EU AI Act and GDPR checklist for recruitment software: 10 questions to ask your vendor

If you buy recruitment software today, you are very likely buying an AI system in the strictest category of the EU AI Act. At the same time, the timeline shifted in 2026, and many vendors are vague about where they actually stand.

This checklist sets out what already applies, what comes later, and ten questions to ask a vendor before you sign.

Why this matters now

Two regimes overlap: the GDPR, which has applied for years, and the AI Act, which is coming into force in phases.

Recruitment and selection is listed in Annex III of the AI Act, the list of high-risk use cases. That is not a detail: it means requirements for documentation, human oversight, logging and risk management.

The date on which those high-risk obligations become enforceable moved in 2026. Under the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 2026), the Annex III obligations shifted from 2 August 2026 to 2 December 2027.

What matters here:

• The GDPR was not postponed. Article 22 on automated decision-making, the duty to carry out a DPIA, processing agreements and retention periods all apply in full. The short-term enforcement risk sits here, not in the AI Act.
• The transparency rules in Article 50 have applied since 2 August 2026. These mainly cover chatbots and AI-generated content. Telling candidates that AI is used already follows from the GDPR's information duties, and from 2 December 2027 also from Article 26 of the AI Act.
• The prohibitions in Article 5 have applied since February 2025. They include emotion recognition in the workplace. A tool that claims to infer a candidate's mood or personality is on very thin ice.
• AI literacy (Article 4) has applied since February 2025. The Omnibus softened the wording but kept the duty: people who work with the system need to understand what it does and where its limits are.

A delay is not a cancellation. And for the parts that matter today, there is no delay at all.

Who is responsible for what?

A costly misunderstanding: as an employer, you cannot buy your way out of compliance.

• The vendor is the provider of the AI system. It is responsible for technical documentation, risk management, quality management and, eventually, the conformity assessment.
• You are the deployer. You are responsible for the legal basis, informing candidates, real human oversight and the retention periods in your own process.

A vendor that says "we are compliant, you don't need to do anything" either does not understand the regulation or hopes you don't.

Ten questions to ask your vendor

Ask these in writing, before you sign.

1. Is our candidate data used to train models? The answer should be no, in writing.
2. Who are the sub-processors, and which AI model is used? You need this for your own record of processing activities.
3. Is there a data processing agreement with a list of sub-processors? Without a DPA you cannot start.
4. How is human intervention enforced? Not "the user can always decide for themselves", but: the system blocks a rejection on content until a person has looked at the documents.
5. Is there an audit trail? Who decided what, when, and on what basis. You need this the moment a candidate objects.
6. Can I explain, per candidate, what an assessment is based on? A bare number is not explainable, and therefore not defensible.
7. Does the system make claims about personality, emotion or mental traits? If so, walk away. This touches Article 5.
8. What measures are in place against bias, and are they monitored? Ask for the procedure and for evidence that it is followed.
9. What are the default retention periods, and can I set them myself? Norms differ per country. In the Netherlands, for example, the data protection authority's guideline is four weeks after the procedure ends for rejected candidates, or up to a year with consent. Check the guidance in your own country.
10. Where is the technical documentation, and can I see it? For a high-risk system it has to exist. A no is a bad sign.

The GDPR side: what you arrange yourself

• Legal basis. In most cases legitimate interest for the hiring procedure itself, with explicit consent for the AI analysis as an extra layer.
• Information. Tell candidates in your job ad or application form that AI is used, what for, and that a person makes the decision.
• DPIA. For high-risk processing of application data, a data protection impact assessment is in practice unavoidable.
• Retention. Set periods that match your national guidance, and enforce them technically, not just in a policy.
• Candidate rights. Access, correction and deletion have to work in practice.

How SelectWiser approaches this

Honestly and concretely: right now, no provider in this category has completed the full Annex III process. That deadline is 2 December 2027.

What is already in place:

• AI analysis happens only with the candidate's explicit consent. No consent means no analysis, and no cost. Applying remains possible.
• Candidate data is not used for model training and not stored permanently by the AI provider.
• A rejection on content requires demonstrable human review of the CV or cover letter. Reading only the AI report does not count. The system records those review moments.
• Scores are an indication in whole numbers, always with reasoning. You get interview questions for every candidate, including weaker matches: the AI does not decide who deserves an interview.
• The AI consent box is never pre-ticked. The candidate chooses.
• Every rejection is recorded with a human reason, plus an audit trail of who decided what and when.
• The model may not make assumptions about age, gender, ethnicity, health, religion or sexual orientation, and may not use indirect signals for them either.
• No conclusions about personality or psychological traits. The analysis is limited to the text and the explicit requirements of the role.
• The full policy is public on our AI governance page.

Frequently asked questions

Which recruitment software complies with the GDPR and the AI Act? Don't ask for a badge, ask for evidence: a processing agreement, a sub-processor list, retention periods, explainable scores and enforced human intervention. A vendor that cannot show those four does not comply.

Can I reject candidates fully automatically? In practice, no. Article 22 GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects. Make sure there is real, demonstrable human intervention.

Do I have to tell candidates that I use AI? Yes. That already follows from the GDPR's information duties: say what you use AI for and that a person decides. From 2 December 2027, Article 26 of the AI Act also requires you to inform candidates.

Does anything change now that the deadline moved to December 2027? For employers, very little. The GDPR obligations never stopped, and they cover most of what you need to have in place for hiring today.

Conclusion

The postponed deadline is no reason to sit back: the obligations that apply today are exactly the ones a candidate or regulator will hold you to.

Take the ten questions to your next vendor conversation. A vendor that answers them plainly probably has its house in order. For what changes for hiring more broadly, read Hiring in 2027, or contact us with questions about our documentation.