AI tools have become indispensable in recruiting. CV parsing, automated candidate matching, scoring algorithms. Headhunters and staffing agencies use these technologies daily. But with the EU AI Act, binding rules take effect starting August 2026 that will fundamentally change how AI is used in human resources. Those who fail to prepare risk fines of up to 35 million euros or 7% of annual revenue.
What Is the EU AI Act - and When Does It Take Effect?
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law. It was published in the Official Journal of the EU on July 12, 2024, and entered into force on August 2, 2024. Implementation follows a phased timeline:
- February 2025: Bans on AI systems posing unacceptable risk (already active)
- August 2025: Obligations for general-purpose AI like ChatGPT, Claude & Co. (already active)
- August 2, 2026: Main body of the regulation becomes applicable - including transparency obligations
- August 2, 2027: Full obligations for high-risk AI systems
For staffing agencies, the last date is particularly relevant: AI systems in employment and recruiting are classified as high-risk. But starting August 2026, basic transparency and disclosure obligations already apply - and you should start preparing now.
Why AI in Recruiting Is Classified as High-Risk
The EU AI Act defines in Annex III the areas where AI is considered high-risk. Point 4 - "Employment, workers management and access to self-employment" - directly affects the recruiting industry. Specifically, the following applications are classified as high-risk:
- AI for recruiting or selecting candidates: this includes automated pre-screening, ranking, and scoring of applicants
- AI for publishing targeted job advertisements, algorithmic distribution of job ads to specific target groups
- AI for analyzing and filtering applications: CV screening, keyword matching, automated rejections
- AI for evaluating candidates: skill scoring, personality assessments, video interview analysis
The legislator's rationale: AI decisions in recruiting have significant impact on people's livelihoods. An algorithm that incorrectly filters out a qualified candidate can affect their career. And bias in AI systems - whether based on gender, age, or ethnicity - reproduces existing discrimination at scale.
Which Recruiting Processes Are Affected?
For headhunters and staffing agencies, it's important to understand which specific processes fall under the high-risk regulation - and which don't.
1. Candidate Matching & Job Matching
If you use an AI tool that automatically assigns or ranks candidates for open positions - that's high-risk. Whether the tool outputs a percentage ("85% match") or creates a sorted list doesn't matter. As soon as AI is involved in deciding which candidate gets presented to the client and which doesn't, the regulation applies.
What to watch for: Document how the matching algorithm works. Ensure that a human makes the final decision. Use the AI result as a suggestion, not a decision.
2. CV Parsing & Automated Data Extraction
This is where things get more nuanced. Pure CV parsing - extracting structured data from a resume (name, skills, work experience) - is by itself not a high-risk system, as long as it doesn't make evaluations or pre-selections. A parser that reads a CV and converts the data into a structured format does not fall under Annex III.
However: If the parsing tool simultaneously evaluates, scores, or filters candidates - e.g., "this candidate is a 70% match for the position" - then it becomes a high-risk system. The line is drawn between decision support vs. pure data processing.
What to watch for: Separate CV parsing (data extraction) from candidate scoring (evaluation). A tool that only extracts and structures data is less critical than one that automatically filters.
3. Automated Pre-Screening & Screening
Tools that automatically pre-sort applications - whether through keyword matching, semantic analysis, or scoring - are clearly high-risk. This also applies to ATS systems (Applicant Tracking Systems) that automatically sort applications into categories like "suitable," "maybe," and "not suitable."
What to watch for: If your ATS uses AI-based pre-sorting, the provider must meet the high-risk requirements. Ask your software vendors about their EU AI Act compliance strategy.
4. AI-Powered Job Postings
Do you use AI to draft job postings? That alone is not high-risk. But: if AI decides who sees the ad - i.e., algorithmic targeting on job boards - then it falls under the regulation. The reason: algorithmic targeting can systematically exclude certain groups.
