SovergateIs your hiring AI high-risk
under the EU AI Act?
Almost certainly, yes. CV screening, candidate ranking, interview scoring, and performance evaluation are all classified as high-risk AI under Annex III Category 4. Sovergate logs every AI hiring decision with PII scrubbing and generates Article 12 reports your legal team can use.
of companies already use AI somewhere in their recruitment process
have started formal EU AI Act compliance preparation
Which HR AI systems are high-risk
The EU AI Act explicitly lists employment AI under Annex III, Category 4 — one of the broadest high-risk categories in the regulation. Not sure about your system? Read the full high-risk classification guide →
Any AI system that analyses CVs, filters applications, or ranks candidates for human review is classified as high-risk. This includes ATS AI features, resume parsers with scoring, and any LLM used to shortlist applicants.
AI that analyses video interviews, assesses verbal or non-verbal communication, or scores interview performance is explicitly high-risk.
AI used to assess employee performance, predict promotion readiness, or support termination decisions falls under Category 4.
AI that allocates tasks, determines shift patterns, or monitors productivity in ways that affect employment conditions is in scope.
The AI Act imposes an absolute prohibition on emotion tracking in the workplace. Monitoring a worker's mood or stress levels is now strictly forbidden. This prohibition has been in effect since February 2025. There is no grace period.
⚠️ What Article 12 requires for HR AI
For every LLM call your hiring or HR system makes, you must maintain:
- ✓Automatic logs of every AI-assisted hiring decision
- ✓Records showing which decisions were reviewed by a human and what factors were considered beyond the AI output
- ✓Tamper-evident audit trail — cryptographic verification
- ✓PII scrubbed in compliance with GDPR
- ✓Minimum 6 months log retention
- ✓Logs available to national labour authorities on request
Employers also have a separate duty to inform affected workers before using high-risk AI at the workplace. Your logs should record that this disclosure was made.
The candidate data problem
Every CV your AI screens contains densely packed personal data: full name, address, email, phone number, employment history, education, and often age, nationality, and disability information. Logging this raw to a US-based service creates immediate GDPR exposure. Sovergate scrubs PII locally before any data leaves your infrastructure.
| Data type | Replaced with |
|---|---|
| Candidate names | [NAME_REDACTED] |
| Email addresses | [EMAIL_REDACTED] |
| Phone numbers | [PHONE_REDACTED] |
| Addresses | [ADDRESS_REDACTED] |
| National ID numbers | [ID_REDACTED] |
The log preserves the structure of the AI decision — what signals were assessed, what score was produced — without containing the candidate's raw personal data.
How Sovergate works for HR AI
Bias documentation
Article 10 requires data governance practices that address bias in training data. For HR AI, this means documenting that your AI does not systematically disadvantage protected groups. Sovergate's logs provide the raw material for bias audits:
- ✓Decision distribution across time periods
- ○Score distributions (without PII)Coming soon
- ○Human override ratesComing soon
- ○Rejection reasons (where recorded)Coming soon
What your HR and legal team gets
A monthly PDF per AI system containing:
- ✓Total AI hiring decisions logged
- ○Human review rate — percentage of AI decisions reviewed by a recruiter before actionComing soon
- ○Override rate — where human reviewers disagreed with AIComing soon
- ○Candidate notification eventsComing soon
- ✓PII scrubbing summary
- ○Bias monitoring data export (CSV)Coming soon
- ✓Audit trail integrity: PASSED
- ✓Data residency: Hetzner, Nuremberg, Germany
Pricing
- 1 AI system (e.g. CV screening)
- 100,000 requests/month
- Annual Article 12 report
- 5 AI systems
- 1,000,000 requests/month
- Monthly Article 12 reports
- Bias monitoring data export
- Unlimited AI systems
- Unlimited candidates
- Custom log retention
- DPA signing included
- SLA guarantee
Frequently asked questions
Is AI used in hiring high-risk under the EU AI Act?
In most cases, yes. Annex III, point 4 lists AI used to recruit or select people — placing targeted job ads, analysing and filtering applications, and evaluating candidates — as well as AI used for promotion, termination, task allocation, and performance monitoring.
Is a CV screening tool still high-risk if a recruiter makes the final decision?
Yes. Annex III covers AI that assists decisions, not only fully automated ones. A tool that ranks or shortlists candidates for human review is still high-risk. The narrow exceptions for procedural or preparatory tasks never apply when the system profiles candidates.
We buy our ATS from a vendor. Who is responsible for compliance?
Both of you. The vendor is the provider and must build in automatic logging under Article 12. As the deployer, you have your own duties under Article 26: use the system as instructed, assign human oversight, keep the logs under your control for at least six months, and inform workers' representatives and affected workers.
When do the high-risk rules apply to hiring AI?
The original date was 2 August 2026. The Digital Omnibus agreement moves the obligations for Annex III high-risk systems, including employment AI, to 2 December 2027. The obligations themselves are unchanged.
What does Article 12 require us to log for hiring AI?
Automatic, tamper-evident records of the system's operation that make each decision traceable: when it ran, which model and version, the input and output, and whether a human reviewed or overrode the result. Logs must be kept for at least six months, and candidate PII should be scrubbed before it is stored.
The December 2027 enforcement deadline
is closer than it looks.
Initializing the Sovergate SDK takes less than 10 minutes. Securing explicit governance sign-off from your corporate internal audit team takes weeks. Install the SDK in staging today, export your first verification ledger, and clear compliance blockers early.