EU AI Act Annex III, GDPR Article 22, and the obligations the recruiting team has not heard of.
Your recruiter chose Phenom because it shortlists candidates faster. Phenom is a high-risk AI system under EU AI Act Annex III. Your DPO did not classify it. Your HR director did not register it. The candidates rejected by it have a right under GDPR Article 22 to human intervention that no one in the chain knows how to provide.
This piece is the structured account of what recruitment AI tools do, what regulatory regimes they cross, and what the DPO and HR director need to coordinate on as part of any credible HR AI governance programme. The four named tools: Phenom, Eightfold, HireVue, Paradox, represent the substantive part of the recruiting AI market and each illustrates a different obligation pattern.
EU AI Act Annex III High-risk Classification
Annex III paragraph 4 of the EU AI Act lists, as high-risk, AI systems intended to be used for the recruitment or selection of natural persons, in particular for placing targeted job advertisements, analysing and filtering job applications, and evaluating candidates. The same paragraph also covers AI systems intended to be used to make decisions affecting the terms of work-related relationships, the promotion or termination of work-related contractual relationships, the allocation of tasks based on individual behaviour or personal traits or characteristics, and the monitoring and evaluation of performance and behaviour.
The classification is broad and operationally inclusive. Any AI tool that screens, scores, ranks, shortlists, or otherwise filters candidates falls inside. Any AI tool used after hire to evaluate performance or determine task allocation also falls inside. The reading that excludes "tools that just help" the recruiter is not the reading the supervisor will adopt.
As a deployer of a high-risk AI system, the firm assumes the deployer obligations under Article 26 of the Act: use the system in accordance with the provider's instructions for use; assign human oversight to natural persons with the necessary competence, training, and authority; ensure the input data is relevant and sufficiently representative; monitor the operation; inform workers and their representatives before deployment; conduct, where applicable, a fundamental rights impact assessment under Article 27; maintain logs.
The deployer obligations under EU AI Act compliance apply from 2 August 2026 for systems placed on the market after that date. Existing high-risk AI systems already in service before 2 August 2026 must be brought into compliance by 2 August 2027. The grace period is real but the discovery and classification work has to happen earlier in either case.
GDPR Article 22 - Automated Decisions and The Right to Human Intervention
Article 22 of GDPR provides that the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Recruitment decisions, particularly rejection at the screening stage that prevents a candidate from progressing, fall within "similarly significant effects" under the European Data Protection Board's published guidance and the Article 29 Working Party guidance the EDPB inherited.
The exceptions in Article 22(2) - necessity for entering into a contract, authorisation by Union or member state law, explicit consent, do not generally cover recruitment screening as conducted by AI tools without explicit candidate consent and implementation of the safeguards Article 22(3) requires.
The operational implications. The candidate has the right to obtain human intervention in the decision, to express their point of view, and to contest the decision. The firm's recruitment AI must be operated in a way that supports those rights, meaning the AI cannot be the final decision-maker for screening rejections without a human review pathway, and the candidate must be able to access that pathway. Most recruitment AI deployments do not currently support this in practice; the screening rejection is automated, the candidate is not informed, and no human-review channel exists.
Conversations with HR directors tend to follow a predictable pattern. The DPO explains that the recruiting AI is a high-risk system under the EU AI Act and that candidates rejected at the screening stage have a right to human intervention under Article 22. The HR director listens, nods, and says that we do review every shortlisted candidate before we call anyone, and that is not the same thing. The Article 22 right belongs to the candidate who was screened out by the AI before the shortlist was ever built. The HR director's review only happens after the AI has already decided who makes it onto the list. The candidate who did not make it never gets a human reviewer; instead, they receive an automated rejection without any information on how the decision was made. The regulatory gap is not in the shortlist review. It is in everything that happened before the shortlist existed. - Namita Razdan, Co-Founder, Montro |
Four Tools, Four Obligation Patterns
The named tools illustrate distinct HR AI governance obligation patterns that DPOs should be able to recognise and triage.
Phenom. Talent experience platform with AI-driven candidate matching, talent intelligence, and chatbot-based engagement. The matching function is the high-risk activity under Annex III. The chatbot adds Article 50 transparency obligations under the EU AI Act. The Article 22 implications follow if the matching influences shortlisting in ways the firm relies on.
