Picture a logistics operator with a few hundred employees, gearing up for its peak season. There are twelve open roles for warehouse operatives, and in ten days the advert has drawn more than six hundred applications. The HR team is two people working full time, who also handle holidays, absences, occupational health certificates and last week's new starters. In the latest update, the recruitment software gained a new button: "rank candidates by fit with AI". One click switches it on and, suddenly, the six hundred applications appear sorted from 98 down to 12.
The temptation is easy to understand. It is also the exact point at which the company walks, without ever having decided to, into the category the European regulation on artificial intelligence treats most strictly: a number attached to a person's name, used to decide who gets invited to interview, is precisely the kind of system the AI Act set out to regulate.
Short answer
AI can safely handle almost all the work around HR decisions: scheduling interviews, replying to candidates, answering questions about internal policies, running onboarding and processing documents. The AI Act treats as high risk whatever touches the decision about people: filtering and ranking applications, assessing candidates, supporting promotions or dismissals, allocating tasks based on personal traits and monitoring performance. The high-risk obligations apply to these systems from 2 December 2027, but the ban on inferring emotions in the workplace, the transparency duties and the GDPR already apply today.
AI can do the work around the decision
Most of what keeps an HR team busy is not deciding about people. It is booking, replying, explaining, collecting, checking and reminding. That work can be automated with peace of mind, and it is where most of the recoverable hours are.
What calls for a different level of care is the decision itself: who moves on to the next stage, who gets promoted, who leaves, how someone's performance is assessed. AI can still help here, as long as the system is designed to support a person who decides, and not to decide with a person signing underneath.
Where AI in HR is straightforward
There is a set of uses that, built properly, stay outside high risk and free up real time:
- Interview scheduling. Matching interviewer and candidate availability, proposing slots, rescheduling and sending reminders. It is logistics, not assessment.
- Replying to candidates. Confirming receipt, saying which stage the process has reached and answering questions about the role, the hours or the location, based on what the company has published.
- Employee questions about internal policies. How many days of holiday are left, how to claim back an expense, what the handbook says about remote working. An assistant that answers from company documents, cites its source and hands over to a person when the answer depends on a decision.
- Onboarding. Collecting documents before day one, preparing the contract for signature, requesting system access, scheduling mandatory training and tracking what each new starter still has outstanding.
- Document processing. Reading certificates, declarations and occupational health reports, extracting expiry dates and flagging them before they lapse, with the same validation logic we use for invoices and orders read by AI.
These uses are not free of rules: an assistant has to make clear that it is automated, and personal data remains subject to the GDPR. But these are obligations that get solved at the design stage without making the project any heavier.
Where high risk begins
Annex III of the AI Act lists the areas in which an AI system is, by default, high risk. Employment is one of them, and the wording is broader than most people expect: systems used to recruit, filter applications and assess candidates, to decide on promotions or the termination of contracts, to allocate tasks based on personal traits and to monitor performance.
| Use | Likely classification | What it implies |
|---|---|---|
| Scheduling interviews and sending reminders | Outside high risk | Good practice and GDPR |
| Internal policy assistant | Limited risk | Disclose it is AI, cite sources |
| Extracting data from onboarding documents | Outside high risk | GDPR, access control |
| Ranking or scoring applications | High risk | Oversight, records, testing, disclosure |
| Supporting promotion or appraisal decisions | High risk | The same, plus informing employees |
| Inferring emotions in interviews or at work | Prohibited | Not done |
There is one detail worth knowing. The regulation allows a system listed in Annex III not to be treated as high risk when it performs a narrow procedural or preparatory task without materially influencing the decision. That exception, however, does not apply when the system profiles people, and scoring candidates on their fit for a role is hard to describe as anything else. The button from the start of this article sits on the wrong side of that line.
Several practices have been prohibited since 2 February 2025, among them inferring people's emotions in the workplace, except for medical or safety reasons. Tools that claim to read enthusiasm or nerves in a video interview are out of the question.
As for the timeline, the high-risk obligations were due on 2 August 2026. The European simplification package known as the Digital Omnibus, published as Regulation (EU) 2026/1744 and in force since 27 July 2026, pushed them back, for Annex III systems, to 2 December 2027. Since the timeline has already moved once, confirm the date with your legal team before fixing any plans. The postponement does not suspend anything else: the duty to tell people they are interacting with an AI system has applied since 2 August 2026, and the GDPR already gives people the right not to be subject to solely automated decisions that significantly affect them, citing e-recruiting with no human involvement as an example. In Portugal, the Labour Code has required employers since 2023 to disclose the parameters and criteria of algorithms that affect access to and retention of employment.
One point that often comes as a surprise: a company that commissions a candidate assessment system and puts it into service for its own use can end up being treated as the provider of that system, with documentation and risk management obligations far heavier than those of a company that merely uses one. That is one more reason to think twice before building an engine that scores people.
Where AI has already crept in without anyone deciding
Many companies are already using AI in decisions about people without ever having decided to:
- the recruitment software shows a score or an automatic ranking of candidates;
- someone on the team pastes CVs into a general-purpose assistant and asks for "the top five";
- automatic filters remove applications before a person ever sees them;
- performance reports include indicators calculated from activity in company systems, without employees knowing how they are worked out;
- nobody can say who approved switching on an AI feature in the HR software;
- rejected candidates get an automated reply and there is no way to find out why they were excluded.
