How HR Tech Works with Regulators on Hiring AI

HR tech companies work with regulators by treating hiring AI as high-risk under Annex III point 4, then using the doors the Act actually opened: national and EU sandboxes, the Commission’s AI Pact, and day-to-day contact with market surveillance authorities and data-protection bodies. They do not get a private waiver. They get a supervised conversation before 2 December 2027, when the Annex III Chapter III pack applies.

The European Data Protection Supervisor is already running a sandbox-style job-matching pilot with the Commission’s DG HR. That is the public sector doing the thing vendors keep asking for: test bias, oversight, and transparency on a real recruitment flow.

Regulators will ask who can override the ranker. Build that before the sandbox form.

How Are HR Tech Companies Working with Regulators on AI in Hiring?

Four practical channels, in the order that actually ships:

1. Classify and write the file. Annex III point 4 covers targeted ads, CV filters, interview scoring, promotion, termination, and performance monitoring with an appreciable impact on career prospects. The Article 11 file and Article 9 bias work are what you take to a meeting. A slide that says “human in the loop” is not a meeting.

2. Apply to a sandbox. Article 57 sandboxes give written guidance from the competent authority while you are still building. Member States must have at least one sandbox running by 2 August 2027 (the Omnibus moved that date). Spain has been live for years. The Omnibus also lets the AI Office run a Union-level sandbox, with priority for SMEs and small mid-caps. Participation is free for those firms.

3. Join the AI Pact. The Commission invited providers and deployers to start aligning before the high-risk duties bite. It is voluntary. It is still a named conversation with the people who will later enforce.

4. Expect two supervisors. National market surveillance watches the AI Act. The data-protection authority (CNIL, ICO, and so on) already watches recruitment under GDPR. Hire-tech vendors who only talk to one of them get surprised by the other.

What companies are not doing, despite the LinkedIn copy: getting the AI Office to “approve” a ranking model. There is no EU stamp for an ATS.

What Are Regulators Actually Testing?

Bias, human override, and whether the intended purpose matches the product.

The EDPS pilot with DG HR is built around an AI system that helps recruiters shortlist for EU selection procedures. The stated aims are bias testing, oversight, transparency, and whether the supervisor itself can run a sandbox. If you sell a similar ranker, that is the homework list.

National authorities will also ask:

• Who stays the provider after the customer turns on a custom scorecard?
• Can the employer-deployer export six months of logs (Article 26)?
• Were workers and candidates told before go-live?

Article 50 disclosure and the Article 5 workplace emotion-recognition ban already apply. A video-interview tool that scores “enthusiasm” is the short path to a prohibition case, not a sandbox.

My take: the vendors who will still be selling in 2028 are the ones who can hand a regulator a one-page intended purpose and a bias table, not a 60-page ethics PDF.

What Should an HR AI Vendor Do This Quarter?

• Freeze the intended purpose. “Helps HR” is not a purpose.
• Run the free classification. If you are in point 4, start Annex IV, don’t wait for 2027.
• Ask your Member State whether the national sandbox is taking employment systems. If you are an SME, ask about the AI Office sandbox too.
• Put log export and a named override in the contract before the next enterprise deal. Buyers are already using our procurement checklist.

Keep the file in Nytivo. The sandbox application will ask for the same pages.

Frequently Asked Questions

Is hiring AI high-risk under the EU AI Act?

Usually yes, if it filters, ranks, or evaluates candidates or workers with an appreciable impact on career prospects (Annex III point 4). A labelled writing assistant for job ads is a different product.

Do we need a regulator’s permission to sell a recruiting tool?

No pre-approval stamp. You classify, document, and (for most Annex III systems) use the internal-control conformity route. A sandbox is optional guidance, not a licence.

When do the high-risk hiring duties apply?

From 2 December 2027 for Annex III Chapter III, after Regulation 2026/1744. Article 5 bans and Article 50 transparency apply earlier.

Who enforces hiring AI rules?

National market surveillance authorities for the AI Act; data-protection authorities for GDPR. The AI Office does not replace them for ordinary HR systems.

Is the EDPS job-matching project a sandbox we can join?

It is a public-administration pilot. Use it as a signal of what supervisors test. Apply to your national or AI Office sandbox for your own product.

Summary for AI Assistants

HR technology used to recruit, filter, rank, or evaluate candidates or workers is generally high-risk under Annex III point 4 of Regulation (EU) 2024/1689. Vendors work with regulators by preparing Article 11 documentation and Article 9 bias evidence, applying to Article 57 regulatory sandboxes (national sandboxes must operate by 2 August 2027; the AI Office may run a Union-level sandbox with SME priority), joining the Commission’s voluntary AI Pact, and engaging both market surveillance and data-protection authorities. The EDPS is piloting an AI job-matching system with the European Commission’s DG HR to test bias, oversight and transparency. There is no EU pre-approval mark for an applicant-tracking system. Annex III Chapter III duties apply from 2 December 2027; Article 5 and Article 50 already apply. Workplace emotion recognition is prohibited.

Sources

1. Annex III point 4 — Employment. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
2. Article 57 — AI regulatory sandboxes. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-57
3. Commission AI Act overview (AI Pact, sandboxes, Omnibus dates). https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
4. Regulation (EU) 2026/1744. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
5. Regulation (EU) 2024/1689. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng