AI in Recruitment and HR Under the EU AI Act: High-Risk Rules for Irish Employers

Under the EU AI Act, AI systems used in recruitment and in managing workers are listed as high-risk. For Irish employers that use CV screening, candidate ranking or performance-monitoring tools, the key points are which uses are covered, when the high-risk rules apply, and what is expected of the employer using the system. As of 9 October 2026, the official sources we read say the high-risk rules for these employment uses apply from 2 December 2027, after the Digital Omnibus on AI moved the date. Some other parts of the Act already apply.

This article draws on the European Commission's AI Act Service Desk (texts based on the EUR-Lex consolidated version as at 27 July 2026), the Commission's regulatory framework page (last updated 3 August 2026), and Irish pages from the AI Office of Ireland and the Workplace Relations Commission. It is general information, not legal advice. If your recruitment tools process personal data, read it alongside our summary of the Data Protection Commission's guidance on AI and large language models.

Which employment uses are listed as high-risk

Annex III of the AI Act lists the high-risk use cases. Point 4 covers employment, workers' management and access to self-employment. According to the Service Desk page, it has two parts:

• Recruitment and selection: systems intended to be used for the recruitment or selection of natural persons, such as placing targeted job advertisements, analysing and filtering applications, and evaluating candidates.
• Decisions and monitoring during work: systems used to make decisions affecting the terms of work-related relationships, including promotion or termination, allocating tasks based on individual behaviour or personal traits, and monitoring and evaluating the performance and behaviour of workers.

The Workplace Relations Commission's AI Act page gives a similar plain-language description: it says high-risk workplace AI systems can include those used to screen job applications, rank candidates, allocate tasks, monitor performance and make promotion-related assessments. It also says the Act does not ban all workplace AI and instead uses risk-based rules.

How Article 6 decides whether a system is high-risk

Article 6(2) says systems listed in Annex III are high-risk. Article 6(3) then provides that an Annex III system is not high-risk if it poses no significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. The Service Desk text lists the circumstances: a narrow procedural task, improving the result of a human activity already completed, detecting decision-making patterns or deviations from past patterns, without replacing or influencing a completed human assessment unless there is proper human review, or a preparatory task for a relevant assessment. There is a firm exception: an Annex III system that profiles natural persons is always high-risk.

Article 6(4) says a provider that concludes an Annex III system is not high-risk must document that assessment before the system is placed on the market. For an employer buying a tool, the practical point is that the classification is something to ask the supplier about, not assume. That is our suggestion rather than a stated requirement for deployers.

When the high-risk rules apply

The Commission's regulatory framework page lists the following dates:

The Service Desk text of Article 113 shows the same 2 December 2027 date for systems classified as high-risk under Article 6(2) and Annex III, marked as amended by the Digital Omnibus on AI. The Data Protection Commission's page on the AI Office of Ireland website describes the change as a 16-month extension from an original date in 2026. In other words, the earlier expectation that employment tools would face high-risk duties from August 2026 no longer holds on the sources we read. Check the Commission and AI Office of Ireland for any later change.

Two things are already live. First, Article 4 on AI literacy has applied since 2 February 2025, so employers using any AI tool, including HR tools, should be supporting staff literacy. Second, the prohibitions apply. The Workplace Relations Commission's page says it has a specific market surveillance role for prohibited practices including AI that infers the emotions of workers or job applicants, except in limited permitted circumstances.

What deployers must do under Article 26

An employer that uses a high-risk system under its own authority is a deployer. The Service Desk page summarises Article 26 as follows (these duties relate to high-risk systems, so they follow the dates above):

• Take appropriate technical and organisational measures to use the system according to its instructions for use.
• Assign human oversight to people with the necessary competence, training and authority, and the necessary support.
• Where the deployer controls input data, ensure it is relevant and sufficiently representative for the intended purpose.
• Monitor operation, inform the provider where relevant, and if the system may present a risk, inform the provider or distributor and the market surveillance authority and suspend use. Serious incidents must be reported as set out in the Article.
• Keep automatically generated logs under the deployer's control for at least six months, unless other law requires otherwise.
• Article 26(7): employers must inform workers' representatives and the affected workers before putting a high-risk system into service or using it at the workplace, following applicable worker-information rules.
• Use the provider's information to support data protection impact assessments where applicable.
• Article 26(11): deployers of Annex III systems that make or assist decisions about natural persons must inform those persons that the system is being used.
• Cooperate with competent authorities.

We have only summarised these duties from the Service Desk text. Read the Article itself before relying on any detail.

Who regulates this in Ireland

The AI Office of Ireland lists Ireland's designated national competent authorities. Two are directly relevant to employers. The Workplace Relations Commission is described as supervising the deployment and use of AI systems in the Irish labour market, and the Data Protection Commission is a market surveillance authority for certain prohibited practices and certain high-risk use cases. The WRC page cites the European Union (Artificial Intelligence) Regulations 2025 (S.I. No. 366 of 2025) and says further legislation will provide its supervision and enforcement powers. It also says the Regulation of Artificial Intelligence Act 2026 became law on 21 July 2026.

The WRC page adds that it does not resolve individual disputes, provide remedies or award compensation for an AI Act complaint, but that AI-related complaints about individual employment rights, equality or dismissal still go through the WRC's existing complaint processes. Note a small inconsistency: the WRC page says there are 15 national competent authorities, while the AI Office of Ireland page lists 13.

A practical approach (our suggestions)

• List every tool used in hiring and people management, including features inside your HR or applicant tracking software.
• Ask suppliers in writing how the tool is classified under the Act, what the instructions for use say, and what logs are available.
• Keep a person with real authority to depart from the tool's output. The DPC's guidance warns that relying on inaccurate or biased outputs without critical human analysis or intervention may introduce automated decision-making risks.
• Plan how and when you would tell candidates and workers that a tool is used.
• Do not wait until 2027 to build AI literacy among the people using these tools.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is every AI tool used in HR high-risk?

No. The WRC says the Act does not ban all workplace AI and applies risk-based rules. Under Article 6(3) some Annex III systems can fall outside the high-risk category, but not if they profile natural persons.

When do the employment high-risk rules apply?

The Commission's regulatory framework page (last updated 3 August 2026) gives 2 December 2027 for Annex III use cases such as employment.

Do we have to tell staff we use a high-risk system?

Article 26(7), as summarised on the Service Desk, requires employer deployers to inform workers' representatives and affected workers before using a high-risk system at the workplace. That duty follows the high-risk dates.

Is any AI use in recruitment already banned?

The WRC's page refers to the prohibition on AI that infers the emotions of workers or job applicants, except in limited permitted circumstances. The prohibitions have applied since 2 February 2025 according to the Commission.

Which Irish regulators should employers know about?

The Workplace Relations Commission and the Data Protection Commission are both listed by the AI Office of Ireland as national competent authorities.

Because the dates have moved during 2026 and Irish implementing arrangements are still developing, review the Commission and AI Office of Ireland pages before making decisions on any HR tool. Our overview of Article 50 transparency and labelling obligations covers another part of the Act that may touch candidate-facing chatbots.