Recruitment AI Facing the EU AI Act

The system is high-risk under Annex III point 4(a), because it is intended for recruitment or selection and is used to analyse and filter job applications and evaluate candidates. The product team's 'decision support' label does not control classification; intended purpose and actual use do. The Article 6(3) filter does not help here because ranking candidates by predicted fit is profiling of natural persons, and profiling is excluded from the derogation. Human review of rejections is an oversight obligation, not a classification exemption. TalentSift is the provider because it develops the tool and places it on the market under its own name. Each employer is a deployer. The contract clause saying the customer is responsible for all compliance cannot transfer TalentSift's statutory provider obligations; it can allocate indemnities between the parties, but a regulator will still look to the provider for conformity assessment, technical documentation, and CE marking. A deployer that puts its own name on the system or substantially modifies it can become a provider under Article 25, so the contract should define permitted configuration and white-label use.

Annex III high-risk obligations apply from 2 August 2026, so a 15 September go-live is inside the regime. Before launch, TalentSift needs a quality management system, a risk management process, data governance for training and testing data, technical documentation, record-keeping and logging, instructions for use, human-oversight design, and appropriate accuracy, robustness, and cybersecurity. It needs to complete the internal-control conformity assessment, draw up the EU declaration of conformity, affix CE marking, and register the system in the EU database. It also needs post-market monitoring and a serious-incident reporting process. The deployer must use the system according to instructions, assign competent human oversight, keep logs, and monitor. In a workplace context the employer must inform workers and their representatives before putting the system into service. TalentSift cannot contract away its provider obligations, its conformity assessment duty, or its incident reporting and cooperation duties with authorities. It can agree that the customer will handle deployer duties and indemnify for misuse, but that does not cure a non-compliant product.

Executive search does not change the analysis. It remains recruitment and selection under Annex III point 4(a), and the ranking of senior candidates is still evaluation and profiling. If anything, the consequences of a biased or opaque ranking are greater because the pool is smaller and the decisions are more consequential. Human review does not save the product from classification. Article 14 requires human oversight for high-risk systems, so a human in the loop is part of the compliance design; it is not an exemption. The review must be meaningful: the recruiter needs to understand the model's limitations, have the authority to override, and see enough explanation to challenge a ranking. A short 'why this candidate' summary generated by the same model may not satisfy that if it is not faithful or if the recruiter anchors on the score. The provider should define the intended purpose narrowly, document the executive-search use, and ensure the instructions for use and oversight measures match both the warehouse and executive-search contexts. If the tool were used only for administrative scheduling, the analysis would differ, but that is not the described use.