What High-Risk Concretely Means: The Obligations
When an AI system is classified as high-risk, both the provider (who develops the tool) and the deployer (you, the staffing agency) must fulfill certain obligations:
Obligations for the Provider (Software Vendor)
- Risk management system: Ongoing identification and mitigation of risks
- Data quality: Training data must be representative, error-free, and bias-free
- Technical documentation: Detailed description of how the system works
- Transparency: Instructions for use for the deployer, including performance limitations and risks
- Human oversight: The system must be designed so that a human can intervene
- Accuracy & robustness: Demonstrable performance metrics and protection against manipulation
- Conformity assessment: The system must be evaluated before market entry
Obligations for the Deployer (Staffing Agency)
- Intended use: Only use the AI system according to the instructions for use
- Human oversight: Qualified personnel must monitor the AI results
- Input data: Ensure that the data entered is relevant and representative
- Monitoring: Report anomalies and malfunctions to the provider and, where applicable, to the authority
- GDPR Data Protection Impact Assessment: Conduct a DPIA before deployment
- Disclosure obligation: Inform candidates that AI is used in the decision-making process
How to Continue Using AI Tools in a Compliant Way
The EU AI Act doesn't ban AI in recruiting. It establishes rules for how it may be used. For staffing agencies that prepare, this is an opportunity - not just a risk. Those who work compliantly stand out from the competition.
1. Human-in-the-Loop as a Principle
The most important principle: AI assists, humans decide. Use AI tools to process data, make suggestions, and speed up workflows. But always let an experienced recruiter make the final decision. Document this process. When a candidate is filtered out, the decision must be traceable to a human evaluation - not to a score.
2. Transparency Toward Candidates
Proactively inform candidates when AI is used in your process. This can be a sentence in the privacy policy, a note on the application form, or an informational email. The GDPR already requires this for automated decision-making (Art. 22) - the EU AI Act reinforces this obligation.
Specifically: "We use AI-powered software to structure resumes and create candidate profiles. The final evaluation and selection is always carried out personally by our recruiters."
3. Vet Your Tool Providers
Ask your software vendors directly:
- Is your system classified as high-risk AI under the EU AI Act?
- Have you conducted or planned a conformity assessment?
- What technical documentation do you provide?
- How do you ensure bias-free algorithms?
- Is there a risk management system?
Providers who can't answer these questions are a compliance risk for you. Because as a deployer, you share responsibility.
4. Separate Data Extraction from Evaluation
A pragmatic approach: Use AI tools for data processing (CV parsing, structuring, profile creation) and keep the evaluation (Does the candidate fit the role?) with a human. A tool that parses a resume and generates a formatted profile in your corporate design is less regulated than one that automatically ranks and filters.
RecuX follows exactly this approach: AI extracts the data, the recruiter reviews and decides. No automatic scoring, no ranking, no pre-screening - just fast, clean data processing and professional profiles.
5. Start Building Documentation - Now
Start documenting today which AI tools you use, what for, and what the human decision-making process looks like. You'll need this documentation by 2027 at the latest. But the sooner you start, the easier it will be.
A simple template is enough:
- Tool name and provider
- Purpose (CV parsing, matching, job postings, etc.)
- High-risk yes/no and rationale
- Human-in-the-loop: Who reviews the AI results?
- Disclosure obligation: How are candidates informed?
EU AI Act and GDPR: Double Regulation
Important: The EU AI Act does not replace the GDPR - it's in addition to it. For staffing agencies, this means a dual compliance requirement:
- GDPR: Governs the handling of personal data (resumes, contact details, application documents)
- EU AI Act: Governs the use of AI systems that process this data
In practice, the obligations partially overlap. The GDPR already requires transparency in automated decision-making and a Data Protection Impact Assessment. The EU AI Act goes further: it requires technical documentation, risk management, and conformity assessment - from both the provider and the deployer.
Those who already take the GDPR seriously have a head start. But the EU AI Act introduces additional requirements that go beyond data protection.
Timeline: What You Should Do Now
Even though the full high-risk regulation doesn't take effect until August 2027, now is the right time to act:
- Q1/Q2 2026: Inventory: Which AI tools do you use? Which ones fall under high-risk?
- Q3 2026: Vet providers: Are your tool vendors on track for compliance?
- Q4 2026: Adjust processes: Ensure human-in-the-loop, build documentation
- Q1/Q2 2027: Conduct DPIA, implement disclosure obligations, train your team
- August 2027: Full compliance
Conclusion: Regulation as a Quality Standard
The EU AI Act won't eliminate AI in recruiting - it will make it better. Staffing agencies that commit to compliance early gain three advantages: they avoid fines, they build trust with candidates and clients, and they stand out from competitors who ignore the issue.
The key lies in a deliberate separation: AI for data processing and workflow acceleration - human expertise for evaluation and decision-making. Those who understand and implement this principle can continue to fully leverage AI tools like CV parsing, profile creation, and workflow automation - with a clear conscience.