The Act sorts AI systems by risk. Its Annex III lists AI intended for recruitment or selection, including systems used to analyse applications and evaluate candidates, as high-risk. Providers of those systems must meet requirements on risk management, data quality, documentation, logging, accuracy and human oversight. Employers using them, known as deployers, have duties too, such as assigning trained staff to oversee the system and telling people it is in use.
The Act can reach organisations outside the EU when their AI is used there or its output affects people in the EU, so UK and US employers hiring EU-based candidates may be covered. High-risk obligations phase in over several years and the timetable has been revised, so current dates are worth checking with an adviser. Human review of every recommendation and clear records of how scores were reached are central to what the Act expects.