Sector · HR and recruitment

One duty runs before go-live, and one thing is simply banned.

Annex III point 4 catches most of the HR technology stack — screening, ranking, promotion, task allocation, performance monitoring. Two rules on this ground exist nowhere else: workers must be informed before a high-risk system is put into use, and inferring emotions in the workplace is prohibited outright.

No card · EU-hosted · 5 minutes to a first classification
Veritome obligations register — EU AI Act and GDPR duties per system and for the organisation, with owners, dates and status
The reality

What HR teams find out late.

What we hear

“We told the works council after the rollout.”

What the product does

Art. 26(7) requires the information to reach workers and their representatives before the system goes into use. After go-live is not a late filing — it is a duty not complied with.

What we hear

“The interview tool scores confidence and enthusiasm.”

What the product does

Inferring emotions in the workplace is prohibited under Art. 5(1)(f), and prohibitions have applied since February 2025. There is no conformity route that makes it permissible.

What we hear

“It only ranks applicants, a human still decides.”

What the product does

Annex III point 4 covers filtering and evaluating candidates, not only final decisions. A human at the end changes the oversight design; it does not remove the listing.

What you get

The duties that are specific to this ground.

01

The prohibition screened first

The intake walks Art. 5 before anything else, so an emotion-inference feature surfaces as prohibited rather than as a high-risk item to work through.

02

The worker notice, dated

The Art. 26(7) notice as an artefact with a date that can be compared to go-live, because the sequence is the substance of the duty.

03

Oversight with authority

Art. 26(2) wants a named person with the competence and authority to override an output. The register holds who, not just that.

04

Applicants informed

Art. 26(11) informs the people subject to decisions — in recruitment, the candidates, not only the staff.

05

GDPR Art. 22 alongside

Solely automated decisions with significant effects, and the DPIA that usually follows, on the same register.

06

Art. 4 literacy for the people using it

Recruiters operating a high-risk system need the literacy the Act requires, evidenced per person.

In practice

Three HR deployments.

Use case 01

A company rolling out CV screening across hiring.

  • Annex III point 4 — high-risk, full Art. 26 deployer set.
  • Art. 26(7) notice issued to representatives and workers before go-live.
  • Named overseer with authority to override, recorded.
  • Logs retained to the Art. 26(6) six-month floor.
Veritome obligations register — EU AI Act and GDPR duties per system and for the organisation, with owners, dates and status
Use case 02

A team evaluating an interview platform with sentiment scoring.

  • Art. 5(1)(f) screening flags emotion inference in the workplace as prohibited.
  • The finding lands before procurement, not after deployment.
  • The rest of the platform can still be assessed on its own merits.
  • The decision and its reasoning are recorded with a date.
Veritome guided classification — the register wizard that walks Article 5, Annex I, Annex III and the Article 6(3) exception
Use case 03

An employer using AI to allocate shifts on behaviour.

  • Task allocation based on behaviour or personal traits is inside point 4.
  • Worker notification and oversight apply as they would to screening.
  • GDPR Art. 22 considered where the allocation has significant effects.
  • One register, one evidence base for both regimes.
Veritome evidence register — files with fingerprints, the clauses each satisfies, scope and status
Also included

What sits beside the HR duties.

Straight answers

Straight answers for HR.

Which HR systems are high-risk?

Annex III point 4 covers AI used for recruitment or selection — including targeted job advertising, filtering applications and evaluating candidates — and for decisions on promotion, termination, task allocation based on behaviour or personal traits, and monitoring or evaluating performance. That is most of the HR technology stack, which is why this ground repays scoping carefully rather than assuming.

What is different about worker notification?

Article 26(7) requires deployers who are employers to inform workers' representatives and the affected workers BEFORE putting a high-risk system into use at work. It is one of the few duties with a hard sequencing requirement, so a notice issued after go-live has not been complied with — it has been documented late.

Can we use emotion recognition in interviews?

No. Article 5(1)(f) prohibits placing on the market, putting into service or using AI to infer emotions in the workplace and in education, outside narrow medical or safety purposes. This is a prohibition, not a high-risk duty: there is no conformity route that makes it permissible, and the prohibitions have been in force since February 2025.

Does the vendor's compliance cover us?

No. You are the deployer. Their conformity assessment is theirs; your oversight, your input data, your logs, your worker notification and your Article 4 literacy remain yours regardless of what their sales material says.

How does GDPR fit in?

Closely, and on the same register. Article 22 governs solely automated decisions with legal or similarly significant effects — which a hiring rejection can be — and a DPIA is very likely required. Where an Article 27 fundamental-rights assessment also applies, it can build on that DPIA under Article 27(4).

Where to next

Check the tool before the rollout date.

One of these duties has to happen before go-live, and one feature is prohibited outright. Eight questions for most systems tell you which applies.

Run the free check See pricing