Is AI in hiring high-risk under the EU AI Act?

Yes. Annex III of the EU AI Act classifies AI used for recruitment, candidate filtering, promotion, and termination as high-risk. That triggers obligations including risk management, data governance, human oversight, transparency, and record-keeping before the system can be deployed.

Can an AI make a hiring decision on its own?

Not for legally significant decisions in the EU and UK. GDPR Article 22 gives individuals the right not to be subject to solely automated decisions with significant effects, so a human must be able to review and override the AI's recommendation.

What does NYC Local Law 144 require?

Employers using an automated employment decision tool for candidates in New York City must have an independent bias audit conducted and published, and must notify candidates that the tool is used and what it assesses. It is one of the strictest US-level disclosure regimes.

Why is explainability a legal requirement here?

Both GDPR and the EU AI Act require that affected people can understand the main factors behind a decision and contest it. If you cannot explain in plain language why a candidate was screened out, you cannot meet the transparency and contestability obligations.

Is this checklist legal advice?

No. It maps common obligations across the EU AI Act, GDPR, EEOC guidance, and NYC Local Law 144 to help you structure your compliance work. A qualified employment and data-protection lawyer should review any live deployment.

AI in Employment Decisions Checklist

AI in employment decisions checklist

Using AI to screen CVs, score interviews, rank candidates, or select people for promotion or redundancy is one of the most heavily regulated AI use cases there is. The EU AI Act treats it as high-risk, GDPR restricts solely automated decisions, the EEOC polices disparate impact, and New York City mandates a published bias audit. This checklist pulls those obligations into one place so you can see whether your deployment is defensible.

How it works

You choose the HR process the AI touches — hiring, promotion, performance, or termination — name the system, and select your jurisdiction. The checklist filters to the safeguards that apply and separates critical ones (human oversight, no solely automated decisions, documented bias testing, candidate notice, explainability, a route to contest, reasonable accommodation, and a completed DPIA) from secondary ones like ongoing drift monitoring and record-keeping. Any unmet critical safeguard flags the deployment as non-compliant.

Tips and notes

Human oversight has to be real. A rubber-stamp reviewer who always accepts the AI’s output does not satisfy Article 22 or the AI Act — the human must genuinely be able to and sometimes does override it.
Test for proxies, not just explicit attributes. Postcode, name, and gaps in employment can stand in for protected characteristics and produce disparate impact even when you never feed the model race or gender directly.
Keep the decision logs. When a regulator or a rejected candidate asks why, you need to reconstruct the main factors — that record-keeping is itself an AI Act obligation.