Blog29 Oct 20266 min read

AI in recruitment: what the EU AI Act means for employers in 2026

The EU AI Act makes AI used in recruitment high-risk from December 2027. Here is what already applies across the EU and the EEA, what employers will have to do, and where countries like Norway stand.

Håkon HøgetveitFounder · Vouch

The EU AI Act classes AI used to recruit and select people as high-risk. For employers in the EU, the high-risk duties apply from 2 December 2027. Some parts of the Act already apply: the bans, including on reading emotions at work, and a duty to make sure staff who use AI know enough about it. GDPR and anti-discrimination law apply today wherever you are. In the EEA countries outside the EU (Norway, Iceland and Liechtenstein), the AI Act applies only once it is part of the EEA Agreement, which it is not yet.

This overview was updated on 29 October 2026. It is not legal advice.

The timeline

The bans have applied in the EU since 2 February 2025, and one of them covers tools that infer the emotions of employees and job applicants. The EU's AI simplification package, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk requirements from August 2026 to 2 December 2027.

EUNorway and the rest of the EEA

Feb 2025EUThe bans apply, and so does the duty on AI literacy

Jul 2026EUThe high-risk rules are moved to December 2027

Aug 2026EUPeople must be told when they talk to an AI

Today29 Oct 2026

Autumn 2026EEANorway announces a new consultation

Spring 2027EEANorway aims to put its AI act to parliament

Dec 2027EUThe high-risk rules apply, recruitment included

Not setEEAWhen the rules start to apply

The EU’s dates are fixed. In the EEA countries outside the EU, the rules apply only once the Act is part of the EEA Agreement.

In the EEA countries outside the EU, none of this has legal effect until the Act is incorporated into the EEA Agreement and implemented in national law. Norway, for example, has announced a new consultation this autumn and aims to put its AI act to parliament in spring 2027. No date has been set for when it applies.

What counts as high-risk in recruitment?

The AI Act lists employment among the areas where AI counts as high-risk (Annex III, point 4). For recruitment, that covers systems used to

target job ads
analyse and filter applications
evaluate candidates

It also covers AI used for decisions on promotion and termination, to allocate tasks, or to monitor and evaluate employees.

There is an exception for systems that only perform a narrow, preparatory task. But a system that profiles people always counts as high-risk. A tool that reads CVs and ranks candidates falls under the rules.

Who does the Act apply to?

The Act calls the employer using an AI system a deployer, and the company that makes it a provider. It applies to deployers located in the EU, and also to deployers and providers outside the EU when the system's output is used in the EU. A company in Norway that uses AI to assess candidates for its office in Sweden should plan by the EU dates. The deployer duties do not depend on company size.

What must the employer do?

The heaviest responsibility lies with the provider, who must document the system and have its conformity assessed before it is sold. But the employer using the system also gets duties once the high-risk rules apply. You must

use the system as the provider describes
let people with enough competence and authority oversee the system and overrule it
make sure the data you put in yourselves is relevant to the job
keep the logs the system produces for at least six months
inform employees and their representatives before the system is put into use
tell candidates that a high-risk system is used when they are assessed

A candidate affected by a decision the system was part of can also ask for an explanation of the role the AI played.

What already applies today

A rejection cannot be fully automated

Article 22 of GDPR gives everyone the right not to be subject to a decision based solely on automated processing when it significantly affects them. GDPR names "e-recruiting practices without any human intervention" as an example (recital 71). A person must make the decision, and the assessment must be real. Clicking approve on what the machine decided is not enough. This applies across the EU and the EEA.

Applicants must know AI is used

Your privacy notice must say that you use AI in recruitment, and what for. Applicants also have the right of access to the data you hold about them.

Staff who use AI must understand it

In the EU, providers and deployers must take measures so that the people who use AI systems on their behalf know enough about them. For recruitment, that means recruiters and hiring managers understand what the tool does and when to overrule it.

Anti-discrimination law applies to the machine too

Every EU and EEA country has anti-discrimination law for hiring, and it is technology-neutral. If a tool screens out applicants in a way that disadvantages, for example, women or people with an immigrant background, the employer is responsible.

Emotion recognition is banned in the EU

Tools that read emotions from facial expressions or voice in video interviews have been banned in the EU since February 2025, and the European Commission's guidelines take the view that the ban also covers job applicants. In the EEA countries outside the EU the ban does not formally apply yet, but there is no good reason to start using such tools there either.

Four questions to ask the vendor

Can the system reject anyone without a person having decided it?
Can we see the reasons for every assessment, criterion by criterion?
Can candidates opt out of AI review?
Where is the data stored and processed, and do you have a data processing agreement ready?

How we built Vouch

Vouch never rejects applicants on its own. The assistant reads each application against the job's criteria and writes a reason for each criterion, along with what to ask in the interview. A rejection is always a draft that a person must confirm. You can also let candidates opt out of AI review, and then a recruiter reads the application. How Vouch reads applications

With the setting on, candidates can say no to AI review when they apply. The team sees who did, and reads those applications itself.

Questions and answers

When does the AI Act apply to AI in recruitment?

In the EU, the high-risk requirements apply from 2 December 2027. The bans and the AI literacy duty have applied since February 2025.

Does the AI Act apply in Norway and the rest of the EEA?

Not yet. The AI Act has not been incorporated into the EEA Agreement. Norway aims to put its AI act to parliament in spring 2027. Until then, GDPR and anti-discrimination law also apply when AI is used, and the EU dates apply to hiring whose results are used in the EU.

Do the rules apply to small companies?

Yes. The duties for employers using a high-risk system do not depend on company size. Small providers get some simplifications, such as lighter technical documentation.

Is it legal to use ChatGPT to read CVs?

Data protection rules apply whatever the tool. You need a lawful basis for processing the data and a data processing agreement with the provider. You also need to know whether the data is used to train models. With an ordinary consumer account, you rarely have this in place. And the decision must still be made by a person.

Who supervises?

Each country appoints authorities to supervise the AI Act. In Norway, for example, Nkom is to coordinate. Data protection authorities supervise GDPR, and national equality bodies deal with discrimination.