AI in recruitment and workforce planning: the category where the EU AI Act is strictest

Why recruitment and workforce planning stand apart in the Act

The EU AI Act classifies AI by risk. For most operational applications, such as demand forecasting, route optimisation or quality control, it goes no further than transparency, human oversight and being able to demonstrate compliance. For a limited number of applications the bar is much higher; these are listed in Annex III. Point 4 of that annex covers employment, workers' management and access to self-employment. The legislator takes a strict line here because the consequences are serious and the person concerned has little chance of escaping them: anyone who is rejected rarely hears why.

Point 4 has two parts, the second of which is often overlooked:

• Point 4(a): AI intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.
• Point 4(b): AI intended to take decisions on terms of employment or on the promotion or termination of an employment relationship, to allocate tasks based on individual behaviour or personal characteristics, or to monitor and evaluate the performance and behaviour of people in such a relationship.

Workforce planning is covered sooner than you think

Point 4(b) makes clear why this subject reaches further than recruitment. Filling a roster based on availability, contract hours and expected workload is planning. Allocating tasks based on how individual employees performed in the past, or tracking and assessing performance and behaviour, affects the legal position of your people.

In practice that distinction is less sharp than it sounds. A planning tool that learns by itself which order picker or driver best fits which task moves towards point 4(b) as soon as it does so at an individual level. Anyone buying workforce planning software should therefore ask explicitly whether the system uses individual performance data, and for what purpose.

What already applies, regardless of December 2027

The demanding high-risk requirements were moved to 2 December 2027 by the omnibus package. That is no free pass until that date, because three rules already affect recruitment and HR policy now.

• Emotion recognition in the workplace is prohibited. Since 2 February 2025, Article 5(1)(f) has prohibited AI that infers people's emotions in situations related to the workplace and education, with a narrow exception for medical or safety reasons. Software that infers motivation, stress or personality from facial expressions, voice or word choice therefore falls not into the high-risk category, with its conditions, but among the prohibited practices.
• AI literacy is mandatory. Article 4 has also applied since 2 February 2025. For HR staff and managers who work with selection or assessment software, it is the basis for weighing up an outcome.
• If AI communicates with job applicants, this must be disclosed. Since 2 August 2026, Article 50 has required that people know they are communicating with AI; a chatbot that handles candidates' first questions falls under this.

The GDPR already sets the strictest requirements today

Alongside the AI Act, the GDPR applies in full, and for job applications it is the most concrete. Article 22 GDPR provides that a person may not be subjected to a decision based solely on automated processing that significantly affects them. A rejection that follows from an assessment score or an automated CV filter can be such a decision. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) set this out in its guidance on online and game-based assessments. In recruitment, the most obvious exception is that the decision is necessary for entering into a contract, but you cannot rely on it automatically: you must demonstrate why it is necessary in your case and whether a less intrusive but equally effective alternative exists. An applicant's consent is usually not a usable legal basis, because in an unequal relationship it does not count as freely given.

The AP also requires an internal policy that safeguards applicants' rights: they must be able to contest the decision, express their point of view and obtain meaningful human intervention, in which the reviewer takes new information into account and takes a new decision. You must also inform them that an automated decision is taking place, what the underlying logic is and what consequences it may have. This applies now, not from December 2027.

What is added from 2 December 2027

If you use a system that does fall under point 4 of Annex III, from 2 December 2027 you are a deployer within the meaning of the Regulation. Article 26 then imposes concrete obligations on you, and Article 86 gives the person concerned a right:

• Using the system in accordance with the provider's instructions for use, with appropriate technical and organisational measures.
• Assigning human oversight to people with the necessary competence, training and authority, as well as the necessary support. Oversight that exists on paper but cannot change anything does not count.
• Ensuring that input data is relevant and sufficiently representative, to the extent you have control over it; monitoring how the system operates; alerting the provider and the regulator in the event of a risk or serious incident; and keeping the logs for at least six months.
• Before putting the system into use in the workplace, informing workers' representatives and the affected workers that they will be subject to it (Article 26(7)), and informing the people concerned themselves when you use it in decisions about them (Article 26(11)).
• Being able to explain a decision: Article 86 gives anyone affected by it the right to clear and meaningful explanations of the role of the AI system and of the main elements of the decision. A score that your own people cannot explain in their own words is therefore a risk.

Not everything that looks like HR AI is high-risk

The Regulation contains an exception. Article 6(3) provides that an Annex III system is nevertheless not considered high-risk where it does not pose a significant risk to the health, safety or fundamental rights of persons, including by not materially influencing the outcome of decision-making. That exception has one hard limit: if the system performs profiling of natural persons, it is always high-risk.

