All resourcesGuide

Does the EU AI Act apply to AI in hiring and payroll?

Short answer: if you use AI to help decide who gets hired, how people are evaluated or managed, or how shifts and pay are set, it is very likely "high-risk" under the EU AI Act. From 2 December 2027 you will need to show documented evidence of how that AI is governed. Running payroll on its own is not caught. What counts is whether the AI decides something about a person. The team it sits in makes no difference.

What the EU AI Act treats as "high-risk" in people decisions

The EU AI Act singles out a set of uses it considers high-risk because they affect people's livelihoods. One of them, Annex III point 4, covers AI used in "employment, workers' management and access to self-employment." In practice that means an AI system is likely high-risk if it helps to:

  • advertise roles, filter CVs, or evaluate candidates;
  • decide terms of work, promotion, or termination;
  • allocate tasks or shifts based on a person's behaviour or characteristics;
  • monitor or score worker performance.

This is not limited to employees. Draft Commission guidance extends it to work-related contractual relationships generally, so freelancers, platform workers, and the self-employed are included. What matters is the decision the AI feeds into. The kind of contract the person is on does not change that.

Hiring: almost always in scope

If AI touches your recruitment, assume it is high-risk until you have confirmed otherwise. The clearest cases are the everyday ones: an applicant tracking system that ranks or scores candidates, a CV-screener that filters applicants, a tool that evaluates video interviews or assessments, and targeted job advertising tied to a specific vacancy.

What tends to fall outside: an onboarding chatbot that only answers questions, employer-branding ads not linked to a particular role, and training quizzes that give learning feedback without influencing a decision. What puts a tool in scope is whether it shapes who gets hired, promoted or let go.

Most HR and talent teams already take this as read. The danger is the team that assumes it does not.

Payroll and finance: it depends what the AI decides

This is where many teams wrongly rule themselves out. "We just run payroll, the AI rules can't apply to us." Sometimes true, often not, and the difference is specific.

Processing payroll is just administration: calculating gross-to-net, applying tax codes, paying people what their contract says. On its own it is not high-risk. But the moment AI starts to decide or influence what people get, the picture changes. Draft Commission guidance points to examples that are clearly high-risk:

  • AI that dynamically sets worker pay from ratings, completion times, or acceptance rates;
  • shift schedulers that allocate work from behavioural signals, affecting earnings and progression;
  • systems that score or rank workers on performance, which then feed pay, bonus, or retention decisions.

So for a payroll or finance team, the answer comes down to what your tools actually do. Tools that only calculate and pay out are probably fine. Tools that rank people, rate them, or set what they earn are probably caught. Sitting in finance rather than HR does not change that.

"Does a human in the loop make us exempt?"

Usually not. The Act has a narrow filter (Article 6(3)) that can take a system out of high-risk if it only performs a limited, preparatory task and does not meaningfully drive the decision. It sounds like an easy way out, and it rarely is.

The filter cannot be used for systems that profile individuals. Draft guidance notes this removes most recruitment, performance-management, and task-allocation tools from the exemption, because ranking and scoring people is profiling. Adding a human reviewer at the end does not, by itself, change the classification either; if the AI shapes the decision, it is in scope regardless of who signs it off.

You might claim it for a genuinely trivial tool, as long as you write down why. It is not a default you can lean on.

When does this apply?

The high-risk obligations (the documented governance, logging, human oversight, and transparency a system in scope must have) now apply from 2 December 2027. They were originally due on 2 August 2026, but the EU's Digital Omnibus deferred them; that reform entered into force on 27 July 2026.

A couple of things get misread here. The deferral is a deadline, not a reprieve. Building the evidence for a high-risk AI system takes months, and the systems are already in use. And it does not cover everything. Some obligations are already live: the Act's transparency duties took effect on 2 August 2026, on a separate track from the high-risk timeline.

In practice the question usually turns up in a procurement review or a security questionnaire first. For most teams that is the deadline that bites, not the one in 2027.

How to tell if you're in scope, and what you'll need to show

A quick test. If you answer yes to any of these, assume the system is high-risk and plan to document it:

  • Does it rank, score, or filter people: candidates, workers, or applicants?
  • Does it influence who is hired, promoted, allocated work, or let go?
  • Does it set or adjust what people are paid, or how shifts are assigned?
  • Could a person be materially worse off if it gets the answer wrong?

Where the answer is yes, what an auditor or customer will expect is not a policy document but evidence behind each decision: who provides human oversight and what authority they have, the logs the system keeps, its accuracy and known limitations, the bias testing done, the records kept, and the notices given to the people affected. The hard part is not using AI. It is being able to prove, on the day someone asks, how you govern it.

That is the gap most teams find only when someone asks. Capturing each AI-assisted decision as a signed-off evidence pack (structured, versioned, and ready to send) means the answer is ready before anyone asks for it.

A note, and sources

This is general information, not legal advice. Classification turns on the specifics of your system and use case, and the detailed Commission guidelines referenced here were still in draft at the time of writing. For a binding view on your own tools, take specialist advice.

Sources

Frequently asked questions

Does the EU AI Act apply to AI used in hiring?

Almost always. AI that ranks, scores, or filters candidates, evaluates interviews, or targets job ads to a specific vacancy falls under Annex III as high-risk.

Is payroll software covered by the EU AI Act?

Only if it decides or influences what people get. Calculating gross-to-net is not high-risk; AI that sets pay, allocates shifts by behaviour, or scores workers is.

When do the EU AI Act high-risk rules take effect?

From 2 December 2027, after the Digital Omnibus deferred them from 2 August 2026. Some transparency duties already apply from 2 August 2026.

Does having a human review the AI decision make us exempt?

Usually not. The Article 6(3) exemption cannot be used for systems that profile people, which covers most hiring and performance tools, and a human sign-off does not change the classification.

Audit Evidence turns each AI-assisted decision into a structured, versioned, audit-ready evidence pack, aligned to the EU AI Act, ISO 42001, NIST AI RMF, and NYC Local Law 144. Build the documentation now, while there is time to do it properly. 14-day free trial, no card needed.

Start your free trial →

Not sure which rules apply to your AI? Answer six questions and see which obligations apply to your organisation.

Take the self-assessment →

Want to see what a completed evidence pack looks like first? The Meridian Financial Group demo pack covers EU AI Act Article 26 deployer obligations in full.

See a completed evidence pack →