Beamery Under the EU AI Act: High-Risk Classification and Deployer Duties
Beamery is high-risk under EU AI Act Annex III point 4 when it ranks or screens candidates. What employers must do as deployers before 2 December 2027.
High-risk. When an employer uses Beamery to match, rank, screen, or rediscover candidates, it is deploying a high-risk AI system within the meaning of Annex III, point 4(a) of the EU AI Act. The talent-CRM framing — engage, nurture, build a pipeline — softens the perception, but the legal test looks at function: a system that scores and ranks people for selection is recruitment AI, and recruitment AI is high-risk. This guide sets out the classification, the provider/deployer split, the prohibited line, the candidate-chatbot transparency duty, and the practical steps.
Why Beamery is high-risk: Annex III, point 4(a)
Annex III lists eight categories of AI use presumed high-risk under Article 6. Point 4 covers employment and worker management; sub-point 4(a) explicitly captures AI used for recruitment or selection — notably to place targeted job adverts, analyse and filter applications, and evaluate candidates.
Beamery's core is a talent CRM with AI candidate matching, predictive talent analytics, skills inference, and talent rediscovery — resurfacing past applicants and silver-medallists for new roles. Matching and ranking candidates against a requisition is screening and evaluation under 4(a). Rediscovery that re-scores and re-ranks a past applicant pool is the same function applied to a stored population. Where Beamery informs internal moves or redeployment, 4(b) (work and progression decisions) is also engaged. Classification is by use, not by the "CRM" label.
Can the Article 6(3) exemption apply?
Article 6(3) can lift an Annex III system out of high-risk through one of four narrow conditions — but never for a system that profiles natural persons. Beamery infers skills and predicts fit, then ranks people on that inference: that is profiling. A ranking fed to a recruiter to decide who to contact or advance is influencing the outcome, not merely a procedural step. The exemption is not available. The high-risk framework applies.
A genuinely narrow point deserves honesty: if you used Beamery only as a contact database with no AI scoring, matching, or ranking touching a hiring decision, the analysis could differ. But the AI matching and rediscovery are the reason most buyers choose it — and once they drive selection, the system is high-risk.
Two transparency layers: the candidate chatbot and the AI assessment
Beamery offers a candidate-facing AI chatbot on career sites that answers questions and helps schedule interviews. That conversational layer triggers Article 50(1): candidates must be told they are interacting with an AI system, at the latest at the start of the interaction. Building that disclosure in is Beamery's duty as provider; yours is to confirm it is switched on in your career site. Article 50 transparency has applied since 2 August 2026 and was not moved by the Digital Omnibus.
Separately, the high-risk matching engine carries its own disclosure expectation under Article 26: candidates and employees evaluated by AI should be informed that an AI system is assessing them. Treat these as two distinct duties — the chatbot disclosure (Article 50) and the assessment disclosure (Article 26) — not one.
The prohibited line: emotion recognition under Article 5(1)(f)
Article 5(1)(f) prohibits AI that infers emotions or affective states of natural persons in the workplace, in force since 2 February 2025 with no transition. A breach sits in the top tier — €35,000,000 or 7% of total worldwide annual turnover (Article 99(3)).
Skills inference and candidate matching are not emotion recognition, and Beamery is not marketed as an affect tool. But if any integrated assessment or third-party add-on in your recruiting stack infers candidates' emotional states from video, voice, or facial signals during the hiring process, that component is prohibited. Confirm in writing that no emotion or affect inference is active, and file the confirmation.
Roles: Beamery is the provider, your organisation is the deployer
The EU AI Act separates the company that builds and markets an AI system from the company that uses it professionally.
Beamery (the provider under Article 16) must, before the high-risk regime applies: run a conformity assessment under Article 43 (Annex VI internal-control route — point 4 is not the notified-body biometrics category); compile technical documentation to Article 11 / Annex IV; register the system under Article 49; supply deployers with adequate information under Article 13; and run post-market monitoring under Article 72, reporting serious incidents under Article 73.
As the employer using Beamery, you are the deployer under Article 26.
