12 min read
Last updated
The EU AI Act establishes rules for developing, supplying and using artificial intelligence within the European Union (EU). Its requirements depend on the type of AI, its intended purpose and the role of the organisation involved.
This article explains the legal framework, including its relevance to recruitment and employee management. It provides a reference for employers, HR professionals and employee representatives who need to understand the law before assessing its practical application.
AT A GLANCE
What Is the EU AI Act?
The AI Act Regulation (EU) 2024/1689 aims to support the use of Artificial Intelligence while protecting health, safety and fundamental rights. It regulates AI systems and establishes separate obligations for providers of general purpose AI models.
EU Regulations are laws automatically become binding in all EU member states, including the Netherlands, without needing to be transposed into national law.
EU Directives are binding as to the result, but not the form: Directives set goals that all EU countries must achieve, but each country decides how to implement them by local law.
The Artificial Intelligence Act is an EU regulation; it applies directly in Member States and does not require transposition in the same way as an EU Directive.
The EU AI Act entered into force on August 1, 2024, and the legislation became part of EU law in 2024, but its requirements apply in stages. The 2026 AI Omnibus amendment changed parts of the framework and its timetable.
AI Transparency Requirements August 2, 2026
From August 2, 2026, relevant transparency requirements apply. For example, applicants and employees interacting with an AI chatbot must generally be informed that they are interacting with AI, unless this is obvious.
These transparency requirements are separate from the obligations for high-risk employment AI.
High-Risk Employment AI Requirements December 2, 2027
A separate development in 2026 concerns the timetable for high-risk AI. The 2026 AI Omnibus amendment moved the application date for relevant Annex III high-risk systems to December 2, 2027. The amendment entered into force on July 27, 2026.
Qualifying systems may include AI used to screen applications, support recruitment decisions, allocate tasks based on individual characteristics or behaviour, or monitor and assess employee performance. Classification depends on the system and its intended purpose.
Employers using these systems will need to address applicable requirements concerning human oversight, monitoring, record keeping and information provided to affected employees and their representatives.
EU Rules AI: Scope AI Act
The EU AI Act applies to organisations that develop, supply or use AI systems within its scope. This includes:
- Providers: organisations that develop an AI system, or have one developed, and make it available under their own name. For example, a software company offering an AI recruitment tool to employers in the EU.
- Deployers: organisations that use an AI system in their professional activities. For example, an employer using that recruitment tool to assess job applications.
- Importers and distributors: organisations that bring AI systems from outside the EU onto the EU market or supply them within the EU.
The Act also covers providers supplying general purpose AI models to the EU market. These are models capable of performing a broad range of tasks, which may be incorporated into different AI tools and services.
For example: a software provider in the USA supplying an AI recruitment system to an organisation in the Netherlands may be covered. The AI Act can also apply where an organisation outside the EU uses an AI system and its output is used in the EU, such as candidate assessments used to recruit employees in the Netherlands.
Out of Scope
Certain activities are excluded, including AI used exclusively for specified military, defence or national security purposes, and individuals using AI for personal, non-professional activities. An employee using AI for work does not fall within the personal-use exclusion merely because they use their own account.
The applicable rules must therefore be assessed under EU AI Act Article 2. An employer should consider how and where the AI system is used, as well as its own role. A supplier being based outside Europe does not remove the employer’s responsibilities.
Providers and Deployers
The EU AI Act distinguishes between organisations that supply AI systems (provider) and those that use them (deployer). This distinction determines which legal responsibilities apply.
-
Provider
A provider develops an AI system, or has it developed, and makes it available or puts it into service under its own name or trademark. For example, a software company offering an AI tool that screens job applications is generally the provider. For qualifying high-risk systems, the provider must address requirements concerning the system’s design, documentation, testing and conformity assessment.
-
Deployer
A deployer uses an AI system under its authority in a professional context. An employer using that recruitment tool will generally be a deployer. Its responsibilities concern how the system is used within the organisation, including following instructions, arranging appropriate human oversight and meeting applicable monitoring and information obligations.
Purchasing a system from a supplier does not transfer all responsibility to that supplier. The provider is responsible for its applicable obligations, while the employer must meet the obligations associated with its own use. The applicable requirements depend on the system’s classification and application dates.
An employer may also acquire provider responsibilities if it substantially modifies a qualifying high-risk system or changes a system’s intended purpose so that it becomes high-risk.
Ordinary configuration does not automatically make an employer a provider. The organisation’s actual activities determine its role. A contract calling the supplier the provider and the employer the customer does not, by itself, settle their responsibilities under the AI Act. This means checking whether changes remain within the use intended and documented by the supplier. Adjusting permitted settings, such as user access or reporting preferences, will generally remain part of the employer’s role as a deployer.
If the employer changes what the system does, it should assess whether that change creates provider responsibilities before using the new function. This could bring additional obligations concerning documentation, testing and conformity assessment.
The supplier contract should therefore explain the intended use, permitted changes and each party’s responsibilities. The contract supports compliance but cannot remove obligations that the law places on the employer.
Different Requirements on AI
The EU AI Act places different requirements on AI depending on how it is used and the harm it could cause. The main distinction is between uses that are prohibited, uses that require additional safeguards, and uses that require transparency.
-
Prohibited AI Practices
Certain AI practices are considered unacceptable and cannot be used, subject to specific legal exceptions.
Article 5 of the EU AI Act prohibits certain uses of AI because of the harm they can cause. These include specified forms of harmful manipulation, exploitation of vulnerabilities and social scoring. The prohibitions have defined conditions, so each proposed use must be assessed against the relevant rule.
