The recruitment team of a large employer has a backlog of applications for warehouse and planning jobs. A recruiter pastes a batch of letters and career summaries into the company's general purpose assistant and asks for a ranking. In the distribution centres the planning software has a new module that hands out shifts on the basis of each worker's past picking speed. Nobody in the company decided to deploy a high risk system. From 2 December 2027 the law will see two.
Annex III of the European Union Artificial Intelligence Act, Regulation (European Union) 2024/1689, lists employment as one of eight areas. Point 4 covers systems intended to be used for recruitment or selection, including the filtering of applications and the evaluation of candidates. It also covers systems used for decisions on promotion and termination, for allocating tasks on the basis of individual behaviour or personal traits, and for monitoring and evaluating performance and behaviour. The requirements attached to the list apply from 2 December 2027. Article 6 has an exception for systems that only perform a narrow procedural or preparatory task, and closes it again for any system that profiles natural persons. Ranking candidates by expected performance fits the definition of profiling in the General Data Protection Regulation, which names the prediction of performance at work.
One rule is in force already. Since 2 February 2025 the Act prohibits systems that infer the emotions of a person in the workplace, except for medical or safety reasons. It sets the maximum fine for breaching a prohibition at 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. A video interview product that scores enthusiasm has to be checked against that rule now.
When the high risk rules apply, an employer that uses such a system is a deployer and Article 26 gives the deployer duties of its own. It has to use the system according to the supplier's instructions, assign human oversight to people with the competence and the authority for it, keep the logs for at least six months, and tell candidates and workers that the system is being used in decisions about them. Paragraph 7 is specific to employers: before the system is put into service at the workplace, the workers' representatives and the affected workers must be informed.
Dutch law already asks for more than information. Under Article 27 of the Wet op de ondernemingsraden an employer needs the consent of the works council for a decision to adopt, change or withdraw an arrangement on appointment, dismissal or promotion policy, on staff appraisal, on the processing of personal data of staff, or on facilities that are suited to observing their attendance, behaviour or performance. A shift module that reads picking speed is hard to place outside that last category. The General Data Protection Regulation adds Article 22, the right not to be subject to a decision based solely on automated processing that significantly affects a person. In December 2023 the Court of Justice of the European Union held that a score produced by one company counts as such a decision when the company that receives it gives it a determining role.
The usual response is to ask the supplier for a compliance statement and file it. That statement covers the supplier's duties as provider and leaves yours untouched. It is also silent on the recruiter with the general assistant, and that is the awkward case. Article 25 says that whoever changes the intended purpose of a system that was not high risk, a general purpose system included, in such a way that it becomes high risk, is to be considered its provider. As we read it, an employer that lets a general assistant rank applicants risks taking on the heavier role, the one with the quality management system and the conformity assessment, without having bought anything.
The route decision matters here because applicant and personnel data are the input. Decide for each type of work whether it may go to a model provider's online interface under contract, to a private deployment, or only to systems on your own premises. Screening through a contracted interface in a European region can be defended. Pasting applications into a consumer chat tool is a different matter, since no contract of yours governs it. Keeping everything in your own data centre settles where the data goes. The works council, the logs, the oversight and the notices to candidates stay where they were.
The governance is the same on each route. It covers an inventory of every system that touches hiring or the allocation of work, your role for each one, the supplier contracts, a test on your own past applications that looks at who gets filtered out, logs, named overseers, training, and a route for complaints and incidents.
The AI Guys does this groundwork with technology and personnel teams, while the legal opinion on consent stays with your employment lawyer. Next month you should have in hand the inventory with the general assistant on it, a written decision on which hiring tasks staff may give to which tool, the agenda item for the works council, and a letter to each supplier asking which role it takes and which it assigns to you.