In practice this separates the wheat from the chaff. A text generator that writes a draft job advert which you then rewrite yourself is something different from a system that ranks a hundred CVs by suitability. An important detail: that assessment is made by the provider, not by you, and under Article 6(4) the provider must document it and register the system. So ask for that documentation; a vendor who says their tool is not covered without showing that reasoning is not giving an answer.

The Regulation lists four circumstances in which the exception can apply, and at least one of them must be met:

• The system performs a narrow procedural task.
• The system improves the result of a previously completed human activity.
• The system detects decision-making patterns or deviations from prior decision-making patterns, and is not meant to replace or influence the previously completed human assessment without proper human review.
• The system performs a preparatory task for an assessment relevant to one of the use cases listed in Annex III.

Four red flags in vendor claims

A lot of HR and planning software is currently being sold with AI Act language on the packaging. Four claims warrant suspicion. A vendor who says the rules only apply from 2027 and that you need do nothing until then is ignoring the GDPR and the ban on emotion recognition. A vendor who claims to be AI Act compliant without saying in which role and on which point is saying nothing. Software that infers emotions, motivation or personality from video or voice does not get past Article 5 in a work-related context. And anyone who sells you the fundamental rights impact assessment of Article 27, or a registration in the EU database, as an obligation for your company is selling something the Act does not require there: neither falls on an ordinary private employer.

One pitfall deserves separate attention, because it arises precisely in companies that take a smart approach. Under Article 25 you yourself are treated as the provider if you put your name or trademark on a high-risk system, substantially modify it, or change the intended purpose of a system that is not high-risk in such a way that it becomes high-risk. Building your own CV selection routine on top of a general-purpose chatbot is therefore not a way around the rules, but a way of pulling the heaviest obligations into your own organisation.

The questions to ask a vendor

These six questions make clear in a single conversation whether a vendor has really thought the Regulation through:

• Does your system fall under point 4 of Annex III? If not, on which circumstance in Article 6(3) do you base that, and where is that assessment documented?
• Does the system perform profiling, in the sense that it scores or ranks people on personal characteristics? If so, the exception does not apply.
• Who is the provider within the meaning of the Regulation, and in whose name is the conformity assessment? With tools that put their own layer over a general-purpose AI model, this is often unclear.
• Do you supply instructions for use as prescribed by Article 13, with the tested level of accuracy and the associated metrics, the known limitations and the performance for specific groups of persons?
• How do you substantiate that the model does not systematically disadvantage certain groups, and on which population was that tested? An accuracy percentage without a test population says nothing about our candidates.
• What logs does the system generate, how do we get access to them, and can our reviewer demonstrably override a proposal?

The Netherlands: no separate law, but supervision is getting under way

The Netherlands has no separate law prescribing procedures for recruitment and selection. The private member's bill Wet toezicht gelijke kansen bij werving en selectie (a bill on supervising equal opportunities in recruitment and selection) was rejected by the Eerste Kamer (Dutch Senate) on 26 March 2024, with 38 votes against and 37 in favour. The framework therefore consists of the GDPR, equal treatment legislation and the AI Act.

Supervision of that framework is meanwhile getting under way. The AP is the coordinating supervisory authority for algorithms and AI and works with, among others, the RDI (Dutch Authority for Digital Infrastructure) and the Nederlandse Arbeidsinspectie (Netherlands Labour Authority); the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) is not yet in force. In the sixth Rapportage AI & Algoritmes Nederland (the AP's AI and algorithms report for the Netherlands) of 5 March 2026, the AP names the rapid growth of AI in recruitment and selection, and the major risks it brings, as one of its three main points, alongside inadequate transparency and lagging preparation for the Regulation. In that edition, the AI Impact Barometer went from two to four red indicators. There will be no inspector at the door tomorrow, but this is the subject the regulator is focusing on, and an applicant can already file a complaint under the GDPR today.

The human decides and signs, and where to start

At AIBA, our starting point is that the human decides and signs. Nowhere does that apply as literally as here: a rejection, a promotion or a different pay grade is a decision about someone's livelihood, and you cannot delegate it to a score. A system may rank, pre-sort and prepare; the assessment and the signature stay with a human who can genuinely reverse the outcome.

Start with an inventory that looks beyond your own software, because AI in recruitment often sits with a third party: your vendor's applicant tracking system, the temporary employment agency that pre-selects, or the assessment you buy in. Ask those parties in writing whether their service uses AI to assess, score or rank candidates, and keep the answer. In horticulture this comes up most sharply around harvest peaks and the hiring of flexible workers, where planning software and job placement meet; what applies per system there is set out on our page on the EU AI Act in greenhouse horticulture and agri-food (in Dutch).

Then put three things in order: a working agreement that a rejection never follows from a system outcome alone, an information notice for applicants about what you use and what rights they have, and a record of who in HR has been trained in what. That meets what the GDPR requires today and lays the foundation for December 2027. Our free Practice Scan helps map where AI sits in your processes, including the staff-related applications you may not see as AI yourself.