TLDR: A recent European Union amendment gives recruitment software more time to meet high-risk rules, and Swiss employers hiring in Europe should use it to build inventories, named oversight and vendor evidence.
Recruitment software sits in the high-risk tier of the European Union Artificial Intelligence Act by design
The European Union (EU) Artificial Intelligence Act, Regulation (EU) 2024/1689, sorts artificial intelligence (AI) systems by the harm they can cause, and hiring sits near the top of that scale. Point 4 of Annex III lists as high-risk any AI system intended for recruitment or selection, “in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”. The same point covers systems used to decide on promotion or termination, to allocate tasks based on personal traits, and to monitor or evaluate the performance and behaviour of employees. A curriculum vitae (CV) parser that ranks applicants, a pre-screening chatbot, a video-interview scorer and an advertisement-targeting engine can all fall inside it.
Article 6(3) offers a narrow exit: an Annex III system leaves the high-risk tier when it performs only a narrow procedural task, improves the result of a completed human activity, detects patterns while leaving the assessment to a human, or carries out a preparatory task. The same article closes the exit for the most common recruitment use: an Annex III system “shall always be considered to be high-risk” when it performs profiling of natural persons. A tool that builds a picture of a candidate’s suitability from their data and ranks them on it is profiling, so most screening and matching software stays high-risk.
One use is already banned outright: since 2 February 2025, Article 5(1)(f) prohibits AI systems that infer the emotions of a person in the workplace, with a narrow carve-out for medical and safety reasons. Any interview-analysis feature that claims to read enthusiasm, stress or honesty from a candidate’s face or voice belongs on the switch-off list today, whatever the vendor’s roadmap says.
The Digital Omnibus gave stand-alone high-risk systems until 2 December 2027
The original Act set 2 August 2026 as the date on which obligations for Annex III systems would apply, until the Digital Omnibus on AI changed it: after a provisional agreement reported by Gibson Dunn on 27 May 2026, the European Parliament approved the package on 16 June 2026 with 423 votes in favour, 57 against and 174 abstentions. It was adopted as Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026. Stand-alone Annex III systems, recruitment tools included, now face their obligations from 2 December 2027; high-risk AI embedded in regulated products such as medical devices follows on 2 August 2028.
Orrick’s July 2026 review of the final text confirms that Annex III systems “will now take effect on 2 December 2027 instead of 2 August 2026”. The amending regulation moves the clock and leaves the deployer duties in place: Article 1 of Regulation (EU) 2026/1744 amends Article 25 in point 12 and Article 27 in point 13, and leaves Article 26 in its original wording, so employers can plan against the text adopted in 2024. One obligation that already applies was softened: point 5 of the same Article 1 replaces Article 4, so that “Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff”, a lighter standard than the original duty to ensure a sufficient level of it; recital 8 explains that the original duty would add compliance burden, particularly for smaller enterprises.
| Date | What applies to hiring teams |
|---|---|
| 2 Feb 2025 | Ban on emotion inference at work (Art. 5); artificial intelligence (AI) literacy duty (Art. 4) |
| 16 Jun 2026 | European Parliament approves the Digital Omnibus (423 to 57) |
| 27 Jul 2026 | Regulation (EU) 2026/1744 enters into force; the Article 4 literacy duty becomes a duty to support staff literacy |
| 2 Aug 2026 | Original Annex III date, now replaced |
| 2 Dec 2027 | High-risk duties apply to recruitment AI (Annex III) |
| 2 Aug 2028 | High-risk duties for AI inside regulated products (Annex I) |
Swiss employers fall in scope as soon as the output of their hiring AI is used in the European Union
Switzerland sits outside the EU, and the AI Act reaches across the border anyway. Article 2(1) applies the Act to deployers established in the Union and also to “providers and deployers of AI systems that have their place of establishment or are located in a third country” where “the output produced by the AI system is used in the Union”. A CMS analysis for Swiss companies reads the provision the same way. A Basel life-sciences group ranking candidates for its Munich site, a Geneva bank shortlisting applicants for a Paris branch, or a Vaud medical-technology company screening sales representatives for Lyon all use AI output in the Union. An EU subsidiary using the group’s applicant tracking system (ATS) is a deployer established in the Union in its own right.
The financial exposure is material: under Article 99(4), breaches of operator obligations, deployer duties included, can draw administrative fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, with the lower of the two applying to small and medium-sized enterprises. The calculation runs on group turnover, so a Swiss parent carries the exposure for an EU hiring team’s tool choice.
