AI in recruitment: what the EU AI Act and UK rules mean for employers

Using AI in recruitment now carries specific legal duties on both sides of the Channel, and the timetable has just moved. Here is where the EU AI Act and the UK rules stand as of October 2026, and what employers should be doing now.

Recruitment AI is high-risk under the EU AI Act

The EU's Artificial Intelligence Act, Regulation (EU) 2024/1689, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024.^[1] It sorts AI systems by risk, and recruitment sits firmly in the high-risk tier: Annex III lists AI intended for the recruitment or selection of people, including placing targeted job adverts, analysing and filtering applications and evaluating candidates, alongside AI used for promotion, termination, task allocation and performance monitoring.^[1] A narrow set of exceptions applies to systems that perform only limited, preparatory tasks, but most screening, ranking and scoring tools will fall inside the category.

Some provisions already apply. Since 2 February 2025 the Act has banned AI that infers emotions in the workplace, and the European Commission's guidelines on prohibited practices make clear that this extends to candidates in a recruitment process.^[1,2] Employers should therefore treat any tool claiming to read emotion from video interviews as off the table for EU candidates. The Act also reaches beyond the EU's borders: it applies to providers and deployers outside the Union where the system's output is used in the EU, so a UK employer screening applicants for an EU role can be caught.^[1]

The digital omnibus: high-risk duties now apply from 2 December 2027

The high-risk obligations were originally due to apply from 2 August 2026. On 19 November 2025 the Commission proposed a "digital omnibus" to simplify and delay parts of the Act, and the amending law was adopted as Regulation (EU) 2026/1744, dated 8 July 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026.^[3] It moves the application date for Annex III high-risk systems, which includes recruitment, to 2 December 2027, and for high-risk AI embedded in regulated products to 2 August 2028.^[3] It also softened the AI literacy duty that has applied since 2 February 2025: employers must still take measures to support the AI literacy of staff who use these systems, but no particular level is now required.^[3]

The delay is a window, not a reprieve. When the high-risk rules bite, employers using recruitment AI (the Act calls them deployers) must use systems according to the provider's instructions, assign human oversight to people with the competence, training and authority to exercise it, ensure any input data they control is relevant and sufficiently representative, monitor the system and suspend it if it presents a risk, keep its logs for at least six months, inform workers' representatives and affected staff before using it at work, and tell candidates that they are subject to it.^[1]

The UK position: no AI Act, but existing law applies

The UK has no equivalent of the AI Act. Instead, recruitment AI is governed by data protection and equality law. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, replaces the old UK GDPR Article 22 with new Articles 22A to 22D, which came into force on 5 February 2026.^[4] Significant decisions based solely on automated processing, meaning with no meaningful human involvement, are now permitted more widely, but only with safeguards: the candidate must be told about the decision and be able to make representations, obtain human intervention and contest it. Stricter limits remain where special category data, such as health or ethnicity, is involved.^[4] A rejection at the sift stage made entirely by an algorithm is exactly the kind of decision these safeguards are aimed at.

The Information Commissioner's Office audited AI recruitment providers and published its outcomes report in November 2024.^[5] It found tools that inferred gender and ethnicity from candidates' names, often without a lawful basis, and search features that allowed recruiters to filter out people with protected characteristics. It recommended data protection impact assessments before processing begins, clear contractual roles, meaningful human review of outputs, and that recruiters should not progress or reject candidates on the basis of AI-generated scores alone.^[5]

The Equality Act 2010 applies regardless of the technology. A tool that disadvantages a protected group is potentially indirect discrimination unless it is a proportionate means of achieving a legitimate aim, and the duty to make reasonable adjustments for disabled candidates applies to automated assessments as much as to any other.^[6] Our guide to reasonable adjustments in online testing covers that duty in more detail.

Practical steps for employers

Map your tools. List every point in the hiring process where AI ranks, scores, filters or recommends, including features built into applicant tracking systems that may not be marketed as AI.

Assess before you deploy. Complete a data protection impact assessment, and ask the provider for evidence of validity, accuracy testing and adverse impact across groups. The UK government's Responsible AI in Recruitment guide recommends impact assessments, bias audits, performance testing and piloting as assurance steps.^[7]

Keep a real human in the loop. Reviewers need the training, time and authority to overturn the system's output; a nominal sign-off does not count as meaningful human involvement.^[4,5]

Tell candidates. Explain where AI is used, how to request human review and how to ask for adjustments.

Plan for December 2027. If you recruit into the EU, build the deployer duties into contracts and processes now rather than in the final months.

The underlying principle is the same one that governs any assessment: a method must measure something relevant to the job, fairly, and you must be able to show it. The standards in our article on what makes a psychometric test valid apply to AI tools too. This article is a general summary, not legal advice; take specialist advice on your own systems.