AI Act Annex III for HR: What Counts as High-Risk and What Compliance Looks Like in August 2026

The EU AI Act Annex III enumerates eight high-risk AI use cases. Two of them are explicitly HR: AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates, and AI systems intended to be used for making decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, for allocating tasks based on individual behaviour or personal traits or characteristics, or for monitoring and evaluating performance and behaviour of persons. If you build, sell, or deploy AI that touches any of these, the high-risk regime applies to you.

The enforcement deadline is August 2, 2026. From that date, providers (the entity that builds and markets the AI) and deployers (the entity that uses it) both have obligations. The obligations are not optional, are not negotiable in procurement, and produce real penalties under EU AI Act Article 99: up to €15 million or 3% of global turnover for non-compliance with high-risk requirements, up to €35 million or 7% for prohibited-practice violations. The deadline is closer than most teams realize.

This guide walks through what counts as Annex III HR-AI (the scope is wider than buyers expect), what does not, what the conformity assessment actually demands, the difference between provider and deployer obligations, and a 6-step readiness plan you can run between now and August 2. It is written for the HR leader, DPO, or compliance owner who has to deliver an Annex-III-ready HR-AI stack on a fixed deadline.

For the broader EU AI compliance framework, start with our AI governance and compliance EU pillar. For the DPIA layer that runs alongside Annex III, see the DPIA template guide. This article is the specific Annex III deep-dive.

The scope is wider than most buyers expect. Annex III HR-AI is not just AI that screens resumes. It is any AI system used for recruitment, selection, performance evaluation, promotion, termination, task allocation, or behavior monitoring of employees. Each item below counts as high-risk; each one triggers the full Annex III obligation set.

What matters is the purpose of the AI in the workflow, not the technology. An LLM that drafts job descriptions is not high-risk. An LLM that filters which candidates a recruiter sees is. An AI that summarizes a meeting transcript is not high-risk. An AI that scores meeting participants on engagement is. The boundary is whether the AI output influences a decision about a natural person's employment.

The EU AI Act distinguishes two roles, and you can be both. The provider is the entity that develops or has developed an AI system and places it on the market under its own name. The deployer (called user in earlier drafts) is the entity that uses the AI system under its authority (except for personal non-professional use). A company that builds its own internal AI is both provider and deployer. A company that buys an AI tool from a vendor is the deployer; the vendor is the provider.

Obligations split between the two. Providers carry the heaviest load: conformity assessment, technical documentation per Annex IV, quality management system, post-market monitoring, EU declaration of conformity, CE marking, registration in the EU database for high-risk AI. Deployers carry: human oversight in line with provider instructions, monitoring of system operation, log-keeping, fundamental rights impact assessment (FRIA) for some Annex III uses, transparency to affected individuals (employees), and incident reporting.

In practice, most HR-AI buyers are deployers. The vendor handles the conformity assessment and technical documentation; you handle the human oversight, monitoring, FRIA, transparency, and incident reporting on your side. If your vendor cannot show their conformity assessment evidence (Annex IV docs, CE marking declaration), you should not deploy them past August 2. The deployer carries downstream risk for the provider's gaps.

August 2, 2026 is a hard deadline. After it, deploying Annex III HR-AI without the 6 deployer obligations in place is a violation that produces fines under Article 99. The window to prepare is closing. The work is not glamorous, but it is bounded: classify each AI deployment, demand provider evidence, document human oversight, set up monitoring and log retention, run FRIA where required, add transparency notices, build an incident pathway.

The vendors who will be there on August 3 are the ones who can hand you the Annex IV package, the conformity assessment evidence, and the CE marking without negotiation. The vendors who are still working on it on August 2 are vendors you should not be deploying in production. Use the next 75 days to do the audit, not to chase deadlines you cannot meet.

The broader pattern across the EU AI compliance landscape (DSGVO, AI Act, NIS2, sectoral rules) is the same: regulators have stopped accepting promises and now require evidence. Your job is not to argue with the regulation; it is to produce the documents the regulation demands, in the order auditors will ask for them. The articles in our AI governance and compliance EU pillar tell you what each document looks like.