The EU AI Act Applies to Your Recruitment Agency Too
A few weeks ago I saw a post on LinkedIn about the EU AI Act and recruitment. Someone mentioned that agencies using AI tools have legal obligations too, not just the companies building them. That caught my attention, so we immediately looked into it.
Turns out they were right. If you use any AI tool to screen, score, or rank candidates, the EU AI Act considers you a "deployer." That word comes with legal obligations. The deadline is August 2, 2026.
Recruitment AI is classified as "high-risk"
The Act sorts AI systems into risk categories. Recruitment and employment fall under Annex III, Category 4(a). The "high-risk" bucket. This covers any AI system used for:
- Screening or filtering job applications
- Evaluating candidates
- Making or assisting with recruitment decisions
If your tool generates match scores, ranks candidates against a job description, or uses AI to rewrite CVs, it likely falls under this classification.
"High-risk" sounds dramatic. It doesn't mean the tool is dangerous. It means the EU decided that AI used in employment decisions affects people's livelihoods enough to require extra rules.
You're not just a user
This is the part most people miss.
The Act defines two roles: providers (companies that build AI systems) and deployers (companies that use them). Your tool vendor is the provider. Your recruitment agency is the deployer. Both have obligations. Yours are in Article 26.
What you need to do
Here's the practical version.
Before you start using any AI recruitment tool
Assign someone on your team to oversee AI outputs. That person needs the authority to override the AI's recommendations. Not "review when they have time." Actual authority to say "the AI is wrong, we're going a different direction."
Check your legal basis for processing candidate data through AI. You probably already handled this for GDPR, but double-check that it covers automated scoring.
Set up a way for candidates to ask "how did the AI assess me?" and to contest the result.
Before uploading any candidate's data
Tell the candidate their data will be processed by an AI system. Tell them a score may be generated. Tell them they can request an explanation and push back on it.
You can't quietly upload a CV, let the AI score it, and move on. The candidate needs to know.
While using the tool
Review every AI-generated score before making decisions. Not when you remember. Every time.
Never use an AI score as the only reason to reject or shortlist someone.
Watch for patterns. If the AI consistently scores certain types of profiles lower, you need to investigate that. Consistent bias in outputs is your problem too, not just the vendor's.
Records
Keep records of how AI outputs influenced your hiring decisions. "The AI said 85% match and we moved forward" doesn't cut it. You need to show that a human evaluated the recommendation and made an independent judgment.
The fines
For high-risk system obligations, which is what deployer duties fall under: up to 15 million EUR or 3% of global annual turnover. Whichever is higher. Smaller companies get capped at the lower amount.
Will regulators come after recruitment agencies on day one? Probably not. They'll start with the most visible cases. But "probably not" is not a compliance strategy.
What we did at Tlntly
I'm writing this because we just finished our own compliance work. I figured sharing it might save you some research.
Tlntly's scoring system is classified under Annex III, Category 4(a). We're the provider. We updated our Privacy Policy, Terms of Service, and created a Data Processing Agreement. We wrote the technical documentation, risk management plans, and instructions for use that the Act requires from providers.
We also added disclaimers to the scoring UI. Wherever you see a match score or rationale, there's now a note saying it's AI-generated and that human review is required. The law says it needs to be there, so it's there.
Compliance isn't a feature. It's table stakes. But I wanted to be transparent about what changed because some of it directly affects how you use the tool.
If you're a Tlntly user, you'll get an email with the updated legal documents. The Instructions for Use document lays out your deployer obligations in plain language and includes a template for notifying candidates about AI processing.
What you should do this week
Ask every AI tool vendor you use one question: "Are you classified as high-risk under the EU AI Act, and where is your compliance documentation?" If they don't have an answer, that tells you something.
Then check your candidate privacy notices. If they don't mention AI processing, update them. You can be brief. Candidates just need to know their data goes through an AI system, what it does, and how to contest it.
Pick someone who will own this at your agency. Write their name next to "AI oversight" somewhere. That alone puts you ahead of most.
Related reading:
Using AI in recruitment? Read our updated legal documents and deployer obligations.
On this page