Swiss law already asks for human review and limits what screening data can contain
Swiss employers start with two domestic rules that point in the same direction. Article 21 of the revised Federal Act on Data Protection (FADP) obliges a controller to inform the person concerned of any decision based exclusively on automated processing that has a legal consequence or a considerable adverse effect. On request, the person may state their point of view and “may request that the automated individual decision be reviewed by a natural person”. An automatic rejection issued by software alone is the textbook case. Article 328b of the Code of Obligations (CO) adds a limit on inputs: the Federal Data Protection and Information Commissioner (FDPIC) explains that an employer may only process data concerning an employee’s suitability for the job or data necessary for the employment contract, a protective rule that holds even where a candidate consents, and that AI-based recruitment may only use data necessary to determine suitability for the particular job.
A third Swiss track began on 12 February 2025, when the Federal Council set out its approach to AI regulation: Switzerland intends to ratify the Council of Europe Convention on Artificial Intelligence and implement it through amendments to Swiss law, with continued work on AI rules in specific sectors such as healthcare and transport. The Federal Office of Communications (OFCOM) states that “The FDJP, together with the DETEC and the FDFA, is to prepare a consultation draft by the end of 2026”, meaning the Federal Department of Justice and Police (FDJP), the Federal Department of the Environment, Transport, Energy and Communications (DETEC) and the Federal Department of Foreign Affairs (FDFA). A Swiss employer that builds its hiring-AI governance to the EU standard now covers its EU exposure, satisfies FADP Article 21 and Article 328b CO, and stands ready for whatever the Swiss draft adds.
An employer preparation plan starts with an inventory of every tool that touches a candidate
The first task is a complete inventory, and it is usually longer than human resources (HR) expects. Sourcing tools that decide which profiles a recruiter sees, job-board targeting that decides which people see an advertisement, ATS ranking modules, chatbots that pre-qualify applicants, assessment and video-interview platforms, scheduling assistants and AI features inside Workday or SAP SuccessFactors all belong on the list. For each, the inventory records the vendor, the hiring stage, the countries where the output is used, whether the tool profiles candidates, and who in the business switched it on. A second category needs attention: general-purpose chatbots that recruiters use informally to compare CVs. Article 25(1)(c) treats a party that modifies the intended purpose of an AI system so that it becomes high-risk as a provider, with the much heavier provider duties that follow. A recruiter pasting fifty CVs into a general chatbot and asking for a ranking is the scenario to stop or formalise.
The second task is human oversight with names attached. Article 26(2) requires deployers to assign oversight to people “who have the necessary competence, training and authority”. In hiring, that means a named reviewer at each automated decision point, trained on how the tool ranks, with real authority to overrule it and the time to do so. Bulk approval of a ranked list removes the reviewer’s practical chance to intervene, while both the AI Act and FADP Article 21 expect a human who can. Employers in pharma and medical technology already know this pattern from computer system validation, where a named person owns each validated system and its deviations; the same logic transfers cleanly to a screening tool, a point Edward Galle develops in its analysis of AI recruiting in regulated industries.
The third task is documentation and notices. Article 26 requires deployers to use the system according to the provider’s instructions, keep input data relevant and sufficiently representative where they control it, keep the system’s automatic logs for at least six months, inform workers’ representatives and affected workers before putting a high-risk system into service at work, and inform candidates that they are subject to a high-risk AI system. Each duty maps onto an artefact an auditor can ask for: the instructions for use on file, a data-relevance note tied to Article 328b CO, a log-retention setting, a works-council briefing record, and a candidate privacy notice that names the tool and explains how to request human review.
| Employer duty | European Union AI Act | Swiss parallel |
|---|---|---|
| Competent human oversight | Art. 26(2) | Federal Act on Data Protection (FADP) art. 21(2) review |
| Tell candidates artificial intelligence is used | Art. 26(11) | FADP art. 21(1) |
| Relevant input data | Art. 26(4) | Art. 328b Code of Obligations (CO) |
| Keep logs, 6 months minimum | Art. 26(6) | European rule only |
| Inform staff representatives | Art. 26(7) | European rule only |
Vendor contracts decide how much of the compliance burden an employer carries alone
Most of the heavy obligations under the Act fall on providers: risk management, technical documentation, conformity assessment and the instructions for use that deployers must follow. A high-risk system must also carry the CE marking (Conformité Européenne), the sign that it has passed conformity assessment before it is placed on the EU market. An employer’s leverage therefore sits in procurement, and the roughly fifteen months between September 2026 and 2 December 2027 cover at least one renewal cycle for most HR software. Every renewal should put five questions to the vendor: does it classify its product as high-risk under Annex III, and if it claims the Article 6(3) exemption, where is the written assessment? What is the plan and date for conformity assessment and CE marking before 2 December 2027? Which bias and accuracy tests has the vendor run, on which populations, and will it share the results? Can the employer export the automatic logs it must keep for six months? Which features infer emotions or personality from voice, video or text, and can they be disabled contractually?
