AI Act
The EU AI Act is the European law that sets rules for artificial intelligence by level of risk. AI used to recruit, select or evaluate candidates counts as high-risk. Some practices, such as reading emotions from a candidate’s voice, have been banned in hiring since 2 February 2025.
The AI Act does not stand alone. GDPR already applies to every candidate conversation. The AI Act adds rules on top. For a staffing agency or an employer, the question is which parts apply today.
Which recruitment tools does the AI Act cover?
The AI Act lists high-risk uses in Annex III. Three points apply to hiring:
- Point 4(a): recruitment and selection. AI that screens, ranks, filters or evaluates candidates. Voice and chat screening fall here.
- Point 4(b): work after the hire. AI that allocates shifts, monitors performance or supports termination decisions for placed workers.
- Point 1: biometrics. Recognising who is speaking from their voice falls here. Turning speech into text does not.
A tool that only screens sits in point 4(a). A tool that also evaluates placed workers picks up point 4(b) as well.
What is already banned?
Article 5 lists practices that have been illegal in the EU since 2 February 2025, with no grace period. Four apply to hiring:
- Manipulation. Scripts that pressure candidates or hide what is collected from them.
- Exploiting vulnerabilities. Using unemployment or immigration status to push worse terms.
- Social scoring. A cross-employer "reliability score" built from past behaviour.
- Emotion recognition at work. Inferring how a candidate feels from their tone, pitch or stress.
These carry the steepest penalties in the regulation.
When do the high-risk rules apply?
The full high-risk obligations for recruitment tools were set for 2 August 2026. In May 2026, the EU co-legislators agreed to move most Annex III deadlines to 2 December 2027, pending formal adoption. Plan for both dates until the final text is published. The later date changes when the paperwork applies. It does not change that recruitment AI is high-risk.
Who carries which duties?
| Provider (the vendor) | Deployer (the agency or employer) | |
|---|---|---|
| Who | The company that builds and sells the AI tool | The company that uses it to hire |
| Main duties | Risk management, technical documentation, conformity assessment, registration | Telling candidates about the AI, real human oversight, keeping logs, informing worker representatives |
| Before go-live | Show the tool meets the requirements | Run a data protection impact assessment (DPIA) |
What does an agency or employer have to do?
- Tell every candidate they are dealing with AI, at the moment it happens, not only in a privacy notice.
- Run a DPIA before deployment. GDPR already required it. See GDPR in recruitment.
- Inform workers and their representatives before the tool goes live. In Belgium and the Netherlands this usually means the works council.
- Keep the automatic logs for at least six months.
- Keep a person able to change the outcome. A click on every AI recommendation does not count. See rubber-stamping.
- Be ready to explain the AI's role in a decision when a rejected candidate asks.
How does Ringtime handle the AI Act?
Ringtime builds its AI agents for frontline hiring around a few fixed boundaries:
- The assistant introduces itself as a digital assistant of your company at the start of every conversation.
- Ringtime does no voice biometric identification and no emotion inference. Audio is transcribed and only text reaches the model.
- The assistant never rejects a candidate by itself. A candidate who fails a must-have question goes to recruiter review.
- Recruiters see the answers behind every result and can read the full conversation, so they can challenge it.
- Ringtime signs a data processing agreement with every customer and gives the input your DPIA needs.
This page is general information, not legal advice. Talk to your legal team or data protection officer about your own setup.
To check any AI vendor in your stack, read what the EU AI Act means for staffing.
