In this article (8 sections)
- Which recruitment tools are in scope?
- What must a subsidiary using recruitment AI do?
- Why can screening CVs with a general-purpose AI tool make you a provider?
- Does the AI Act matter when Taiwanese headquarters recruits for Europe?
- The most common subsidiary mistakes
- FAQ
- Next in the series
- Legal sources and references
When Taiwanese companies set up subsidiaries, factories or service locations in Europe, recruitment is one of the first operational tasks they face. Many of today’s applicant tracking systems (ATS), job platforms and interview tools have AI built in: they screen CVs automatically, score candidates, analyse interview videos and recommend suitable people.
The AI Act classifies these uses as high-risk. The good news is that most European subsidiaries are “deployers” here, with obligations much lighter than a provider’s. What you need to watch is one common practice that can turn you into a provider without you realising it.
Key takeaways
- Point 4(a) of Annex III: AI used for recruitment or selection, including placing targeted job advertisements, analysing and filtering job applications and evaluating candidates, is high-risk and applies from 2 December 2027.
- Deployers must use the system in accordance with the instructions, assign human oversight, ensure input data is relevant, monitor operation, keep logs, and inform candidates that they are subject to a high-risk AI system (Article 26(11)).
- Candidates affected by an adverse decision have the right to ask the deployer to explain the role of the AI in the decision (Article 86).
- Using a general-purpose generative AI tool to screen CVs and score candidates may make you a provider by modifying the intended purpose (Article 25(1)(c)).
Which recruitment tools are in scope?
Point 4(a) of Annex III lists three uses:
| Use | Common tools |
|---|---|
| Placing targeted job advertisements | Ad targeting functions that decide who sees a vacancy based on personal characteristics |
| Analysing and filtering job applications | Automatic screening, CV ranking and key criteria matching in an ATS |
| Evaluating candidates | Automatic scoring of online tests, interview video analysis, aptitude assessments |
The test is what the tool “is used for”. The same ATS used only to receive applications and schedule interviews gives a different result from one with AI automatic ranking switched on.
Take particular care with interview video analysis. Using AI to infer a person’s emotions in the workplace, except for medical or safety reasons, is a prohibited practice under Article 5(1)(f), applicable since 2 February 2025. If a tool claims to judge candidates’ emotions or attitude from facial expressions or tone of voice, first check whether it falls under this prohibition.
Does any of this happen at your European locations?
- AI functions in an ATS or job platform automatically rank or filter out CVs
- Online tests or interview videos are scored automatically by the system
- HR staff use tools such as ChatGPT to compare and score CVs
High-risk rules for recruitment AI: apply from 2 December 2027.
What must a subsidiary using recruitment AI do?
If you buy or subscribe to a recruitment system from a software vendor, the vendor is the provider and the European subsidiary is the deployer. The deployer obligations in Article 26 are:
| Obligation | Provision | What it means in recruitment |
|---|---|---|
| Use in accordance with the instructions for use | Paragraph 1 | Use the system within the intended purpose and conditions described by the provider |
| Human oversight | Paragraph 2 | Assign people who are competent, trained and have the authority to override the system’s results |
| Input data | Paragraph 4 | To the extent you control it, ensure job requirements and screening settings are relevant and sufficiently representative in view of the intended purpose |
| Monitoring and reporting | Paragraph 5 | Monitor operation in line with the instructions, and inform the provider and suspend use if you identify a risk |
| Record-keeping | Paragraph 6 | Keep automatically generated logs, to the extent they are under your control, for at least six months |
| Informing workers | Paragraph 7 | Inform workers’ representatives and affected workers before using high-risk AI in the workplace |
| Link to the DPIA | Paragraph 9 | Use the provider’s information to carry out the GDPR data protection impact assessment |
| Informing candidates | Paragraph 11 | Where the system makes or assists in making decisions about natural persons, inform the persons concerned |
In addition, Article 86 gives affected persons a right to explanation: where a decision taken on the basis of the output of an Annex III high-risk AI system produces legal effects or similarly significant effects for the person, and the person considers that it adversely affects their rights, they can ask the deployer to explain the role of the AI in the decision-making procedure and the main elements of the decision.
Why can screening CVs with a general-purpose AI tool make you a provider?
Article 25(1)(c): anyone who modifies the intended purpose of an AI system that is not high-risk (including a general-purpose AI system) in such a way that it becomes a high-risk AI system is considered a provider.
The intended purpose of a general-purpose generative AI tool is not to screen candidates. When HR staff feed in a batch of CVs and ask the tool to rank them, score them and pick the top few, they are using it for the purpose in point 4(a) of Annex III. The full set of provider obligations (Article 16) may then fall on you, while you hold almost no technical documentation.
This is the risk that needs the most attention in recruitment: the problem is not that you use AI, but how you use it.
Does the AI Act matter when Taiwanese headquarters recruits for Europe?
Yes. Article 2(1)(c): providers and deployers established in a third country are in scope where the output produced by the AI system is used in the EU. If HR at Taiwanese headquarters uses AI to screen candidates for European locations and the results are used to make recruitment decisions in the EU, the high-risk rules apply in the same way.
The GDPR has a similar extraterritorial reach: it applies when you offer goods or services to people in the EU or monitor their behaviour. Processing of recruitment data must also be checked against the restrictions on automated decision-making in GDPR Article 22.
The most common subsidiary mistakes
- Assuming that “a person makes the final decision” means it is not high-risk: point 4(a) of Annex III includes “analysing and filtering”, and people filtered out by the system never reach a human at all.
- Not asking the vendor for the instructions for use: deployer obligations are based on the provider’s instructions for use, and without them you cannot show that you used the system in accordance with them.
- Human oversight in name only: Article 26(2) requires the person overseeing to have competence, training and authority; oversight that can only click “approve” does not count.
Start by mapping the AI in your recruitment process
A single recruitment process may involve several tools, each playing a different role. Which are high-risk, which can avoid that through a change in how they are used, and what documents vendors should supply all depend on your actual process and tool settings.
FAQ
Is using AI to screen CVs illegal in the EU?
No, but it is a high-risk use under the AI Act, and from 2 December 2027 both providers and deployers must meet the corresponding obligations. Using AI to infer candidates’ emotions may fall under the Article 5 prohibitions.
We subscribe to our recruitment system from a large international vendor. Is the vendor responsible for everything?
The vendor is the provider and is responsible for the system’s design, documentation and conformity assessment; your subsidiary is the deployer and still carries the Article 26 obligations, including human oversight, record-keeping and informing candidates.
Can candidates ask us to explain why they were rejected?
Article 86: where a decision taken on the basis of the output of an Annex III high-risk AI system produces legal effects or similarly significant effects for the person concerned, that person can ask the deployer for a clear explanation of the role of the AI in the decision and the main elements of the decision. The GDPR also has relevant rights to information and rules on automated decision-making.
Next in the series
Part 9: “We are not high-risk”: the Article 6(3) exception and the evidence behind it
Previous: Part 7: Using AI to schedule after-sales engineers may be high-risk AI
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help European subsidiaries map the AI in their recruitment and HR processes and confirm AI Act applicability.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2, 5, 16, 25, 26 and 86, Annex III: EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
- Regulation (EU) 2016/679 (GDPR), Articles 3, 22 and 35: EUR-Lex
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · AI Act consolidated text (27 July 2026) · Regulation (EU) 2016/679 (General Data Protection Regulation). This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI ActAnnex IIIrecruitment AIAI CV screeningdeployerdeployer obligationsGDPRHR
