AI in hiring: three common misconceptions about the EU AI Act

Vendor compliance does not cover your own obligations, not every deadline waits until 2027, and the EU AI Act does not explicitly require an AI-free candidate route.

AI is now part of many hiring processes, from screening applications to assessing candidates. Used responsibly, it can make hiring faster, more consistent and fairer for every candidate, as long as it stays transparent and overseen by people. Building that trust in how AI supports hiring decisions is one of the reasons the EU AI Act was introduced.

Hiring is one of the areas the EU AI Act watches most closely. AI tools used to recruit and select candidates may be considered “high-risk” under Annex III of the Act, which means they come with extra rules. Those rules apply both to your AI hiring vendor and to you, as the organisation using the tool to recruit.

Because the Act has been amended, delayed in parts and covered unevenly, three misconceptions about EU AI Act hiring obligations keep coming up among TA and HR leaders. Getting them wrong creates real compliance gaps.

Why hiring sits squarely in scope

Most AI tools used in hiring fall under Annex III as high-risk AI systems in employment. These include:

• CV screening.
• Candidate ranking.
• Voice or video assessment with a score attached.
• Conversational interview agents.

That classification is what triggers the obligations discussed below. It applies at every stage where AI contributes to a decision about a candidate, not only at final selection.

It also applies regardless of where your company is headquartered. What matters is whether the candidates being evaluated are based in the EU, not where your business is registered.

Misconception 1: “My AI hiring vendor is compliant, so I'm covered”

Wrong. The EU AI Act distinguishes two roles:

Deployer obligations are significantly lighter than provider obligations. Most of them are set out in a single article of the EU AI Act, Article 26, which applies from 2 December 2027. They include following the vendor's Instructions for Use, a document every provider of a high-risk system is required to publish.

Lighter does not mean none, and your vendor's compliance will not cover them for you.

What a deployer gap looks like

Your vendor's screening tool is compliant. But if your recruiters reject candidates blindly, without really reviewing the AI outputs, especially if that review is a requirement described in the Instructions for Use, you have a gap. The gap sits with you as the deployer, not with your vendor.

In practice, someone in your organisation needs to read the Instructions for Use for every AI hiring tool you deploy, not file it away as a vendor artefact.

It is also worth seeing what credible provider-side evidence actually looks like. We publish how we audit Mochi and Shiro for bias every year, which is the kind of documentation your own vendors should be able to produce.

Misconception 2: “All the EU AI Act obligations have been postponed to December 2027”

Wrong. The Digital Omnibus, which entered into force in July 2026, postponed the high-risk obligations to 2 December 2027. But other parts of the EU AI Act already apply.

The dates that matter

Prohibited practices are already banned

Some uses of AI in hiring are already banned outright, not merely regulated. Using AI to detect how a candidate or employee feels, such as stressed, confident or enthusiastic, from their facial expressions or voice tone is one of them.

Transparency cannot wait until 2027

Under Article 50, AI system providers must ensure that people interacting with their system are informed that they are interacting with AI.

A candidate taking a conversational interview with an AI agent must be told from the start that they are talking to an AI, not to a recruiter. This notice requirement cannot wait for the 2027 deadline because it is already in force.

See “EU AI Act Article 50: what to tell candidates” for what that notice needs to cover.

What this means in practice: “the deadline is 2027” is true for the high-risk obligations under Article 26 and false for prohibited practices and transparency. Treating the whole Act as postponed risks missing requirements that already apply today.

Misconception 3: “I must build an AI-free route for candidates who refuse AI”

This is not an explicit obligation. The core obligations for AI system providers, your vendor, include transparency and human oversight requirements. They do not explicitly require an AI-free route for candidates who would rather not be evaluated by AI.

In practice, we observe different approaches across organisations deploying AI in hiring.

Some emerging US AI laws touch on the alternative-route question in various ways. NYC Local Law 144, California's rules on automated decision-making, and Colorado's AI legislation each approach it differently.

Depending on where your recruitment campaigns take place and which AI system you use, your legal team may conclude that an AI-free route is the safer path, even though the EU AI Act itself does not require one.

What non-compliance actually risks

The EU AI Act is enforced by national market surveillance authorities in each member state, and penalties scale with the severity of the breach.

A prohibited practice, such as emotion recognition in an interview, sits in the most serious enforcement category. A missed deployer obligation under Article 26 sits in a lighter one, but it is still an enforcement category, not a formality.

[fill: verified penalty figure and source for the relevant breach category]

The practical risk for most TA and HR teams is not a headline fine. It is a candidate complaint, a works council question, or a customer's own compliance review surfacing a gap nobody had looked for.

Treating transparency and prohibited-practice obligations as already live, rather than waiting for 2027, closes that gap before it becomes someone else's discovery.

{{BANNER}}

How to review your hiring process

None of this requires you to be a lawyer, but it does require someone in your organisation to own it. In practice, that means three things:

The obligations that already apply, prohibited practices and transparency, are the ones most likely to be overlooked, precisely because the 2027 headline date suggests there is still time. There is time for the high-risk obligations. There is not for the rest.

FAQ

Disclaimer

MakiPeople is not a law firm, and this note should not be considered legal advice or legal evidence. Should you wish to take legal decisions, we recommend that you reach out to your legal counsel.