Job advertising

On 12 September 2026, AI used to place targeted job advertisements is listed as high-risk, but the corresponding provider and deployer safeguards do not apply until 2 December 2027. The AI Omnibus moved their former August 2026 start date.² Targeted job-advertising AI is listed as high-risk, subject to the no-significant-risk exclusion in Article 6. The precise application of that exclusion awaits final Commission classification guidance.¹⁴

From 2 December 2027, Articles 9, 10 and 16 require the provider of a covered system to manage risks throughout its lifecycle and ensure relevant training, validation and testing datasets are sufficiently representative and, as far as possible, complete and error-free for their intended purpose. Articles 13 and 16 require the provider to explain the system's capabilities, limitations, accuracy and foreseeable risks to the recruiter or employer deploying it. The relevant national market-surveillance authority enforces these duties. Article 49 also requires the provider, under the same authority's enforcement, to register the recruitment system in the public EU database before marketing it or putting it into service.¹

These are duties on the provider, not personal rights to its complete technical documents. Since 2 August 2026, Article 85 has allowed a person who suspects an infringement to complain to the relevant national market-surveillance authority. The relevant authority and complaint procedure are country-specific.¹

Article 86 has formally applied since 2 August 2026. It requires a recruiter or employer acting as deployer, when requested, to explain the role and main elements of a covered AI-assisted decision with adverse legal or similarly significant effects. The relevant market-surveillance authority enforces that duty. The Act prescribes no request format, response deadline or appeal route. Its operation before the high-risk classification rules begin remains unresolved, and simply not seeing an advertisement may not meet its effects threshold.¹

GDPR may therefore be more useful now. Since 25 May 2018, Article 15 has required the controller to provide access to targeting data, its source, recipients and meaningful information about automated profiling. Article 21 requires the controller to act on a valid objection where its conditions are met, including an objection without reasons if the processing qualifies as direct marketing. National data-protection authorities and courts enforce both duties.³

Where this stops

Not every advertisement selected by software is necessarily high-risk. Article 6 permits exclusion where the system poses no significant risk and does not materially influence outcomes. Final Commission classification guidance was still pending on the checking date.¹⁴