Almost every hiring platform now offers to rank your applicants, score a video interview, or tell you which CVs are worth reading first. Most of those features arrived in an update, switched on, described as smart matching rather than as AI.
Using them puts an ordinary small business into the one high-risk category it is genuinely likely to meet. That is not a reason to panic, and the date moved. It is a reason to know what you are using before December 2027.
General information, not legal advice. Employment decisions carry obligations beyond the AI Act, so take advice on your own situation.
Applies to you if
- You use software to filter, rank, score or shortlist job applicants.
- Your applicant tracking system scores or matches candidates against a role, even if a person makes the final call.
- You use AI to analyse recorded interviews, assess responses or evaluate candidates.
- You use AI in decisions about promotion, task allocation or termination.
Probably does not apply if
- You use AI to write the job advert, or to draft rejection emails a person sends.
- You use it to transcribe an interview you then read yourself, without any scoring.
- Your system sorts by keyword, date or completeness with no model doing any evaluation. Plain filtering is not the same thing.
- You read every application yourself, which most businesses hiring two people a year still do.
Why recruitment specifically
The Act sorts uses by how much damage they can do to a person. Employment sits in Annex III, the high-risk list, because a system that quietly filters people out affects their livelihood and they usually never learn it happened.
Note that it is the use that is high risk, not the business. A twelve-person firm screening CVs with software is in the same category as a multinational doing it. Size does not move you out of the tier, though it does affect how penalties are calculated.
The date changed. It is now 2 December 2027
These obligations were originally due on 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved most Annex III high-risk obligations to 2 December 2027.
Two things worth knowing about that reprieve. The new date is unconditional: the earlier draft tied it to European standards being ready, and that trigger was removed, so it will not drift again without new legislation. And the delay applies to the high-risk obligations, not to everything: transparency duties and the AI literacy duty already apply.
Three situations, worked through
A practice hiring one receptionist. Twelve applications, all read by the practice manager. No AI involved in the decision. Nothing here is high risk, and nothing changes in December 2027.
A contractor using a job board’s “best match” ranking. Eighty applicants, the platform orders them by fit and the owner reads the top fifteen. This is high-risk use, and the sixty-five never read were filtered by a model nobody in the business can explain. The fact a human made the final call does not remove it from the tier.
A firm using AI to summarise interview notes. Summarising what was said, with no score and no ranking, is not evaluation. If the same tool starts rating candidates against competencies, it has moved.
What being a high-risk deployer involves
Lighter than being a provider, and heavier than nothing. Broadly, from December 2027, a deployer is expected to use the system in line with the provider’s instructions, assign human oversight to someone competent and with authority to override it, make sure input data is relevant, keep the automatically generated logs under your control for at least six months, and inform workers’ representatives and affected staff before putting it into use.
Human oversight is the one people get wrong. It is not a person rubber-stamping a ranked list. It is someone who understands enough to notice when the ranking is wrong and has the standing to disregard it.
What already applies, today
Waiting until 2027 to think about it would be a mistake, because three things bite now.
GDPR. Screening applicants is processing personal data, and a decision produced solely by automated means with legal or similarly significant effects carries its own rules. Being rejected for a job qualifies.
Employment equality law. A model trained on who you hired before will reproduce who you hired before. Discrimination law does not care that a vendor’s algorithm did it.
AI literacy. Already in force. Anyone using these tools on your behalf should understand what the score means and what it does not.
Five things worth doing
- Find out what your hiring software already does. Ask the vendor directly whether any feature scores, ranks or matches candidates. Most businesses do not know.
- Ask the vendor whether they consider it high risk under the AI Act, and what they will give you to meet the deployer duties. A vendor with no answer by now is a warning.
- Name who exercises oversight, and make sure they can actually override the tool rather than only agree with it.
- Check what you tell candidates. Your privacy notice should say plainly if automated tools are used in selection.
- Consider whether you need it at all. For a business hiring a handful of people a year, ranking software solves a volume problem you do not have, while adding a category of obligation you would not otherwise carry.
The first of those is the one people skip, because it means admitting you are not sure. An inventory sheet is here if a structured place to write the answers down would help. One of its worked examples is a hiring platform that ranks candidates, so you can see what the honest version of that row looks like before filling in your own.
Common misconceptions
- “We are too small to be high risk.” The use is high risk, not the business. Size affects penalty calculation, not category.
- “A human makes the final decision, so we are fine.” Human involvement at the end does not remove a screening system from the tier. It is one of the safeguards, not an exemption.
- “It is the vendor’s software, so it is their problem.” Providers and deployers carry different duties, and both exist. You cannot contract out of being the deployer.
- “Nothing applies until December 2027.” The high-risk duties start then. GDPR, equality law and AI literacy apply now.
The honest summary
Most small businesses hiring a few people a year should simply read the applications. It is not slower at that volume, and it keeps you out of a category that comes with real obligations from December 2027.
If you already use a platform that ranks candidates, the useful step this month is finding out exactly what it does. The wider Act is covered here, and if you are unsure whether a feature counts as evaluation, describe what it produces and you will get a straight answer.
Sources
Annex III and Articles 26 and 86 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, on EUR-Lex; Article 22 GDPR on automated decisions; and Irish employment equality legislation. Checked 6 August 2026.
Common questions
Does using an applicant tracking system make us high risk?
Only if it evaluates candidates. Storing applications, sorting by date or filtering on a stated requirement is not evaluation. Scoring, ranking or matching against a role is, and that is the common case in modern platforms.
When do these obligations actually start?
2 December 2027 for most Annex III high-risk uses, moved from 2 August 2026 by the July 2026 Digital Omnibus. The new date is unconditional, so it will not slip again without fresh legislation.
Does a human reviewing the shortlist solve it?
No. Human oversight is one of the required safeguards, not an exemption from the category. And oversight means someone able to notice the ranking is wrong and override it, not someone approving a list they cannot interrogate.
Should a small business use CV screening AI at all?
At low hiring volumes, usually not. It solves a problem you do not have while adding obligations, discrimination risk and a decision process nobody in the business can explain to a rejected candidate.