AI in Recruiting: What the New High-Risk Guidelines Mean for HR

On 19 May 2026 the Commission published its draft guidelines on classifying high-risk AI systems. They run to roughly 170 pages of interpretation and practical examples. For hardly any area are they as concrete as for human resources, and for hardly any area are they as clear-cut.

The consultation has closed, and the final version is due to be adopted by the end of 2026. Even then the guidelines will not be legally binding. But they will be the yardstick market surveillance authorities work from.

What counts as high-risk in HR

The relevant provision is point 4 of Annex III to the AI Act. It covers two phases, and the guidelines show how far both reach.

The second block is often overlooked. A company running AI-assisted performance management, or allocating shifts on the basis of a behavioural profile, is just as affected as the recruiting team.

"A human decides" is not enough

The central criterion in the guidelines is the material influence of the AI output on the decision. Even if a recruiter formally makes the final call, the system can still be high-risk if its output largely determines who moves forward.

That describes the typical workflow exactly. A tool ranks 400 applications, and a recruiter looks at the top 30. Formally, she decides. In practice, the system has filtered out the other 370 without a human ever seeing them.

What is already prohibited today

The genuinely urgent point gets lost in the debate about 2027. Emotion recognition in the workplace has been prohibited under Article 5 since February 2025, with exceptions only for medical or safety reasons. That includes job interviews.

This covers video interview tools that infer enthusiasm, nervousness, resilience or honesty from facial expression, voice or word choice. The Commission's draft explicitly warns about the lack of scientific basis for such systems and makes clear the concept is not to be read narrowly. A vendor that markets "attitudes" or "soft-skill signals" instead of emotions is still caught.

There is no transition period to 2027 for these tools. They should be switched off, or the relevant feature disabled, today, and breaches fall into the highest penalty tier of Article 99.

A first classification of typical tools

Use case	Likely classification
Video interview analysing emotions or personality from face and voice	Prohibited since February 2025
CV screening, matching score, applicant ranking	High-risk
Targeted delivery of job ads to selected audiences	High-risk
AI-assisted performance review, task allocation by behavioural profile	High-risk
Parsing CVs into a standard format, with no assessment	Art. 6(3) exemption possible, only without profiling and documented
Drafting job ad text without steering who sees it	Usually not high-risk
Chatbot answering questions about process, deadlines and documents	Usually not high-risk, but disclosure duty under Art. 50

This classification is guidance based on the draft guidelines. In each case what matters is the system's intended purpose and how strongly its output shapes the employment decision.

The underrated trap: ChatGPT as a recruiting tool

Many HR teams do not use a specialised recruiting system at all. They paste CVs into a general-purpose AI assistant and ask for a ranking or a suitability assessment. That feels more harmless than a bought-in screening tool. Legally, it is the opposite.

Under Article 25, anyone who changes the purpose of an AI system so that it becomes high-risk is treated as a provider. That expressly includes general-purpose AI systems. Using a chatbot to rank applicants means you are no longer merely a deployer; from December 2027 you potentially carry a provider's obligations: risk management, technical documentation, conformity assessment. Since the Digital Omnibus, this role shift is also expressly subject to fines.

What employers as deployers must do from December 2027

An employer using a bought-in high-risk system is a deployer. The obligations come mainly from Article 26.

On top of that, Article 86 gives affected persons the right to an explanation of the role the system played in a decision about them. A company that cannot explain a rejection because nobody understands the ranking has a problem at exactly this point.

What already applies in Germany

The postponement to 2027 creates the impression that nothing needs doing in recruiting for now. For employers in Germany that is not true, because two other frameworks already apply.

Then there is the General Equal Treatment Act (AGG). A ranking model trained on historical hiring data adopts its patterns. If a rejected applicant raises discrimination, the burden of proof under section 22 AGG can shift quickly to the employer, and "the tool suggested it" is no defence.

Five steps before December 2027

The point that matters

The high-risk obligations for recruiting arrive only at the end of 2027. But the question they are designed to answer already arises today: can a company explain why an application was rejected, and who is responsible for that?

A company that cannot has not just an AI Act problem in fourteen months, but a works council, data protection and equal treatment problem from the next batch of applications onwards. The inventory needed for 2027 resolves those questions along the way.

This article is for general information only and does not constitute legal advice. It is based on the Commission's draft guidelines of 19 May 2026; the final version may differ. Last updated: 28 September 2026.