The EU AI Act, effective from 2026, introduces new rules for recruitment agencies using AI for candidate matching, screening, or anonymisation. These rules focus on transparency, documentation, and risk management for AI systems classified as high risk in recruitment. Meeting these obligations is critical to avoid fines and reputational damage.
What changed in 2026
The EU AI Act (Regulation 2021/0106) came into force with detailed requirements for AI systems, categorising recruitment AI tools as "high risk" under Annex III. This classification covers systems that influence hiring decisions or process sensitive personal data for job candidates.
From 2026, recruitment agencies and their AI providers are typically required to:
- Document the design, development, and testing processes of AI tools used in recruitment.
- Conduct risk assessments to identify potential biases and discriminatory outcomes.
- Implement transparency measures so candidates understand when AI is used.
- Maintain logs and records to demonstrate compliance in audits.
These changes mean routine AI-driven tasks—like CV screening, candidate scoring, or anonymised shortlisting—now carry explicit legal duties. The focus is on fairness, explainability, and data minimisation.
The EU AI Act obligations recruiters care about
Recruiters using AI in hiring should focus on four main obligations under the Act:
1. Transparency and disclosure
Candidates must be informed when AI is involved in decisions affecting them. This includes clear communication about:
- The use of AI in screening or scoring., logic behind AI decisions, where feasible., possibility of human review or appeal.
Transparency helps meet the Act's requirement that individuals understand AI's role and can contest decisions.
2. Risk management and bias mitigation
Recruitment AI systems must undergo risk assessments before deployment and regularly thereafter. These cover:
- Potential discrimination against protected groups under the Equality Act 2010 or equivalent EU laws.
- Accuracy and reliability of AI outputs.
- Data quality and representativeness.
Agencies should work with AI vendors to ensure bias tests and corrective measures are documented.
3. Data governance and minimisation
Only data necessary for recruitment decisions should be processed. This means:
- Avoiding extraneous sensitive data (e.g., health, religion) unless essential.
- Applying anonymisation or pseudonymisation where possible.
- Retaining data only as long as required for recruitment or compliance.
Data governance helps reduce privacy risks and supports GDPR compliance alongside the AI Act.
4. Record-keeping and auditability
Agencies must keep technical documentation on AI systems, including:
- System design and intended purpose.
- Data sets used for training and testing.
- Logs of AI decisions and human interventions.
This documentation supports regulatory audits and internal reviews.
What recruiters must redact / disclose / retain
Redact
Recruiters typically need to remove or mask:
- Personal identifiers not relevant to job criteria (e.g., photos, dates of birth).
- Information that could introduce bias (e.g., gender, ethnicity) if not anonymised properly.
- Data subjects' sensitive categories unless legally justified.
Redaction supports fairness and minimises discrimination risks.
Disclose
Recruiters generally disclose to candidates:
- That AI tools are used in the recruitment process.
- The main factors AI considers where possible.
- Their rights to request human review or correction.
This disclosure is typically part of privacy notices or candidate communications.
Retain
Agencies usually retain:
- Records of AI assessment reports.
- Documentation on data sources and processing.
- Logs of AI decisions and any manual overrides.
Retention periods should matches recruitment needs and data protection rules.
Penalties and enforcement landscape
The EU AI Act enforces compliance with fines up to €30 million or 6% of global turnover for serious breaches. National authorities across member states will oversee enforcement, often working alongside data protection regulators.
Recruitment agencies face reputational and financial risk if AI systems cause discriminatory outcomes or fail to meet transparency standards. Enforcement will focus on:
- Failure to document AI risk assessments.
- Lack of candidate disclosure on AI use.
- Processing excessive or inappropriate data.
While initial enforcement may prioritise larger organisations, agencies should prepare for audits and complaints.
How agencies operationalise this
Agencies can meet these obligations by:
- Mapping AI tools in use and their risk profiles.
- Collaborating with AI vendors to obtain compliance documentation.
- Updating candidate communications to include AI disclosures.
- Training recruitment staff on AI-related risks and procedures.
- Implementing standard redaction protocols to remove bias-prone data.
- Maintaining audit trails of AI decisions and human reviews.
Some tasks require upfront effort but reduce risk in the long term. Agencies with high volumes of AI-processed CVs will benefit from automated redaction and formatting tools.
Distill can help by stripping names, emails, phone numbers, photos, and graduation years from CVs before submission—supporting anonymisation and compliance with data minimisation standards.
FAQ
Does the EU AI Act replace GDPR in recruitment?
No. The AI Act complements GDPR. GDPR remains the primary law on personal data protection. The AI Act adds specific rules on AI system transparency, risk, and documentation.
Are small agencies exempt from the AI Act?
No explicit exemptions exist based on size. Obligations scale with risk and AI use intensity. Smaller agencies with limited AI use may face fewer burdens but should still document processes.
Can I rely on my AI vendor for compliance?
Vendors share responsibility but agencies remain accountable for recruitment decisions. Always verify vendors' compliance claims and request documentation.
What if AI results in biased hiring outcomes?
You should investigate and remediate bias sources. The Act requires ongoing monitoring and corrective measures to reduce discriminatory impacts.
How do I inform candidates about AI use?
Include clear statements in privacy notices, job adverts, or application portals explaining AI's role. Offer contact points for questions or human review requests.
If your agency sends 20+ CVs a week to clients using AI-driven ATS or screening tools, Distill formats and redacts candidate data automatically to help you meet EU AI Act requirements without extra manual work. Try Distill free to see how it streamlines compliance.