If your firm uses AI to screen CVs, rank candidates, target job ads, or evaluate staff, you're operating under Annex III §4 of the EU AI Act, and some hiring tools are prohibited outright. cosantio gives HR teams, internal recruiters, and agencies the workflow, artefacts, and named officer to be audit-defensible in time. Examples here are drawn from the Irish market we know best, but the obligations apply across the EU, with some country-specific variation.
Hiring AI in Ireland and the EU is regulated by more than the AI Act. The four frameworks below overlap, and one of them bans certain tools outright. cosantio's Scorecard maps your firm against all four at once.
Source: Regulation (EU) 2024/1689
Classifies AI used for recruitment, selection, and workforce management as high-risk: targeting job ads, screening and ranking applicants, and decisions on promotion, termination, task allocation, or performance monitoring. Triggers obligations on data governance, human oversight, transparency, and record-keeping.
Source: AI Act Art. 5 · since Feb 2025
Some hiring tools are banned, not merely high-risk. Inferring a candidate's emotions in an interview is prohibited under Article 5(1)(f), and the Commission's guidelines extend “workplace” to recruitment. This applies now and is not deferred to 2027.
Source: GDPR Art. 22 · DPC
Candidate and employee data is personal data. Article 22 restricts solely-automated decisions with legal or significant effect, and a DPIA is usually required. The Data Protection Commission supervises hiring analytics, profiling, and employee monitoring.
Source: Employment Equality Acts
A screening or ranking tool that produces discriminatory outcomes across gender, age, disability, race, or other protected grounds breaches equality law regardless of the AI Act. Enforced in Ireland by the WRC and IHREC, with the burden often on the employer to justify.
The AI Act treats your firm differently based on whether you develop the AI or use it. That distinction (provider vs deployer) shapes which Article 16 or Article 26 obligations apply, and building or fine-tuning a screening tool can pull you into both.
HR and hiring managers in SMEs using a third-party ATS, CV-screening, or scheduling tool. Acting as deployer under Article 26 means human oversight, transparency, logging, and the worker-information duty, even though you did not build the tool.
Agencies screening, matching, or ranking candidates on behalf of clients. Build a screening model, or fine-tune a vendor's on your own candidate pool, and Article 25 can reclassify you as a provider with the full Article 16 obligation set.
Firms that build the screening, matching, or performance-management AI that everyone else deploys. Full provider obligations apply: technical documentation, data governance, conformity assessment, and EU registration.
Worker-notice duty. Before using a high-risk AI system at work, Article 26(7) requires employers to inform workers' representatives and the affected workers first. This is a deployer obligation that lands even when the tool is a third-party product you did not build. The Scorecard flags where it applies to your firm.
Real systems we see across Irish and EU employers and agencies. Classifications and obligations below are illustrative; your firm's classification depends on the specific use, not the product name.
Excerpt from a sample Annex IV technical dossier for a candidate-screening engine. Every finding cites firm-specific evidence; every gap names an owner and a date.
The Scorecard is the same eight questions for every sector, but the result is sector-specific. Hiring teams get §4 classification, a prohibited-practice check, and the Article 26(7) worker-notice obligations layered on top of the core readiness assessment.
Free · 3 minutes · no login
Eight plain-English questions. A regulator-grade PDF that scores your firm against every AI Act obligation in scope, with hiring-specific framing throughout.
Demo · 20 minutes · with our team
The full Annex IV workflow inside the platform: 25 questions across 11 pillars per AI system, producing a regulator-grade technical dossier for an auditor, a client, or your board. Book a demo to walk through a sample and the hiring-specific features.
Eight questions. Three minutes. A regulator-grade PDF with §4 classification, a prohibited-practice check, and a prioritised action plan for your firm.