What the EU AI Act actually requires of hiring teams
Olivia Bennett
Tech Consultant
Latest update
16 min read
IN THIS ARTICLE
The Four Fields Problem
Proxies that survive annoymization
When the rubric itself is the bias
Feedback loops, and why they hide
What monitoring actually catches
A short checklist
10 min remaining
Almost every hiring team using AI eventually faces the same question: what does the EU AI Act actually require when automated systems influence recruitment decisions? It may seem that compliance simply means choosing an approved or compliant tool. But the rules go further. AI systems used for recruitment and candidate selection can fall under the Act’s high-risk requirements, meaning hiring teams may need to consider risk management, human oversight, documentation, record-keeping and ongoing monitoring as part of the recruitment process itself.
Each of these requirements can affect how AI is used throughout the hiring process. Some focus on how candidates are assessed, while others address the controls teams need around automated systems. The two can be difficult to separate, because once AI influences screening or ranking decisions, earlier outputs can shape who reaches the next stage — making human oversight, documentation and monitoring important throughout the recruitment workflow.
The four fields problem
Consider what remains once an AI-assisted hiring process has screened and ranked candidates: records of automated decisions, risk assessments, human review steps, system outputs, rejected applications, monitoring results, and documentation showing how the system was used. These records can help hiring teams demonstrate that appropriate oversight and controls were in place — and identify recurring patterns that may require further review.
Each of these requirements can influence how hiring teams use AI throughout the recruitment process. Some focus on how candidates are assessed, while others define the safeguards around automated systems. The two effects can overlap, because when AI helps screen, rank, or evaluate hundreds of applications, every automated output can influence who moves forward — and determines where human review and oversight are needed.
The test we use internally
Take a candidate assessed by an AI-assisted hiring system and have two reviewers independently examine the outcome. Ask each reviewer to explain whether they agree with the system’s recommendation, whether they would make the same decision, and what factors influenced their judgment. If their assessments differ, repeated reviews can help hiring teams identify where human oversight is needed and whether the system’s outputs are being applied consistently.
Proxies that survive anonymisation
These are the areas we see most often shaping how hiring teams use AI in recruitment, ordered roughly by their potential compliance impact and how easy they are to overlook:
Risk classification. Hiring teams need to understand whether an AI system used for recruitment falls within the EU AI Act’s high-risk rules. Tools that screen, rank, or evaluate candidates may trigger additional requirements around risk management, human oversight, documentation, and monitoring. Overlooking the system’s classification can leave teams without the controls needed to use AI responsibly throughout the hiring process.
Human oversight. Hiring teams need to ensure that AI-generated recommendations do not become the final decision by default. Reviewers should be able to understand, question, and override automated outputs when appropriate, particularly when AI is used to screen, rank, or evaluate candidates. Without meaningful human oversight, automated recommendations can quietly shape hiring outcomes without sufficient review.
Documentation and record-keeping. Hiring teams may need clear records showing how an AI system is used, what role it plays in recruitment, and how its outputs are reviewed by people. Keeping this information documented can make it easier to demonstrate compliance, investigate unexpected outcomes, and understand how automated recommendations influence candidate assessment and selection.
Risk management. Hiring teams should identify and assess the risks associated with AI systems used in recruitment, including how automated outputs may affect different groups of candidates. A structured risk-management approach can help teams detect potential problems, evaluate their impact, and put appropriate controls in place before those systems influence important hiring decisions.
Monitoring and evaluation. Hiring teams should monitor AI systems after deployment to identify unexpected patterns, errors, or outcomes that could affect candidate assessment. Regular evaluation can help reveal when seemingly unrelated candidate information is influencing automated recommendations and give teams an opportunity to review, correct, or improve how the system is being used.
When the rubric itself is the bias
When screening rules narrow the candidate pool too aggressively, automated outputs can have a greater influence on who receives further consideration. Hiring teams therefore need appropriate safeguards, human oversight, documentation, and monitoring to ensure that AI-assisted decisions remain properly controlled and do not determine outcomes without meaningful review.
