If your company uses an ATS that filters applications, a tool that scores interviews, or a people analytics platform that evaluates performance, the right question is not "does this apply to us?". It is: is it a high-risk system, and what should I do before someone asks? The short answer: almost certainly yes, the EU obligations arrive on 2 December 2027, but the Italian part of compliance is enforceable today.
Why recruiting is almost always "high-risk"
Annex III, point 4 of Regulation (EU) 2024/1689 lists as high-risk the systems intended to:
- recruit or select natural persons — targeted job advertising, analysing and filtering applications, evaluating candidates;
- make decisions on working conditions, promotion and termination;
- allocate tasks based on individual behaviour or personal traits;
- monitor and evaluate the performance and behaviour of workers.
Article 6(3) provides a derogation: an Annex III system is not high-risk if it poses no significant risk — for instance because it performs a narrow procedural or purely preparatory task. Note the closing clause, though: a system that performs profiling of natural persons is always considered high-risk, whatever the task. An engine that ranks candidates by score profiles them. In recruiting practice, the derogation applies far less often than vendors imply — and whoever invokes it must document the assessment and register under Article 49(2). That is a question to put in writing at purchase time.
What is already prohibited and already mandatory in 2026
The postponement left three HR-relevant points untouched.
- Emotion recognition: prohibited. Article 5(1)(f) bans systems inferring emotions in the workplace, except for medical or safety purposes. It has applied since 2 February 2025 and covers video interviews with "tone of voice" or micro-expression analysis. It sits in the top penalty tier: up to €35 million or 7% of worldwide turnover.
- AI literacy (Art. 4). Whoever operates the tool must have adequate competence. Regulation (EU) 2026/1744 reframed its scope in terms of measures supporting skills development, but did not delete it: a recruiter who does not know how the score is weighted cannot supervise anything.
- Transparency (Art. 50), from 2 August 2026. If the first contact with a candidate runs through a chatbot, the candidate must be able to tell they are interacting with a machine.
Italian law did not wait for Europe
This is the part most companies miss. Even setting the AI Act aside, the use of automated systems in the employment relationship is already regulated in Italy:
- Disclosure on automated systems — Article 1-bis of Legislative Decree 152/1997, introduced by Legislative Decree 104/2022 (the transparency decree) and amended by Decree-Law 48/2023 converted into Law 85/2023, requires employers to tell workers and their representatives about fully automated decision or monitoring systems affecting hiring, management, task allocation, surveillance and evaluation: purposes, operating logic, data categories and parameters, control measures and who is responsible for the system. The word "fully" narrows the scope compared with the 2022 text, but it is not a free pass: a purely formal human step — one click confirming a ranking that has already been produced — does not turn the system into a non-fully-automated one.
- Remote monitoring — if the tool even potentially allows monitoring of workers' activity, Article 4 of Law 300/1970 applies: it requires a union agreement or authorisation from the labour inspectorate.
- GDPR — legal basis, minimisation, CV retention periods, privacy notice and, where the decision is solely automated and produces legal or similarly significant effects, Article 22 with the right to human intervention, explanation and contestation. (A revision of Article 22 sits in the data Digital Omnibus, still under negotiation: it is not law and should not be assumed.)
- Law no. 132 of 23 September 2025 — Article 11 requires AI at work to be used safely, reliably and transparently, without discrimination, and restates the duty to inform workers in the cases covered by Article 1-bis; Article 12 sets up, at the Ministry of Labour, the Observatory on the adoption of AI systems in the world of work. The implementing package was approved by the Council of Ministers on 10 June 2026.
The operational checklist
| # | Action | Reference |
|---|---|---|
| 1 | Inventory HR tools with AI components, including modules enabled by default by the vendor | prerequisite for everything |
| 2 | Establish your role: almost always deployer, but you become a provider if you rebrand or substantially modify the tool | Arts. 3 and 25 |
| 3 | Ask the vendor, in writing: Annex III classification, instructions for use, any documented Art. 6(3) derogation, bias mitigation measures | Arts. 6(3) and 49(2) |
| 4 | Prepare the disclosure to workers and representatives and check whether a union agreement is needed | Art. 1-bis D.Lgs. 152/1997; Art. 4 Law 300/1970 |
| 5 | Assign human oversight to people with the competence, training and authority to overturn the outcome | Art. 26(2) (from 2027) |
| 6 | Ensure input data is relevant and representative, and keep logs for at least 6 months | Art. 26(4) and (6) (from 2027) |
| 7 | Measure selection rates by group and document non-discrimination testing | Art. 11 Law 132/2025; anti-discrimination law |
| 8 | Inform candidates that they are subject to the system | Art. 26(11) (from 2027); already today via GDPR |
Two clarifications that save time. The FRIA under Article 27 does not fall on private employers: it covers bodies governed by public law, private entities providing public services, and the Annex III systems in points 5(b) and (c). The GDPR DPIA, by contrast, is almost always required in personnel selection. And from 2 December 2027 Article 26(7) applies: before putting a high-risk system into service at the workplace, the employer must inform workers' representatives and the affected workers.
The timeline, one line per date
| Date | What it means for HR |
|---|---|
| 2 February 2025 | Ban on workplace emotion recognition; AI literacy |
| 2 August 2026 | Transparency (Art. 50); supervision and penalties fully operational |
| 2 December 2027 | High-risk obligations under Annex III, including point 4 (employment) |
| 2 August 2028 | High-risk systems embedded in Annex I products |
| already today | Art. 1-bis D.Lgs. 152/1997, Art. 4 Workers' Statute, GDPR, Law 132/2025 |
Where to start
The cheapest way to face 2027 is to find out now how many AI-enabled HR tools are already in the building, and which of them breach an Italian rule today rather than a European one. An independent gap assessment scoped to HR — inventory, roles, disclosures, union agreements, human oversight — costs a fraction of redoing a contested selection process, and produces exactly the file an authority will ask to see.