,000,000 or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)).
If you are currently using any tool marketed as detecting "employee sentiment," "engagement signals," or "emotional state" from audio or video, review it immediately against this prohibition.
What It Means to Be a Deployer: Article 26
When an employer buys and uses a third-party HR AI tool, the Act treats that employer as a deployer under Article 26. Providers carry the heavier technical obligations — risk management system (Article 9), technical documentation (Article 11), conformity assessment (Article 43). Deployers cannot outsource accountability entirely, but their obligations are more operational.
The two obligations that HR teams most often miss:
Logs — Article 26. Where it is within the deployer's control, you must keep logs of the system's operation for at least six months. For a recruitment tool, this means retaining a record of which applicants were filtered, scored, and by what output — not just final decisions. This is audit evidence, not a nice-to-have.
Worker notification — Article 26. Before deploying a high-risk AI system in the workplace, you must inform workers' representatives. If your jurisdiction has a works council or co-determination body, that body must be informed before the system goes live. This is a legal pre-condition, not a communications task.
Beyond those two, Article 26 also requires deployers to: follow the provider's instructions for use; ensure human oversight is actually in place (Article 14); monitor for problems in operation; and report serious incidents or malfunctions to the provider.
Human Oversight Under Article 14
Article 14 requires that high-risk AI systems be designed and used so that humans can effectively oversee them, understand their outputs, and intervene or override where necessary. As a deployer, you cannot simply activate a recruitment tool and accept its rankings. Someone with appropriate authority and competence must review outputs, be able to question them, and make the final decision.
In practice, this means your HR process needs a documented step where a human reviews algorithmic outputs before a candidate is rejected or a worker is disciplined. A rubber-stamp review does not satisfy Article 14. The oversight must be substantive.
Does Your Organisation Need a FRIA?
Article 27 requires certain deployers to complete a Fundamental Rights Impact Assessment (FRIA) before deploying a high-risk AI system. The FRIA obligation applies to:
- Public bodies
- Private companies deploying creditworthiness-scoring systems (Annex III, point 5(b))
- Private companies deploying health/life-insurance risk-assessment systems (Annex III, point 5(c))
Most private employers deploying HR tools do not automatically owe a FRIA under Article 27. The obligation does not attach to Annex III point 4 (employment AI) for private-sector deployers. This is a frequent misstatement — Article 27 is precise about who it covers, and private employers are not in scope simply because they use recruitment or performance-monitoring tools.
That said, GDPR Article 22 (which has applied since 2018) gives individuals the right not to be subject to purely automated decisions with significant effects. If your HR system makes decisions without meaningful human review, GDPR Article 22 may already require you to act. These two frameworks sit alongside each other; neither displaces the other.
Works Council and Co-Determination Law
Works-council rights in Germany, Austria, the Netherlands, and other co-determination jurisdictions often give employee representatives a right to be consulted — or even to veto — new monitoring or selection tools. The EU AI Act's Article 26 notification duty reinforces rather than replaces those national rights. A multinational deploying an AI recruitment tool across EU markets may face different procedural requirements country by country on top of the baseline Article 26 duty.
Discrimination Risk and GDPR
HR AI systems present a specific discrimination risk that regulators and courts have already focused on before the AI Act existed. A candidate-ranking algorithm trained on historical hiring data can encode historic bias — against women, older applicants, or minority ethnic groups — and reproduce it at scale. The EU AI Act's requirements for data governance (Article 10 at the provider level) and human oversight (Article 14 at the deployer level) are partly designed to address this.
GDPR Article 22 automated-decision rights are a parallel layer. Where an employer's AI system produces significant effects on individuals solely through automated processing, affected individuals have the right to request human review, to express their point of view, and to contest the outcome. Your Article 14 human-oversight process and your GDPR Article 22 safeguards should be designed together.
The Deadline
High-risk AI obligations under Annex III, point 4 apply from 2 December 2027 for stand-alone systems. Under the Digital Omnibus agreed between Parliament and Council in May 2026, this date replaced the original 2 August 2026 deadline. The extra 16 months is real preparation time, not a reprieve: assembling six months of audit logs, implementing substantive human-oversight procedures, notifying works councils, and reviewing every vendor's conformity documentation takes time.