A hiring team may set a rule requiring a certain number of years in a similar role, prioritise specific career backgrounds, or make particular qualifications mandatory. An AI system can then apply those criteria consistently without understanding whether they are appropriate or proportionate. Teams should therefore review the criteria, assess potential risks, and ensure that automated screening supports a properly governed recruitment process rather than simply making exclusion more efficient.
That is why hiring teams should monitor not only the AI system itself, but also the rules, criteria, and workflows surrounding its use. When recruitment outcomes or shortlist rates change, teams should be able to identify what changed, document the impact, and review whether additional human oversight or risk controls are needed rather than assuming the model itself is responsible.
Feedback loops, and why they hide
The most difficult risks can develop gradually as AI becomes part of a repeated hiring workflow. If the same screening rules and automated recommendations are used again and again, teams may reinforce existing patterns without noticing how they affect candidate selection. Regular monitoring, risk reviews, and documented changes can help hiring teams detect these patterns early and question whether the system is still being used appropriately.
After months of use, an AI hiring system may appear reliable because it consistently produces similar recommendations and shortlist outcomes. But stable results do not necessarily show that the system is working appropriately. Hiring teams should continue to monitor performance, review risks, and assess whether the system is producing unintended patterns rather than assuming consistency means the process is compliant or effective.
Hiring teams should monitor AI use at each stage of the recruitment process rather than evaluating the system only by its final results. If a significant change appears during screening, ranking, or evaluation, tracking each stage separately can help identify where the issue originates and whether additional human review, documentation, or risk controls are needed.
What monitoring actually catches
Small changes to how an AI hiring system is configured can affect who moves forward in the recruitment process. For example, teams may refine screening criteria, clarify acceptable qualifications, or include equivalent forms of relevant experience. Any meaningful change to the system or its use should be documented and reviewed so teams can understand its impact and maintain appropriate oversight.
The lesson is not that every issue can be solved by changing the screening criteria. It is that potential risks should be identified while the AI system is being used, rather than only after recruitment decisions have been made. Ongoing monitoring and timely review can help hiring teams detect unexpected outcomes earlier and take corrective action before automated recommendations have a wider impact.
A short checklist
Go through the system’s intended use, screening criteria, and decision-making role, and ask whether each requirement is genuinely necessary for the recruitment process. This helps hiring teams identify potential risks, clarify responsibilities, and establish appropriate human oversight before an AI system begins influencing candidate assessment and selection.
Run the AI-assisted recruitment process with the same or comparable inputs and review whether the system produces consistent results. Significant differences in rankings, recommendations, or candidate outcomes can be a signal that the system needs further evaluation. Regular testing helps hiring teams identify unexpected behaviour and determine whether additional monitoring or human oversight is required.
Hiring teams should track how AI is used across screening, ranking, and candidate evaluation rather than looking only at the final outcome. Stage-by-stage monitoring makes it easier to identify where unexpected results or risks appear, assess whether additional controls are needed, and address issues before they influence important hiring decisions.
Hiring teams should not assume that past hiring decisions are enough to demonstrate that an AI system is working appropriately. Historical data can reinforce existing selection patterns without showing whether the criteria remain suitable or whether the system creates new risks. Teams should combine historical information with ongoing testing, risk assessment, monitoring, and meaningful human oversight.
Hiring teams should keep a clear record of significant changes to the AI system, its screening criteria, and how it is used. Maintaining version history makes it easier to trace which configuration was applied at a particular point in time, understand how changes affected recruitment outcomes, and provide evidence for review when compliance questions arise.
None of this guarantees a perfect shortlist. Nothing guarantees that every screening decision will be consistent. What it does provide is visibility into where applications are being filtered differently, so those differences can be investigated, corrected and explained — rather than allowing the system to make confident decisions that no one can properly examine.
