The EU AI Act for the CHRO: AI in recruitment, performance and workforce management

Are CV screening, interview scoring, performance and task allocation AI high-risk under the EU AI Act?

Annex III, point 4, "Employment, workers' management and access to self-employment", lists two groups:

Recital 57 gives the reasons: these systems may appreciably affect people's future career prospects and livelihoods, may perpetuate historical patterns of discrimination, for example against women or certain age groups, and monitoring tools may undermine the rights to data protection and privacy.

Exception: a system that only performs a narrow procedural task or improves the result of a previously completed human activity, and does not profile natural persons, can be treated as not high-risk under Article 6(3), but this must be documented and registered in the EU database. Annex III systems apply from 2 December 2027 (as amended by Regulation (EU) 2026/1744).

If our Taiwan headquarters uses AI to screen applicants for an EU subsidiary, does the EU AI Act apply?

It may. Placing an AI system on the EU market, or using an AI system's output in the EU, brings you within scope even with no establishment in the EU (Article 2(1)).

HR should first determine its role for each HR system:

• Deployer: uses someone else's AI system in a professional activity, for example a purchased recruitment or performance platform
• Provider: develops or has an AI system developed and puts it into service under its own name
• Roles can change: if you put your name or trademark on a third-party AI system, make a substantial modification, or change its purpose so that it becomes high-risk, Article 25(1) treats you as the provider, with the provider's obligations

For example, if the group adjusts a vendor model's scoring logic and uses it for promotion assessments at the EU subsidiary, check whether that is a substantial modification. Record the reasoning in the AI system inventory; whether the Act applies is for legal counsel to judge case by case.

We use a vendor's HR system. What must HR do as a deployer?

Article 26 sets specific obligations for deployers of high-risk AI. Those directly relevant to HR:

HR's practical work: require the vendor in the purchase contract to provide instructions for use and logging; name an overseer for each system and arrange training; and put the notices to workers' representatives and applicants on the pre-launch checklist.

Can we use AI to analyse employees' emotions, or read candidates' facial expressions in video interviews?

In principle, no. Article 5(1)(f) prohibits placing on the market, putting into service for this purpose, or using AI systems to infer the emotions of a natural person in the workplace and education institutions; the only exception is medical or safety reasons. The prohibitions have applied since 2 February 2025, and breaches carry fines of up to €35 million or 7% of total worldwide annual turnover (Article 99).

What HR should do:

• Check whether current tools have emotion or attitude analysis features, including interview, service quality and employee survey tools
• When buying new tools, require the vendor in the contract to state whether they include emotion recognition
• Emotion recognition or biometric categorisation outside the prohibition still carries the Article 50 notice obligation

Whether a candidate's video interview falls within "the workplace", and whether a given feature infers emotions, can be assessed against the European Commission's guidelines on prohibited practices and is for legal counsel to judge case by case.

Employees use generative AI tools on their own. How far must HR's AI literacy training go?

Article 4 (as amended by Regulation (EU) 2026/1744) requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and others operating and using AI systems on their behalf, taking into account their technical knowledge, experience, education and training, the context of use and the people affected; the obligation does not require guaranteeing any specific level of AI literacy for any individual.

In practice, tier it:

• All employees: permitted uses and prohibitions, data input rules and output review; use an allow list with exception requests and regularly reassess new uses, so use does not go underground
• Overseers of high-risk systems: Article 26(2) requires the necessary competence, training and authority, so their training goes deeper
• Managers: understand automation bias and know when to override an AI recommendation

Training records can sit in the same annual training plan as security, privacy and integrity training.

Does HR's use of AI need a fundamental rights impact assessment or a DPIA? What should the board see?

• Fundamental rights impact assessment: Article 27 requires it only of bodies governed by public law, private entities providing public services, and deployers of creditworthiness or life and health insurance pricing systems; ordinary corporate HR uses are usually not among them, but confirm against the facts.
• DPIA: whether AI processing of employee or applicant data needs a GDPR data protection impact assessment is for legal counsel to judge; the two can share facts but must each be completed.
• One document: Winners Consulting uses one AI risk and impact assessment that covers Article 9 risk management, the Article 27 fundamental rights impact assessment and the ISO/IEC 42001 risk and impact assessment.
• Board report: the AI system inventory and risk levels, each system's application date, and records of oversight and notice procedures. Maximum fines are €35 million or 7% for breaching the prohibitions and €15 million or 3% for other obligations.
• Certificate boundary: the EU AI Act has no standalone certificate; ISO/IEC 42001 is not a harmonised standard, and certification gives no presumption of conformity.

How does Winners Consulting help a CHRO with the EU AI Act?

This is Winners Consulting's own description; hold us to the questions above.

• Classify first: inventory the AI systems HR uses, determine roles and risk levels, and record the reasoning in the AI system inventory; an Article 6(3) exclusion needs a written assessment and registration, not a verbal call
• Three core documents: the AI system inventory, the AI risk and impact assessment, and the EU AI Act obligation matrix (each obligation by role, with owner, evidence and due date)
• One system: an ISO 42001 management system as the organisational governance backbone, checked article by article against Articles 9 to 17 to close gaps
• Timeline (as listed on the service page): high-risk AI compliance usually takes 6–9 months, or 9–12 months integrated with ISO 42001 certification
• Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced; legal opinions come from partner lawyers

More: EU AI Act consulting, Choosing an EU AI Act consultant, Acceptance for recruitment, medical and factory AI, What to do when your role changes