The emotion-recognition prohibition (Article 5(1)(f)) is already in force. It has applied since 2 February 2025. There is no transition period for that obligation.
How Confir Helps
Confir's classification engine runs each HR tool you register through the Annex III point 4 logic — answering plain-English questions about what decisions the system influences, whether it profiles individuals, and whether the Article 6(3) exemption could credibly apply. The output is a determined risk tier and a scoped obligation set.
As a deployer, your scope is 2–3 controls: human-oversight verification (Article 14), log-retention setup (Article 26), and — if you are a public body or in the credit/insurance space — the Article 27 FRIA. Confir runs that assessment in a single structured workflow, generates the documentation, and stores the audit trail.
Providers building HR AI tools see the full stack: risk management (Article 9), technical documentation (Article 11/Annex IV), and the conformity pathway (Article 43). Both roles start from the same classification step.
Frequently Asked Questions
Which specific HR tools are classified as high-risk under Annex III?
Annex III, point 4(a) covers AI systems used for recruitment and selection: targeted job-ad delivery based on individual profiling, application filtering, ranking applicants, and evaluating candidates. Point 4(b) covers in-employment AI: tools that support promotion or termination decisions, systems that allocate tasks by monitoring behaviour or personal traits, and tools that monitor performance and conduct. If your system does any of these things, the starting presumption is high-risk. The Art 6(3) exemption can rebut that presumption but only through a documented assessment — and any system that profiles individuals is always high-risk.
Is emotion recognition at work banned under the EU AI Act?
Yes. Article 5(1)(f) prohibits AI systems that infer employees' emotional states during work — from facial expressions, voice tone, or similar signals — unless used strictly for medical or safety purposes. This prohibition has been in force since 2 February 2025 and carries the highest penalty tier: up to €35,000,000 or 7% of worldwide annual turnover (Article 99(3)). Tools marketed as measuring "employee engagement" or "sentiment" via audio/video analysis fall directly under this ban.
As an employer deploying a third-party HR AI tool, what are my specific obligations?
You are a deployer under Article 26. Your core duties: follow the provider's instructions for the system; implement genuine human oversight so that staff can understand, question, and override outputs (Article 14); keep operational logs for at least six months where that is within your control (Article 26); and inform workers' representatives before the system goes live in the workplace (Article 26). You must also monitor performance and report serious malfunctions to the provider.
Do private employers need to carry out a Fundamental Rights Impact Assessment?
Not automatically. Article 27 requires a FRIA from public bodies, and from private deployers of creditworthiness or life/health-insurance AI (Annex III, point 5(b) and 5(c)). A private employer deploying a recruitment or performance-monitoring tool does not automatically trigger Article 27. That said, GDPR Article 22 requires you to offer human review and the ability to contest outcomes wherever automated processing produces significant individual effects — an obligation that applies now and independently of the AI Act.
What are the penalties for non-compliance?
Non-compliance with high-risk AI obligations — including Article 26 deployer duties — carries fines up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Deploying a prohibited emotion-recognition system reaches the top tier: up to €35,000,000 or 7% (Article 99(3)). For SMEs and start-ups, Article 99(6) caps fines at the lower of the percentage or the fixed amount — a meaningful proportionality provision, but not a safe harbour.
When do high-risk HR AI obligations apply?
Under the Digital Omnibus agreed in May 2026, the application date for stand-alone high-risk Annex III systems moved to 2 December 2027 (from the original 2 August 2026). The emotion-recognition prohibition under Article 5(1)(f) already applies — since 2 February 2025. If your HR AI tool is embedded in an Annex I regulated product, the applicable date is 2 August 2028.
What does the Article 26 notification duty require in practice?
Before deploying any high-risk AI system in the workplace, you must inform workers' representatives — typically the works council, staff committee, or equivalent co-determination body where one exists. This is a pre-condition for deployment, not a post-deployment formality. In countries with strong co-determination rights (Germany, Austria, the Netherlands), national law may additionally require consultation rights or consent beyond the Article 26 notification. Plan for this early — works-council consultation processes can take weeks.
Related guides
- Article 9 risk management system
- provider and deployer obligations
- high-risk classification requirements
- assess your AI system's risk level
- Article 6 high-risk criteria
- risk classification decision tree
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 7-day free trial.
Start free trial →