Eightfold. Talent intelligence platform with AI-driven candidate-job matching, internal mobility recommendations, and skills inference. Annex III applies to the external recruitment functions. The internal mobility application falls in scope because Annex III paragraph 4 covers decisions affecting work-related relationships, including promotion. The skills inference engine raises an additional question about the lawful basis for processing data the candidate has not directly provided.
HireVue. Video interview platform with AI-driven analysis of recorded interviews, historically including facial expression and voice tone analysis, with the company's published position evolving as regulatory scrutiny has increased. Annex III applies. The Article 5 prohibited-practices list includes emotion recognition in workplaces with limited exceptions; the boundary between "interview assessment" and "emotion recognition" is operationally narrow and the firm should specifically check the configuration of the tool against the prohibited-practices line. The supplier's documentation should be sufficient to establish where the configuration sits, and confirming it is a mandatory step in any EU AI Act compliance programme covering recruitment AI.
Paradox. Conversational AI for candidate engagement and screening. The chatbot function adds Article 50 transparency. Where the screening determines candidate progression, Annex III and Article 22 both apply.
A Six-Item Checklist for HR and DPO
- Inventory the recruiting AI tools and the points in the recruitment workflow at which each operates. Distinguish AI that screens, AI that shortlists, AI that recommends, and AI that schedules, they have different obligation profiles.
- Classify each tool against the EU AI Act tiers as part of a structured HR AI governance exercise. Most fall into Annex III high-risk; some have additional Article 50 transparency layers; check specifically against the Article 5 prohibited-practices list for any tool with emotion-recognition components.
- Establish the human review pathway for Article 22 purposes. Document the trigger that routes a rejected candidate to a human reviewer, the reviewer's authority to overturn the AI decision, the candidate's right to access this pathway, and the communication that informs the candidate this right exists.
- Update the recruitment privacy notice to reflect AI use. The Article 13 information obligations include meaningful information about the logic involved and the significance and envisaged consequences of automated decision-making for the data subject. Most recruitment privacy notices do not currently address AI screening; the update is operational.
- Conduct the Article 35 DPIA for recruitment AI processing. The DPIA threshold is met for high-risk AI deployments touching natural persons in this context, and the DPIA is the documentary instrument that demonstrates the firm has considered the risks and the mitigations.
- Inform workers and their representatives before any new deployment, per Article 26(7) of the EU AI Act. The obligation runs to existing employees, not just to candidates. Where works councils exist, the consultation runs through them.
Frequently Asked Questions
Does GDPR Article 22 apply to AI-assisted recruitment if a human makes the final decision?
It depends on how much weight the human reviewer gives to the AI's output. Where the human systematically follows the AI's recommendation without meaningful independent assessment, European supervisory authorities have increasingly taken the position that the decision is effectively automated for Article 22 purposes. The human review pathway needs to be genuinely independent; the reviewer must have the authority, competence, and information to overturn the AI's output, not a procedural step that rubber-stamps it.
What does Article 26(7) of the EU AI Act require before deploying recruitment AI?
Article 26(7) requires deployers of high-risk AI systems to inform workers and their representatives before the system is deployed in the workplace. For recruitment AI, this obligation runs to existing employees affected by the system, not just to external candidates. Where works councils exist, as in Germany, the Netherlands, and Austria, the consultation typically runs through co-determination procedures before deployment typically proceeds.
Is skills inference from a CV by an AI tool lawful under GDPR?
It depends on the lawful basis and the transparency provided. Where a platform like Eightfold infers skills the candidate has not directly stated - from job titles, tenure, or associated roles, the processing involves data the candidate did not provide, engaging Article 14 information obligations. The organisation also needs to identify a lawful basis for the inference; legitimate interests is available but requires a balancing test, and the candidate's reasonable expectation of how their CV data will be used is a relevant factor.
What is the difference between Annex III paragraph 4 and Article 5 emotion recognition for HR tools?
Annex III paragraph 4 classifies recruitment and performance evaluation AI as high-risk, triggering deployer obligations including human oversight and FRIA. Article 5 prohibits emotion recognition in workplaces with limited exceptions. The two provisions can apply to the same tool simultaneously: a video interview platform that analyses facial expressions is both a high-risk system under Annex III and potentially operating in prohibited-practice territory under Article 5, depending on configuration. The firm needs to verify both positions independently, and that verification is the starting point for EU AI Act compliance on any high-risk AI system with emotion-recognition components.
