REFERENCE · HR
Employment AI: the classification rule and the deployer obligations
What the regulation provides for this sector. To read once the survey is done, not before.
Classification
When HR AI puts you in Annex III §4
Annex III §4 covers AI systems intended to be used in employment, workers' management, and access to self-employment. Two activity buckets: (a) recruitment and selection (placing targeted job ads, analysing and filtering applications, evaluating candidates); (b) decisions affecting employment relationships (terms of work, promotion, termination, allocation of tasks, monitoring/evaluating performance). If you operate one of these systems on EU-based workers or candidates, even procured from a US vendor, you are an Annex III §4 deployer. Recruitment is interpreted broadly (Draft Commission Guidelines on Article 6, 19 May 2026, in consultation): it commences already with the identification and attraction of potential applicants, covering early-stage prospection activities, sourcing tools, candidate ranking in CV databases, and any tool whose output meaningfully influences who reaches the application stage.
Test: does AI rank, screen, evaluate, or recommend any decision about a person's employment? If yes: Annex III §4 applies, and the deployer cascade activates regardless of vendor location.
| Activity | Annex III §4 | Art. 27 FRIA (private deployer) |
|---|---|---|
| AI-assisted CV screening / candidate ranking | Yes | Not triggered (§4 not in Art. 27) |
| AI-driven performance evaluation / monitoring | Yes | Not triggered |
| AI in promotion / termination recommendations | Yes | Not triggered |
| Targeted job ad placement (profiling-based) | Yes: §4(a) · always high-risk, no exception when profiling | Not triggered |
| Platform deactivation / account suspension (gig / freelance platforms) | Yes: §4(b) · treated as termination | Not triggered |
| Task allocation by behavioural indicators (acceptance rate, response time, customer ratings) | Yes: §4(b) | Not triggered |
| Task allocation by objective external criteria (geographic proximity, accreditation, availability) | Out of scope: §4(b) | · |
| Generic HR chatbot (no employment decision influence) | No: Art. 50 instead | No |
Source: Reg. 2024/1689 Annex III §4 + Article 27(1) + Draft Commission Guidelines on Article 6 (19 May 2026, consultation open to 23 June 2026). FRIA (Art. 27) binds only public-law bodies, private entities providing public services, and deployers of Annex III §5(b)/(c); a private-sector HR deployer under §4 performs a GDPR Article 35 DPIA, not a FRIA.
Four deltas
Four obligations specific to HR deployers
GDPR Article 22, national employment law, and existing HR governance frame the broader compliance posture. But none of them produces an Article 26 paragraph map. These deltas need to be added to the existing risk framework.
Delta 1 · Article 26 §7 worker information (pre-deployment)
§7 requires deployers to inform workers' representatives and workers concerned BEFORE putting an Annex III system into service. This is information, not consultation; but it is binding and requires a documented disclosure trail. In DACH, the works council (Betriebsrat) trigger sharpens with KI-MIG codification.
Delta 2 · Article 26 §11 individual notification (post-decision)
§11 requires deployers to inform a natural person subject to an Annex III decision that they are subject to such a decision. The HR-specific case (Annex A §4.4): a candidate or employee receiving an AI-screened outcome must be informed. Most HR pipelines today do not produce that disclosure automatically.
Delta 3 · GDPR Article 35 DPIA (not Article 27 FRIA) + the works-council discovery trigger
A private-sector HR deployer under §4 is NOT subject to the Article 27 FRIA: Art. 27(1) lists only public-law bodies, private entities providing public services, and deployers of Annex III §5(b)/(c). What does apply is the GDPR Article 35 DPIA, fed by the provider notice (Art. 26 §9). The works-council request is the discovery moment, not a FRIA trigger: when an employee, candidate, or representative asks in writing for the legal basis, the deployer must answer from its Art. 26 evidence trail. Selling a mandatory FRIA to a private HR deployer is a classification error.
Delta 4 · Article 25(1)(b) reverse-bascule (fine-tuning trap)
Employers that fine-tune a vendor screening model on their own historical hiring data may be reclassified as providers under Article 25(1)(b), inheriting the heavier Articles 16–22 regime. The boundary check is contractual, not technical: performed at the moment a fine-tuning option is contractually accepted.
Sources: Reg. 2024/1689 Articles 25–27 · GDPR Reg. (EU) 2016/679 Art. 22 · Annex A v1.0 §4 (Sprinkling Act, May 2026) · KI-MIG (DACH works-council codification).
Integration
How this fits with GDPR, national employment law, and works-council practice
GDPR Article 22 covers automated decision-making rights; AI Act Article 26 §11 specifies the post-decision information obligation. They interlock; failure to integrate creates dual-regime exposure. National employment law frames the consultation-vs-information boundary for works councils. The AI Act Article 26 §7 specifies pre-deployment information of workers, which complements (does not replace) national consultation regimes.
Concretely: a private HR deployer ends up with four documents (GDPR Article 22 record, national employment law consultation trail, AI Act Article 26 paragraph map, GDPR Article 35 DPIA). The Sprinkling Act report produces the third document and feeds the DPIA. The others are produced by your existing HR/legal frameworks. A FRIA (Article 27) is added only if the deployer is a public-law body or a private entity providing public services.
Sources: GDPR Reg. (EU) 2016/679 · Reg. 2024/1689 Articles 26–27 · National employment law (varies) · Annex A v1.0 §4.6 reverse-bascule worked example.
From the regulation to your own workflows
This page describes what the regulation expects. It does not say where your own HR workflows stand. Six questions, two minutes, no account: they sort what you know about your AI uses, returned as a text you can take away. Nothing is sent, nothing is stored, and it concludes nothing about you.
This page is informational. It does not constitute legal advice, regulatory determination, or a conformity assessment under Article 43 AIA. Specific classifications for any specific HR deployer require a tailored screening. Organisations recognising themselves in the Annex III §4 description should consult qualified labour counsel and engage works-council representatives where applicable before making compliance decisions.
SEE ALSO