EU AI Act and recruitment: an HR screening tool as an Annex III system

Where this starts

Annex III point 4(a) lists AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Point 4(b) covers decisions on promotion, termination, task allocation and performance monitoring of people already in a work relationship. Under Art. 6(2) a system whose intended purpose matches one of these points is high-risk. Art. 6(3) removes the classification when one of four conditions applies, and the third subparagraph of Art. 6(3) keeps the classification whenever the system performs profiling of natural persons; a screening tool that evaluates a candidate from personal data performs profiling within the meaning of Art. 3(52), so the exception does not apply to it. The risk classifier runs the Art. 6 routes on the published logic and records the profiling check as its own row.

Two roles share the obligations. The organisation that develops the screening tool, or has it developed under its own name, is the provider under Art. 3(3) and carries Chapter III Section 2, including the data governance and bias examination duties of Art. 10 and the human oversight design of Art. 14. The employer that uses the tool in its own hiring decisions is the deployer under Art. 3(4) and carries Art. 26: use within the instructions for use, oversight assigned to persons with competence, training and authority, monitoring, log retention, worker information under Art. 26(7) where the tool also runs on existing staff, and the notice to candidates under Art. 26(11). An employer that puts its own name on the tool, substantially modifies it or changes its intended purpose becomes the provider under Art. 25(1). The Annex III provider hub and the deployer hub carry the obligation set with its dates for each role.

The bias examination under Art. 10(2)(f) is the test the recruitment use case turns on, and the Act sets no pass level for it: no minimum sample size per subgroup, no acceptable disparity between groups. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available. The sources in use sit lower in the hierarchy: the JTC 21 drafts prEN 18284Draft for data governance practices and prEN 18283Draft for bias measures, and ISO/IEC TR 24027:2021Published for bias categories and candidate fairness metrics without a pass level. The provider selects the disparity target, justifies it against the persons the system is intended to be used for and records the justification before any run. Where the examination needs special categories of personal data, for example ethnicity or disability, the legal basis moved from Art. 10(5) to Art. 4a under Regulation (EU) 2026/1744, and its threshold is the unsettled point below.

Human oversight in a recruitment workflow has the same source gap. Art. 14(4)(d) and (e) require that the assigned recruiter can disregard, override or reverse a ranking and stop the system in a safe state, and Art. 26(2) requires the deployer to assign that role to persons with the authority to act. The draft prEN 18229-3Draft fixes the categories of oversight measures, with no public text yet, and prEN 18229-1Enquiry under enquiry supplies the log event set that records each override and stop. What counts as an effective override is the provider's justified choice, recorded in the rationale step of PR-14-OVR v1.0.

The sequence

The work runs classification and role first, then the bias examination on the provider side, then the oversight and log checks on the deployer side, then the file.

1. Match each screening function against Annex III point 4(a) and record the profiling check under Art. 6(3).

   Record High-risk classification record per function with the Annex III match, the Art. 6(3) condition and the profiling check

   [Regulation (EU) 2024/1689, Art. 6(2), 6(3) and Annex III point 4(a); PR-CLS steps 13 to 17]

2. Record which organisation is the provider and which is the deployer, and test each Art. 25(1) trigger.

   Record Role determination record and Art. 25 trigger record

   [Regulation (EU) 2024/1689, Art. 3(3), 3(4) and Art. 25(1); PR-CLS steps 8 to 10]

3. Define the protected and context-relevant subgroups, the fairness metrics and the disparity targets before any run.

   Record Subgroup definition table, metric selection record, threshold justification record and special-category data presence statement

   [Regulation (EU) 2024/1689, Art. 10(2)(f) and Art. 4a(1); PR-10-BIAS steps 7 to 12]

4. Run the model on the testing set and compute each metric per subgroup and per intersectional cell.

   Record Bias examination report with subgroup disaggregation tables (PR-10-BIAS output)

   [Regulation (EU) 2024/1689, Art. 10(2)(f); PR-10-BIAS steps 22 to 25]

5. Where special-category data was processed, verify the safeguards in the pipeline and review the legal-basis record.

   Record Bias detection legal-basis record (Art. 4a(1)(f)) and special-category data safeguards and deletion record

   [Regulation (EU) 2024/1689, Art. 4a(1)(a) to (f); PR-10-BIAS steps 27 to 29 and 37 to 38]

6. Compare the deployed configuration with the instructions for use and obtain the oversight assignment record.

   Record Human oversight assignment record (Art. 26(2)) and instructions-for-use conformance record (PR-14-OVR output)

   [Regulation (EU) 2024/1689, Art. 26(1) and 26(2); PR-14-OVR steps 8 to 9]

7. Execute not-use, override, reverse and stop from the assigned account and read the recorded decision for each case.

   Record Override, reversal and stop verification report (PR-14-OVR output)

   [Regulation (EU) 2024/1689, Art. 14(4)(d) and (e) and Art. 26(2); PR-14-OVR steps 21 to 26]

8. Where the deployer controls the applicant data, profile the live applicant population against the intended purpose.

   Record Input data representativeness profile (PR-10-BIAS output)

   [Regulation (EU) 2024/1689, Art. 26(4); PR-10-BIAS steps 30 to 31]

9. Reconstruct a sampled screening decision from the logs under the deployer's control and read the retention configuration.

   Record Decision reconstruction record (PR-12-LOG output) and log retention configuration evidence

   [Regulation (EU) 2024/1689, Art. 26(6); PR-12-LOG steps 24 to 25 and 30 to 31]

Evidence this situation ends with

Each artifact follows a specification with a synthetic sample on the deliverables page: the bias examination report and the verification report follow the test report specification, the representativeness profile follows the dataset profile specification, and the classification and legal-basis records follow the register or checklist specification.

If nothing is done

A screening tool placed on the market after the Annex III application date without the Art. 10 bias examination or the Art. 14 oversight design is subject to the market surveillance procedure of Art. 79: the authority evaluates the system and, where the Chapter III requirements are not met, requires the provider under Art. 79(2) to take corrective action, to withdraw the system or to recall it within a period the authority sets. A finding against the provider obligations in Art. 16 falls in the penalty tier of Art. 99(4)(a), and a finding against the deployer obligations in Art. 26 falls in the tier of Art. 99(4)(e); the amount in a given case is set by the national authority under the Art. 99(7) criteria. On the deployer's side, Art. 26(5) requires the deployer that has reason to consider the system presents a risk within the meaning of Art. 79(1) to inform the provider and the market surveillance authority and to suspend use, and Art. 86(1) gives a candidate subject to a decision based on the tool's output, where the decision produces legal effects or similarly significantly affects the candidate, the right to obtain from the deployer an explanation of the role the system played. The sequence above produces the records that answer both the authority's request under Art. 21(1) and the candidate's request under Art. 86(1).

Services, guides and tools for this situation

The bias and fairness testing service runs the subgroup disaggregation and the Art. 4a safeguards review under PR-10-BIAS v1.0, within the limits stated on what we cannot do; the logging and human-oversight verification service runs the override, stop and reconstruction checks under PR-14-OVR v1.0 and PR-12-LOG v1.0.

Obligations

• Art. 10
• Art. 14
• Art. 26

Services

• Bias and fairness testing under the Omnibus sensitive-data provision
• Logging and human-oversight verification

Guides

• AI bias testing for fairness under the EU AI Act: subgroup disaggregation
• Override testing: what AI human oversight under Article 14 looks like in a test

Tools

• Risk and role classifier

ICP hubs

• Annex III providers
• Deployers

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com