EU AI Act · apply · about 10 minutes

The HR team bought a screening tool

HR has signed with a vendor for a CV screening tool. It will run under your company's brand on your careers site, you will fine-tune it on five years of your own hiring decisions, and a recruiter will see a ranked shortlist with scores. The vendor's contract describes you as "the customer". Your general counsel asks for a one-page read.

Write the page. Lead with what the company is, legally, in this arrangement.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Classifies the system: employment is Annex III, and ranking candidates is not a narrow procedural task High risk arrives by two routes
Names the flip: own branding plus fine-tuning makes the company a provider, not just a deployer How a deployer becomes a provider
Draws the consequence — the provider's full high-risk obligations now land on the company A risk management system that runs for the lifetime
Flags the training data: five years of past hiring decisions carry the past's bias Data governance, and the article that permits special-category data
Checks the recruiter's oversight is real — authority to override, and designed against automation bias Human oversight is designed in, not added on
Puts it on the calendar against 2 December 2027 for Annex III, and notes the literacy duty already applies The regulation arrives in stages

Read against Regulation (EU) 2024/1689 (AI Act), Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.