EU AI Act for Recruitment Agencies: Candidate Screening vs Administrative Automation
Where recruitment automation may become high-risk and where communication, scheduling and structured intake remain operational support.
Start with the intended purpose
For recruitment agencies, the useful question is not whether a supplier uses AI. The useful question is what the system is intended to do, which information it uses and whether its output influences a decision about a person. The AI Act follows a risk-based structure, while GDPR continues to govern personal-data processing.
This distinction matters commercially. A narrow communication workflow can remove repetitive work without silently becoming a decision engine. A broad promise to “automate the process” can conceal very different legal, operational and human consequences.
Where the high-risk boundary may appear
AI used to recruit or select people, filter applications, evaluate candidates, influence employment decisions or monitor worker performance can fall within the employment-related high-risk category.
The current implementation timetable and supporting guidance continue to evolve. Organisations should classify the actual use case, document assumptions and obtain current legal advice rather than relying on a product label or an old compliance checklist.
Design a narrow operational scope
Keep lead response, interview scheduling and information collection separate from ranking, scoring, rejection and suitability recommendations.
A system that confirms availability and books an interview is not performing the same function as one that predicts whether a candidate will be reliable.
GDPR still applies to the data flow
AI classification does not replace GDPR analysis. Buyers still need to define purpose, lawful basis, data minimisation, transparency, recording, retention, access, processors, transfers, security and rights handling. Voice and free-text systems can capture much more personal information than a structured web form.
Design prompts around the minimum information needed for the next action. Where sensitive or special-category data may appear, use tighter access, shorter retention where appropriate and a tested human handoff. Recording should be a deliberate setting, not an automatic default.
Questions buyers should ask
Buyers in recruitment agencies should ask the supplier to state the intended purpose, prohibited uses, data fields, model and infrastructure providers, storage locations, logging, monitoring, incident process and human-oversight design. Ask what happens when the system is uncertain, the user objects or the conversation moves outside scope.
Contracts should match the actual service. Determine which organisation acts as provider, deployer, controller or processor for each part of the workflow. Marketing terms such as “compliant platform” do not settle those roles.
A practical implementation path
Begin with a small number of repeatable scenarios and a written decision table. For every scenario, define the allowed action, required data, responsible person, escalation trigger and maximum response time. Test ordinary cases, ambiguous answers, refusals, language changes and emergencies.
The safest and most commercially useful automation usually makes routine communication faster while preserving human authority over consequential decisions. That boundary should be visible in product design, contracts, training and day-to-day operation.