If your recruitment AI scores a candidate's "enthusiasm" from their interview video, that's not a 2027 compliance problem. It's already illegal, and has been since February 2025.
Most HR tech content lumps every AI hiring feature into one "get ready for the EU AI Act" bucket. In reality, there are two very different buckets, with two very different deadlines:
HIGH-RISK (Annex III(4)(a)) — Full obligations enforceable 2 December 2027
- CV and resume screening that ranks or filters applicants
- Video-interview platforms that score responses or delivery
- Psychometric and skills assessments feeding a hiring decision
- Sourcing and matching algorithms deciding who a recruiter even sees
- Programmatic job-ad targeting that decides who sees a role at all
Required: documented risk assessment, technical documentation, bias testing, human oversight, disclosure to candidates, and an audit trail. Fines for failing these run up to €15M or 3% of global turnover.
PROHIBITED (Article 5) — Came into force since 2 February 2025
- Inferring a candidate's emotions from facial expression, voice tone, or body language (Article 5(1)(f)) — the EU AI Office's guidance explicitly extends "workplace" to the recruitment and interview stage
- Inferring personality traits from social media or non-work behaviour to filter candidates (Article 5(1)(c))
There's no phase-in, no grace period, no documentation that makes this compliant. Fines run up to €35M or 7% of global turnover. So if your ATS or interview platform has a "culture fit" or "engagement" score built on facial or voice analysis, it needs to come out, not get documented.
Here's the part that actually matters for engineering teams building HR Tech: the difference between these two buckets often comes down to a single feature flag or a single import. The exact same candidate scoring codebase can be high-risk today and prohibited tomorrow, depending on what a new PR adds — and that's not something a compliance team reviewing quarterly is going to catch in time.
That's the gap we built OpenComplAI to close: EU AI Act checks that run in your CI, on every commit, not a policy review that happens after the feature has already shipped. The same detection model that flags an unrecognised biometric import in a codebase applies the same way to an emotion-inference library landing in a candidate-scoring pipeline — caught before merge, not discovered at audit time.
If you're building or buying AI hiring tools, it's worth an afternoon auditing your stack against these two lists specifically, not just "are we EU AI Act ready" in the abstract.
OpenComplAI is free and open source, and still early enough that feedback from people actually working in HR tech shapes what we build next.
