Hiring and management

AI that filters applications, evaluates candidates, allocates work using behaviour or personal traits, monitors workers, or is used for decisions affecting promotion or termination is listed as high-risk. The associated safeguards were postponed by the AI Omnibus and are now scheduled to apply from 2 December 2027.¹²

This diagram shows where the later duties attach as a person moves from application to employment.¹

flowchart TD
    A[Application submitted] --> B[AI analyses or filters the candidate]
    B --> C[Hiring decision]
    C --> D[Worker management, promotion or dismissal]
    N1[From 2 Dec 2027<br/>Article 26 eleven: recruiter or employer as deployer tells the affected person at an AI-assisted decision<br/>National market-surveillance authority enforces] -.-> C
    N2[From 2 Dec 2027<br/>Article 26 seven: employer as deployer tells affected workers and representatives before workplace use<br/>National market-surveillance authority enforces] -.-> D
    N3[From 2 Dec 2027<br/>Articles 14 and 26 two: provider enables oversight and deployer assigns qualified overseers<br/>National market-surveillance authority enforces] -.-> B
    N3 -.-> D

Figure: Hiring rules attach at selection, decision and worker-management stages, with later duties shown beside each stage.

From that date, Article 26 requires the employer or recruiter deploying covered AI to assign oversight to people with adequate competence, training, authority and support. Article 14 requires the provider to design the system so those people can understand limitations, resist automation bias and disregard, override or reverse outputs. The relevant national market-surveillance authority enforces both duties. Advance workplace notice under Article 26 covers affected workers and their representatives, not job applicants, although applicants receive notice under Article 26 when high-risk AI makes or assists a decision about them.¹³

For action now, GDPR may be stronger. Since 25 May 2018, Article 22 has required the controller not to subject someone to a solely automated decision with legal or similarly significant effects unless an exception and safeguards apply. Automatic refusal of an online applicant can meet that effects threshold. Article 15 requires the controller to provide the person's data and meaningful information about automated logic and expected consequences. National data-protection authorities and courts enforce these duties.⁴

Article 86 has formally required the deployer since 2 August 2026 to explain, on request, the role and main elements of a covered adverse hiring or employment decision. The relevant market-surveillance authority enforces it, but its operation before December 2027 remains unresolved. Article 85 already permits complaints to that authority.¹

The explanation route has no EU-prescribed request format, response deadline or appeal process. National authorities and procedures vary. The future oversight duties are regulatory duties, not guarantees that a particular decision will be reversed.

Where this stops

Whether a decision is solely automated under GDPR depends on the facts. Older private-sector systems may also remain outside the deferred AI Act safeguards unless significantly redesigned after December 2027.¹