Use the system within its intended purpose (Article 26)
Stay inside the roles and populations Beamery validated the system for. Going outside shifts liability toward you and may be a substantial modification under Article 25 that triggers provider duties.
Ensure human oversight (Article 14)
No automated selection. The match score and ranking are inputs to a human's judgment, not the decision. Article 14 requires the system to allow human override; Article 26 requires you to exercise it. Do not auto-filter candidates below a score; ensure a qualified recruiter reviews every shortlist, rejection, and rediscovery surfacing; train recruiters on what a match score means and when to override it.
Monitor performance and keep logs (Article 26)
Watch for disparate outcomes across cohorts, report serious incidents to Beamery (which escalates under Article 73), and keep deployment logs for at least six months.
Inform workers' representatives and candidates (Article 26)
Before deploying recruitment AI, inform workers' representatives (works council or equivalent) that it is in use. Tell candidates AI-assisted matching is part of the process and a human reviews recommendations. Document when you notified your works council.
Does Article 27 (FRIA) apply?
The Article 27 FRIA is mandatory for public bodies and deployers of creditworthiness or life/health-insurance systems (Annex III 5(b)/(c)) — not private employers using recruitment AI. Public-sector employers deploying Beamery do owe a FRIA. Article 27(4) allows it to build on an existing GDPR DPIA.
Bias testing, data governance, and GDPR
Article 10 (data and data governance) and Article 15 (accuracy, robustness, cybersecurity) bind Beamery as provider. As deployer, demand the evidence: selection-rate and adverse-impact ratios across gender, age, and ethnic origin; documentation of bias testing pre- and post-deployment; and the limitations of the rediscovery model, which re-scores a historical pool and can carry forward old patterns. Then monitor your own outcomes.
GDPR stacks on top. Talent rediscovery in particular raises retention and purpose-limitation questions — re-processing a past applicant's data for a new role needs a lawful basis and a defensible retention period. GDPR Article 22 gives candidates a right not to be subject to a solely automated decision with significant effect; build human review and a contest route into the process. Label that GDPR Article 22, not the AI Act.
The compliance deadline
Under the Digital Omnibus on AI — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 — stand-alone high-risk Annex III obligations apply from 2 December 2027, not the original 2 August 2026.
The deferral is law, not a proposal: the amended Article 113 itself now reads 2 December 2027 for Annex III systems such as Beamery's matching and rediscovery.
The Article 5(1)(f) emotion-recognition prohibition is already in force (2 February 2025) and is not deferred. The Article 50 chatbot-disclosure duty has applied since 2 August 2026 regardless of the high-risk timeline.
Worked example: a 280-person scale-up runs Beamery
Lindqvist Talent AB, a ~280-employee technology scale-up with ~€48M turnover, uses Beamery's matching and rediscovery to source and rank candidates and a career-site chatbot to answer applicant questions.
Classification result: high-risk. The matching and rediscovery rank candidates for selection (Annex III point 4(a)); profiling rules out Article 6(3).
Their duties: human review of every shortlist and rediscovery surfacing (Article 14); an Article 50 disclosure live in the career-site chatbot (required since 2 August 2026); an Article 26 notice to candidates and the works council that AI-assisted matching is used; bias-evidence requests to Beamery; six-month log retention. No FRIA, as a private employer.
Outcome: a defined high-risk deployer programme on the 2 December 2027 track, plus the Article 50 chatbot disclosure that is already live.
How Confir helps
Add Beamery to your AI register and Confir's rule-based intake asks how you use it — what the matching and rediscovery rank, whether scores feed selection, whether a candidate chatbot is live, and what data the models touch. The deterministic engine maps your answers to Annex III point 4(a), derives your role (deployer, Article 26), and scopes the obligation set — Article 14 oversight, the Article 26 notification and log duties, the Article 50 chatbot disclosure, the bias-evidence requests — and flags Article 5(1)(f) if any emotion-inference feature is present. Same intake, same finding, every rule human-readable. No consultants required.
Related guides
- Article 6 high-risk classification
- Annex III employment decision systems
- Article 14 human oversight
- provider vs deployer: who carries which duty
- Eightfold AI under the EU AI Act
- HireVue under the EU AI Act
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →