Overview

The EU classified employment AI systems as "high-risk." This is serious. It means your recruiting AI, your performance management AI, your compensation AI, all are subject to strict regulatory requirements. You need formal risk assessment before deployment. You need conformity assessment (independent review). You need documentation and audit trails. You need to tell people AI is being used. You face €30M+ fines if non-compliant (or 6% global revenue, whichever is higher).

If you have European employees, candidates, or even candidates who apply from European countries, this applies to you. Even if you're a US company with no office in Europe. If a candidate from Germany applies for a job, the EU AI Act applies to that candidate's screening.

This lesson walks you through the EU AI Act, what it actually requires, what it means for recruiting, performance management, and compensation, and how to be compliant without unnecessary overhead. You'll understand what "high-risk" means, what conformity assessment is, and how to build compliance documentation that satisfies regulators.

What's the EU AI Act? The Regulatory Hierarchy

The EU AI Act (effective 2025-2026, phased implementation) regulates AI systems by risk level.

Prohibited AI (you can't use these ever):
- Emotion recognition for employee evaluation
- Real-time biometric categorization (facial recognition, gait analysis)
- Subliminal manipulation
- Exploitation of vulnerabilities (targeting vulnerable populations)

High-Risk AI (includes employment decisions):
- Recruiting (resume screening, interview assessment, hiring decisions)
- Performance management (evaluation, promotion recommendations)
- Compensation (pay decisions)
- Workforce planning (layoff decisions, restructuring)

Limited-Risk AI (transparency required):
- AI that interacts with humans
- Recommendation systems

Minimal-Risk AI (almost no requirements):
- Spam filters
- Video games
- Most optimization tools

Why employment AI is high-risk:
Decisions affect people's livelihoods. Bias in recruiting means unfair opportunity. Bias in performance means unfair advancement. Bias in compensation means unfair pay. The potential for discrimination is high.

What the EU AI Act Requires for High-Risk Employment AI

Requirement 1: Risk Assessment (Before Launch)

You must document:
- What's the intended use? (e.g., "screen resumes for engineering roles")
- What could go wrong? (bias, discrimination, data breach)
- How will you mitigate risks? (bias audits, human review, appeals)

Format: Written risk assessment, 2-3 pages per use case

What to include:
- Description of the AI system
- Purpose and intended use
- Identified risks (bias, security, accuracy, unintended consequences)
- Mitigation measures (how you'll prevent each risk)
- Residual risks (risks that remain even with mitigation)
- Conclusion: is risk acceptable?

Example:
"Resume screening AI for engineering roles. Purpose: accelerate hiring, improve candidate quality. Risks: (1) Bias against women engineers (mitigated by quarterly bias audits), (2) Data breach (mitigated by SOC 2 vendor, encryption), (3) Accuracy drops (mitigated by quarterly accuracy validation). Residual risks: <5%. Risk acceptable with mitigations in place."

Requirement 2: Conformity Assessment (Before Launch, Then Annually)

Independent review (internal or third-party) that:
- Confirms you've done the risk assessment
- Verifies documentation
- Tests for bias/discrimination
- Confirms human oversight is in place

Timeline: Before deployment, then annually

What this means:
Someone (internal compliance person or external auditor) reviews:
- Your risk assessment (is it complete? thorough?)
- Your bias audit plan (how will you measure bias?)
- Your human oversight process (can people override AI? are decisions logged?)
- Your documentation (can you prove you did this work?)

Cost: Internal assessment is ~$5-10K. External auditor is ~$15-25K per year.

Requirement 3: Documentation & Audit Trails (Ongoing)

Maintain records of:
- Training data: What data was the model trained on? Is it documented?
- Model accuracy: How accurate is the model?
- Bias audit results: Quarterly bias audits. Results documented.
- Decisions made: Who made hiring decisions using AI? Log it.
- Outcomes: What happened as a result? Person hired? Promoted? Paid?

Format: Keep for [duration, varies by regulation, typically 3-5 years]

Why: Legal defense. If challenged, you can show: "We trained the model on X data. We tested accuracy at Y%. We audited for bias quarterly. Here are the results. We logged all decisions. Here's what happened."

Requirement 4: Transparency (Before and After Decision)

You must tell people:
- That AI is being used (in job posting, application materials, interview notice)
- How the AI works (in general terms, don't need to explain the algorithm)
- Their right to explanation (person can ask: why was I screened out?)
- Their right to appeal (person can challenge the decision)

Format: In job posting, during hiring, in decision notification

Example for recruiting:
"We use AI to help screen resumes. The AI reviews qualifications and experience. A recruiter reviews the AI's recommendations and makes the final screening decision. If you have questions about your screening decision, contact [recruiter email]."

Requirement 5: Human Oversight (Always)

Humans (not AI) make final employment decisions.
- AI informs; people decide
- Humans can override AI
- People are trained to understand AI limitations
- Decisions are logged and auditable

What this means:
- Recruiting: AI screens, human recruiter makes hiring decision
- Performance: AI surfaces patterns, manager makes rating decision
- Compensation: AI recommends pay, compensation team approves

Never: "The computer decided" or "AI made the final decision"

Specific Requirements by HR Function

Recruiting AI (Resume Screening, Interview Assessment)

Prohibited under EU AI Act:
- Emotion recognition (analyzing facial expressions in video interviews)
- Biometric systems (voice analysis, gait analysis, facial recognition to identify candidates)
- These are banned entirely for hiring

High-risk (allowed with safeguards):
- Resume screening (if accurate and fair)
- Interview assessment (written questions okay; video analysis problematic)
- Skills assessment (tests okay if non-discriminatory)

What you need:
- Risk assessment for each use case
- Bias audit (compare selection/outcome rates by protected characteristic)
- Documentation of model training data
- Audit log of screening decisions
- Transparency to candidates (job posting discloses AI use)
- Appeal process (candidate can challenge screening decision)

Transparency statement for candidates:
"We use AI to help screen resumes. The AI reviews qualifications and experience. A recruiter reviews the AI's recommendations and makes the final screening decision. If you have questions about your screening decision, contact [recruiter email]. You can appeal any screening decision by contacting [HR email]."

Performance Management AI

High-risk (allowed with safeguards):
- Performance analytics (analyzing manager feedback for patterns)
- Coaching recommendations (AI suggests development areas)

Prohibited:
- Emotion recognition from work meetings
- Tone analysis of emails/messages
- Real-time monitoring disguised as "performance AI"

What you need:
- Risk assessment
- Transparency to employees (tell them AI is used in performance)
- Human review (manager reviews AI recommendations before using)
- Documentation (what feedback went in? what recommendations came out?)
- Appeal process (employee can challenge performance assessment)

Transparency statement for employees:
"Your manager uses AI tools to help with performance conversations. The AI surfaces patterns in feedback and identifies potential development areas. Your manager makes all decisions about your performance rating and development plan."

Compensation AI

High-risk (allowed with safeguards):
- Pay equity analysis (AI compares compensation across similar roles)
- Market benchmarking (AI rates your pay against market)
- Pay recommendations (AI suggests pay for new hires/adjustments)

What you need:
- Risk assessment
- Documentation (what data went in? what pay recommendations came out?)
- Bias audit (does AI recommend fair pay across demographics?)
- Human review (comp team reviews AI recommendations before implementing)
- Transparency (if AI is used in pay decisions, disclose it)

Practical Compliance Checklist: What to Do Before Deploying

Before you launch any HR AI:

• [ ] Risk assessment completed (identify risks and mitigations)
  - [ ] Conformity assessment done (independent review confirms you've done the work)
  - [ ] Documentation in place (model training data, accuracy metrics, bias audits)
  - [ ] Audit trail capability (can you log who made what decision?)
  - [ ] Transparency (you've told people AI is used)
  - [ ] Human oversight (people make final decisions; AI informs)
  - [ ] Appeal process (people can challenge decisions)
  - [ ] Legal review (General Counsel has approved)

Ongoing (after deployment):

• [ ] Quarterly bias audits (mandatory; measure outcomes by protected characteristic)
  - [ ] Quarterly accuracy validation (model is still working as promised)
  - [ ] Annual compliance review (re-confirm you're still compliant)
  - [ ] Monitor regulatory changes (EU AI Act will evolve; stay current)
  - [ ] Document any incidents (bias detected, complaints received)
  - [ ] Update risk assessment if use case changes (changed the model? Changes screening criteria? Re-assess risk.)

Penalties for Non-Compliance: What's at Stake

Administrative Fines for High-Risk AI Non-Compliance:
- €30M or 6% global annual revenue (whichever is higher)
- This is serious money. For a $1B company, 6% = $60M fine

Prohibited AI Use:
- €30M or 6% global revenue (same as high-risk)

Other Violations:
- €10M or 2% global revenue

Other Consequences:
- Regulatory action (ban on use of AI)
- Legal liability (employees/candidates can sue)
- Reputational damage (negative press, trust loss)

Documentation Template: AI System Risk Assessment

Create this document for each AI system:

AI System Risk Assessment

System: [Name and purpose]

Use case: [What it does, e.g., "screen resumes for engineering roles"]

Risk 1: Bias in Screening
- Description: AI could screen out candidates from protected groups at higher rates
- Probability: Medium
- Impact: High (discrimination liability, regulatory action)
- Mitigation: Quarterly bias audits using 4/5ths rule; human review of edge cases; appeal process
- Residual risk: Low (mitigations in place and active)

Risk 2: Data Breach
- Description: Employee/candidate data could be exposed
- Probability: Low
- Impact: Very High (regulatory fines, customer trust loss)
- Mitigation: Vendor SOC 2 certified; DPA signed; encryption; access controls
- Residual risk: Low (mitigations in place)

Risk 3: Model Accuracy Drops
- Description: Model accuracy could degrade over time
- Probability: Medium
- Impact: Medium (bad hiring decisions, quality issues)
- Mitigation: Quarterly accuracy validation; model retraining; fallback process
- Residual risk: Low (monitoring and remediation plan in place)

Risk 4: Vendor Failure
- Description: Vendor could go out of business or fail to support
- Probability: Low
- Impact: Medium (business interruption)
- Mitigation: Vendor financially viable; exit clause in contract; data export rights
- Residual risk: Low (contractual protections in place)

Overall Risk Assessment: Risks are acceptable with mitigations in place. Proceed with deployment.

Conformity Assessment: [Internal/external assessment completed on [date]. Assess result: PASS/FAIL]

The EU AI Act vs. US Regulations

EU AI Act: Prescriptive (you must do X, Y, Z)
- Before you launch: risk assessment, conformity assessment, documentation
- Quarterly: bias audits, accuracy validation
- Ongoing: human oversight, audit trails

US (no federal AI law yet): Principles-based (don't discriminate; be transparent)
- EEOC guidance: validate AI for bias, monitor outcomes
- FTC: don't make false claims, protect privacy
- State laws: vary (NYC, Colorado, Illinois have specific requirements)

Practical impact:
- If you operate in EU: comply with EU AI Act (strict requirements)
- If you operate in US: follow EEOC/FTC guidance (more flexible)
- If you operate in both: do the stricter thing (EU AI Act) and you'll comply with US too

CALLOUT BOX: The Conformity Assessment, What's It Really About?

"Conformity assessment" sounds scary. It's not. It's just: someone reviews your work and confirms you've done it properly.

Internal conformity assessment ($5-10K): - Your compliance person reviews your risk assessment, bias audit plan, and documentation
- They verify: is it complete? thorough? actually protective?
- They sign off: "Yes, we've done the work."
- Takes 40-80 hours of their time

External conformity assessment ($15-25K per year):
- Third-party auditor (Big Four firm, AI compliance specialist) reviews your work
- They run their own tests, review your audit results, check documentation
- They sign off: "This company is compliant."
- More credible if challenged by regulator
- Takes 80-120 hours of their time

You can start with internal assessment. If risk is high or organization is large, consider external assessment for credibility.

Deliverable: Your EU AI Act Compliance Checklist (2 pages)

Create a document covering:

Page 1: Compliance Requirements
- Risk assessment (for each use case)
- Conformity assessment (schedule annual)
- Documentation (what you'll keep and for how long)
- Transparency (how you'll disclose AI use)
- Human oversight (how humans will stay in the loop)

Page 2: Audit Schedule & Documentation
- Quarterly bias audits (methodology, schedule)
- Quarterly accuracy validation (how you'll measure)
- Annual compliance review (who does it, what they check)
- Documentation retention (how long you'll keep records)

What to Do Monday Morning

• 
  Determine if EU AI Act applies to you. Do you have EU employees? Do you recruit from Europe? If yes, it applies.
• 
  For each HR AI tool, create a risk assessment. Use the template above. 2-3 pages per tool.
• 
  Schedule conformity assessment. Decide: internal or external? When will you do it?
• 
  Create your bias audit plan. Quarterly, using 4/5ths rule. Who will run it? How will you document it?
• 
  Update hiring materials. Add transparency statement: "We use AI to help screen resumes..."
• 
  Brief your Legal team. Make sure they know EU AI Act requirements for your organization.

Key Takeaways

• 
  EU AI Act applies to employment AI (recruiting, performance, compensation).
• 
  High-risk requirements: risk assessment, documentation, audit trails, transparency, human oversight.
• 
  Bias audits are mandatory for compliance. Quarterly minimum.
• 
  Prohibited practices: emotion recognition, biometric analysis in hiring. Don't use these.
• 
  Penalties are serious: €30M+ or 6% global revenue. Compliance is worth the effort.
• 
  Compliance documentation matters for legal defense. If challenged, show your work.

FAQ

Q: Does EU AI Act apply if we're a US company with no EU employees?

A: If you recruit from EU or have EU candidates apply, EU AI Act applies to that recruiting process. Geography doesn't matter; having EU data subjects does.

Q: What's a "conformity assessment"?

A: Independent review that you've properly assessed risks and have safeguards in place. Can be internal (your compliance team) or external (third-party auditor).

Q: Do we need to pay external auditors for conformity assessment?

A: Not required, but recommended. Internal assessment is cheaper but less credible if challenged. External assessment costs $15-25K/year but is harder to challenge.

Q: When does the EU AI Act take effect?

A: Phased: some provisions 2024, others 2025-2026. High-risk AI (employment AI) requirements effective in 2026. Start now.

Q: What if we're not ready by 2026?

A: Start now. Compliance takes time (documentation, audits, process changes). Begin immediately.

What's Next

You've navigated EU AI Act. Now you need to understand US regulations. US doesn't have unified federal law yet, but states are passing their own laws (NYC, Colorado, Illinois), and federal agencies (EEOC, FTC) are issuing guidance. Next lesson: US Federal and State AI Employment Laws.

EU AI Act tells you the strict regulatory standard. US laws tell you you need to be ready for multiple standards.