Identify the intended use
List drafting, extraction, summarization, ranking and evaluation separately. Record inputs, outputs and the decisions affected.
Annex III point 4 of Regulation 2024/1689 covers specified recruitment and selection uses. Classification also requires examining Article 6 and its bounded exceptions. Not every AI tool used by HR automatically has the same status.
Read the current timetable
Regulation 2026/1744 sets 2 December 2027 for Chapter III Sections 1–3 concerning Article 6(2) and Annex III high-risk systems, subject to the stated Article 6(5) exception. Annex I systems have a different timetable.
Other dates and transitional rules also apply. System history and changes may matter. This timetable does not suspend GDPR or employment obligations.
Distinguish provider and deployer roles
A provider develops or markets the system under the regulation’s conditions; a deployer uses it professionally. Significant changes or altered purposes may require further analysis.
Relevant requirements concern risk management, documentation, logging, information, oversight and robustness. Ask what exists, what remains open and under which conditions the system is intended to be used.
Make oversight meaningful
A confirmation button alone does not establish useful oversight. Decision makers need information, time and the ability to disagree with the output.
If an analysis misses experience in a CV, the recruiter should inspect the original and ask for clarification. Define how errors are raised and decisions documented rather than routinely following a score.
Ask concrete demonstration questions
Use fictional representative cases, including incomplete documents and uncertain output. Ask about evaluation methods and limitations rather than seeking an unsupported promise of zero bias.
| Topic | Question |
|---|---|
| Purpose | What decisions should the system support, and what uses are excluded? |
| Data | What is transmitted, where and to whom? |
| Explanation | Can the result be connected to evidence in the record? |
| Errors | How are incorrect extraction and analysis handled? |
| Evaluation | Which tests and limitations are documented? |
| Changes | How are model and method changes tracked? |
Assess data protection separately
GDPR requirements include lawful grounds, information, retention and rights. Article 22 addresses specified solely automated decisions with legal or similarly significant effects; this is not resolved by a generic consent checkbox.
Assess whether a data protection impact assessment is required for your processing. French hosting does not remove that question, and a vendor document does not automatically cover every employer’s situation.
What aiKip documents
aiKip presents scoring as indicative and keeps recruiter review and decisions central. Its transparency page describes intended uses, measures and remaining work.
Published controls are not a blanket certification. During a trial, check whether your team can inspect explanations and original information.
Prepare an owned review process
Assign an owner and involve HR, data protection, IT and legal functions as appropriate. Maintain a coherent view of uses, provider documentation, internal rules and unresolved points.
Review it when the tool, model or usage changes, keeping reference dates and versions.
-
Inventory
List uses, data and affected decisions.
-
Classify
Assess roles and applicable requirements.
-
Organize
Prepare oversight, information, error handling and training.
-
Review
Track product and regulatory changes.
Frequently asked questions
Does the AI Act ban AI-assisted recruitment?
No. It distinguishes uses and risks, including prohibited uses and specified high-risk systems. Assess the actual system and purpose.
Can preparation wait until 2027?
GDPR and employment rules already apply independently. Organizing responsibilities and oversight takes time.
Does aiKip claim AI Act certification?
No. Its transparency page publishes measures and remaining work rather than a general certification claim.