Three common reactions, and why they fail
Switch the module on and trust the vendor. The vendor has its obligations, but the company using the system has its own: oversight by trained people, records kept, candidates informed and, before a system like this is used in the workplace, employees and their representatives informed too. None of that comes with the click.
Ban AI from HR altogether. Understandable, and it leaves the team exactly where it was, answering hundreds of emails by hand about the status of an application. Worse, the informal use of general-purpose tools carries on, only now without any rules.
Have a person press the final button. This is the answer that looks like a solution and is not one. If the decision maker receives a ranked list, cannot see why candidate 340 ended up in 340th place and has thirty minutes to finish screening, the human involvement is decorative. A review that always confirms what the system proposed is not oversight, it is a signature.
How to design AI that supports rather than decides
The difference between supporting and deciding does not lie in the language model, it lies in the architecture around it. Five decisions do almost all of the work.
Criteria are set by people and kept under version control. Before the system reads a single application, HR and the hiring manager define what counts for that role: an HGV licence, experience with barcode scanners, availability for night shifts. Each criterion is written down, dated and tied to the role. If it changes midway through the process, the record shows when and by whom.
The system extracts evidence, it does not give marks. Instead of an overall score, each application is presented criterion by criterion, with the passage from the CV that backs up each statement. "Mentions three years as a forklift operator, 2021 to 2024, in the experience section." The decision maker sees what the system found and where, and can check it in seconds. When the information is not there, the system says it did not find it, rather than inferring it.
There is no automatic rejection. The system can flag that an application does not mention a mandatory requirement, but the exclusion is made by a person. Nothing leaves the process without a human decision attached to a name.
The decision is recorded with its reasoning. Every move between stages stores who decided, when, with what information in front of them and why. That is what makes it possible to answer a candidate who asks for an explanation, an audit or a complaint, and it is also how you measure whether the human review is real: if nobody ever disagrees with the system, there is a problem worth investigating.
Bias testing before and after go-live. Removing the name and the photo is not enough, because some variables act as proxies: the postcode, the year a degree was completed, which gives away age, or career breaks that coincide with parental leave. We test with sets of applications built for the purpose and repeat the test whenever the criteria or the model change.
On top of this come the information given to candidates, who know there is AI in the process and how to ask for a review by a person, and the data protection impact assessment, carried out at the design stage rather than afterwards. The general principles we apply to any agent in production are in the article on GDPR and the AI Act before putting AI agents into production; the difference here is that the bar goes up because the decision is about people.
We do not give legal advice, and the final classification of each use is for the company and its advisers to make. Our job is to build the system so that this analysis finds what it needs: written criteria, complete records and decisions that can be explained to a candidate, an employee or an inspector.
How we work
1. Free diagnosis
A conversation with no commitment to map where AI is already used in HR, officially or not, and where the team loses the most hours. By the end, each use is classified: straightforward, needs care, or best avoided.
2. Design and criteria
Together with the HR leadership we define the scope, the criteria for each process, who decides what and what gets recorded. This is also where the data protection officer and, where there is one, the works council get involved.
3. First, what frees up hours without risk
Employee portal, internal policy assistant, digital onboarding and scheduling. This is the phase with the fastest return, and the one that builds the data and access foundation everything else rests on.
4. Decision support, if it makes sense
Only afterwards, and only if the volume justifies it, evidence extraction from applications, with human review, record keeping and bias testing designed in from the start.
5. Production and ongoing support
Training for the people who use the system, which also serves the duty to promote AI literacy that the AI Act places on those who use it, close support through the first weeks and periodic review of the tests. The code and the infrastructure belong to the company.
Reference figures and timelines
The figures depend on the starting point. Within our digital onboarding solution, an employee portal with holidays, expenses, documents and a personal area sits between €15,000 and €25,000, rising to between €25,000 and €40,000 when it includes digital onboarding of new starters with electronic signature. For custom HR management, a portal with time and attendance comes in between €18,000 and €30,000, rotas and shifts with legal rules between €30,000 and €50,000 (a concrete example is shift management in hospitality), and a complete people platform, with appraisals and skills, from €50,000.
What moves the figure most is the number of systems to integrate (payroll, time tracking, existing recruitment software) and the quality of the internal documents the assistant will rely on. A screening support component, where it is justified, adds its own record keeping and testing work, which should not be cut to bring the price down. As an engineering plan, building a portal with onboarding typically takes 8 to 12 weeks, and 12 to 18 weeks when it includes attendance, rotas or appraisals. What makes these timelines vary is explained in how long a custom software or AI project takes.
When the answer is not to build
If the company receives a few dozen applications a month, AI screening does not pay for itself and adds obligations with no return. If all you are after is interview scheduling and automatic replies to candidates, off-the-shelf recruitment software is usually enough, and that is what we recommend. The broader comparison is in the article on custom AI agents versus generic tools.
And if the goal is an automatic score that decides who gets interviewed, our honest answer is that we do not build it that way, because it shifts onto the company a risk that the time saved does not make up for.
Five questions for the HR director
- How many applications do you receive a month, and how many hours does the team spend just replying and scheduling?
- Which AI features are currently switched on in your HR software, and who approved them?
- Are your internal policies written down and up to date, or do they live in the heads of two people?
- Who in the company is responsible for data protection and for employee relations?
- If a candidate asked you tomorrow why they were rejected, could you answer?
If the last question had no answer, that is the place to start. If you want to understand where AI can help your HR team without putting the company in a category it never chose, you can request a free diagnosis. In the first conversation, with no commitment, we go through the uses already in place and the ones worth adding, and classify each of them with you.