For example: AI that infers a person’s emotions from biometric information in the workplace, except where the system is intended for medical or safety reasons.
-
High-Risk Employment AI Requirements
Certain AI systems influencing recruitment or employment decisions may be used, but must meet additional requirements. These can include human oversight, documentation, monitoring and information for affected people.
Article 6 of the EU AI Act sets out two routes to high-risk classification. One concerns specified products and safety components where the statutory conditions are met. The other concerns the employment and other listed uses under Annex III, and includes employment uses such as analysing and filtering job applications, evaluating candidates, decisions affecting promotion or termination, allocating tasks based on individual behaviour or characteristics, and monitoring or assessing employee performance.
Certain Annex III systems may fall outside the high-risk category where the Article 6 conditions are satisfied, including the absence of a significant risk and material influence on decision making. Profiling of natural persons has a specific rule, as a human making the final decision does not automatically remove high-risk classification.
Providers of qualifying high-risk systems face requirements concerning risk management, data governance, technical documentation, record keeping, information for deployers, human oversight, accuracy, robustness and cybersecurity. Applicable conformity assessment, registration and related requirements must also be considered.
-
AI Transparency Requirements
People must receive specified information about certain AI uses.
Article 50 of the EU AI Regulation requires providers of systems designed to interact directly with people to ensure that people are informed that they are interacting with AI, unless this is obvious in context. It also contains obligations concerning the marking of synthetic content and disclosure of specified AI generated or manipulated material, subject to exceptions.
For example: A recruitment chatbot illustrates the interaction rule. The provider must address the required disclosure in the system’s design. An employer implementing it should check how the notice works in its own setting. This is separate from the information duties associated with high-risk employment decisions.
Dates & Legal Development EU AI Act
The 2026 amendment postponed the relevant Annex III high-risk requirements from the original August 2026 timetable to December 2, 2027. This postponement does not suspend obligations that already apply, including relevant transparency, AI literacy and prohibited practice rules.
Systems already on the market or in service require a separate assessment under Article 111. Existing systems are not all treated identically, and changes to a system may affect the applicable transitional position.
| Date | Development |
| August 1, 2024 | EU AI Act entered into force. |
| February, 2 2025 | AI literacy and initial prohibited practice rules began to apply. |
| August 2, 2025 | General purpose AI model obligations began to apply, subject to transitional provisions. |
| July 27, 2026 | AI Omnibus amendment entered into force. |
| August 2, 2026 | General application date, including relevant transparency obligations, subject to exceptions. |
| December 2, 2027 | Requirements for qualifying Annex III high-risk systems, including employment uses. |
| August 2, 2028 | Later application for relevant product related high-risk requirements. |
AI and European Works Councils
The European Works Council is governed by the EU EWC Directive and applies to companies with at least 1,000 employees across EU member states and at least 150 employees in each of two or more member states.
It operates at the transnational level, meaning the European Works Council only deals with matters that affect employees across multiple countries.
What makes an AI decision transnational, up for consultation with the European Works Council, is for example when a group company proposes a common AI recruitment platform for operations in the Netherlands, Germany and France. This group proposed decision may require European Works Council (EWC) consultation. Changes to recruitment arrangements and employee data processing may also trigger Works Council procedures per country.
AI Focus Areas for EWCs
Under Article 26(7) of the EU AI Act, employers must inform employee representatives and workers before putting a high-risk AI system into use in the workplace.
The EWCs and national Works Councils (such as the Works Councils in the Netherlands) hold rights to receive information and be consulted before major technological changes or automation projects will be implemented. The core focus areas regarding AI for the European Works Council are:
Focus 1. Workplace Surveillance & Privacy
Ensuring AI algorithms do not unfairly track pace, route calls, or micromanage workers in violation of GDPR and local privacy laws.
Focus 2. Impact Assessments
Demanding algorithmic and organisational impact assessments before deployment to evaluate risks to job security, health, and working conditions.
Focus 3. AI Literacy & Training
Advocating for mandatory employee training policies in order for employees to understand how AI decisions are made and how to work alongside automated systems.
Focus 4. Transnational Governance
Using the EWC structures to establish company-wide or group-wide framework agreements rather than negotiating fragmented, tool-by-tool rules across different EU Member States.
Actions Central Management: Preparing EWC Consultation on AI
When an AI project requires European Works Council involvement, central management and HR should prepare the information and consultation process before implementation. The following steps support to explain the proposed decision and coordinate EWC involvement with any national employee representation procedures.
Step 1. Explain the Proposed European Decision on AI
Central management should explain to the European Works Council why the group proposes to introduce AI, which countries and employee groups will be affected, and the expected consequences for employees.
The information should include:
- The business purpose and proposed implementation timetable.
- Expected changes to jobs, staffing, working methods and employee monitoring.
- Responsibilities of headquarters, suppliers and local management.
- Decisions proposed at group level and matters to be decided locally.
Step 2. Coordinate European Works Council Consultation and Local Works Council Consultation
Central management and local HR teams should identify which matters require EWC consultation and which require involvement of national Works Council consultation. A favourable EWC opinion does not replace any consent required from a national Works Council. Equally, completing a national procedure does not fulfil the EWC consultation requirements.
Step 3. Establish the Consultation Timetable Before Implementation
Before setting the rollout date, central management and HR should map the proposed group and local decisions, identify the employee representative bodies involved, and establish the applicable procedures.
Human in Progress supports employers and HR professionals in reviewing HR processes, preparing internal policies and coordinating European and local Works Council involvement. Please contact us to discuss the preparation required within your organisation.