The answers also test the vendor: a provider still vague on its own risk classification this close to the deadline is a poor bet for on-time conformity, and a platform switch in late 2027 would be costly. Edward Galle’s guide to a compliant hiring process under the General Data Protection Regulation covers the data-protection clauses that sit alongside these AI questions, and its briefing on what candidates and HR leaders need to know about AI in hiring sets out the candidate’s side of the same tools.
Edward Galle’s view: regulated employers can reuse the validation habits they already have
Edward Galle’s view, from its HR technology advisory and search work with Swiss pharmaceutical, medical-technology and financial-services employers, is that these companies start ahead of the AI Act because they already run validated systems. Three validation habits transfer directly: a system owner per tool, named in the inventory, mirrors the owner of a validated laboratory or quality system. A change-control step for every new AI feature that a vendor switches on in a release mirrors the change control that governs a validated platform, and it catches the most common source of unplanned high-risk use: features that arrive in a quarterly update of the applicant tracking system. A periodic review of each tool’s outputs by the named reviewer mirrors the periodic review of a validated system, and it produces the evidence an auditor will ask for.
The same view shapes hiring for the work itself. The tasks above call for a specific profile: a person who understands HR processes, reads vendor documentation critically and can run a review cycle. In Edward Galle’s experience, strong candidates often come from computer system validation, quality assurance or HR information systems teams, and the best of them can explain both Article 26 and a Workday or SAP SuccessFactors release note to a hiring manager. Employers that appoint this owner in 2026 give the inventory, the oversight model and the vendor questions a single accountable lead well before December 2027.
Employers that start in 2026 turn a compliance deadline into a better hiring process
HR leaders and talent-acquisition heads should complete the tool inventory before the end of 2026, switch off any emotion-inference feature now, and name an accountable reviewer for each automated decision point. Legal and compliance teams should add the vendor questions to every HR software renewal, map each Article 26 duty to a documented artefact, and align the candidate privacy notice with FADP Article 21 so that one notice serves both Swiss and EU applicants. Executives in Swiss pharma, medical technology and financial services should treat hiring AI the way their organisations already treat validated systems: owned, documented and periodically tested, with group-level visibility of the tools EU teams use.
Edward Galle supports HR teams through its HR consulting and workforce systems (HR IS) services and runs specialist searches for digital, brand-tech and revenue-operations roles in Swiss regulated industries. Professionals with experience in AI governance for HR can submit a CV ou browse current openings.
This article has been reviewed by Haider Alleg, Managing Partner at Kainjoo SA.
References
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Annex III: High-risk AI systems referred to in Article 6(2). AI Act Explorer. https://artificialintelligenceact.eu/annex/3/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 2: Scope. AI Act Explorer. https://artificialintelligenceact.eu/article/2/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 5: Prohibited AI practices. AI Act Explorer. https://artificialintelligenceact.eu/article/5/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 6: Classification rules for high-risk AI systems. AI Act Explorer. https://artificialintelligenceact.eu/article/6/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 25: Responsibilities along the AI value chain. AI Act Explorer. https://artificialintelligenceact.eu/article/25/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 26: Obligations of deployers of high-risk AI systems. AI Act Explorer. https://artificialintelligenceact.eu/article/26/
- Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act). Article 99: Penalties. AI Act Explorer. https://artificialintelligenceact.eu/article/99/
- European Parliament and Council. Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). Official Journal of the European Union, L series, 24 July 2026; entry into force 27 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj
- Gibson Dunn. EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes. 27 May 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
- Morais Leitão. European Parliament approves Digital Omnibus package on AI. 17 June 2026. https://www.mlgts.pt/en/knowledge/legal-alerts/Legal-Alert-European-Parliament-approves-Digital-Omnibus-package-on-AI/26967/
- Orrick. EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes. 29 July 2026. https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes
- CMS. Switzerland to ratify Europe’s landmark AI Framework Convention: what does it mean? 20 February 2025. https://cms.law/en/che/legal-updates/switzerland-to-ratify-europe-s-landmark-ai-framework-convention-what-does-it-mean
- Swiss Federal Act on Data Protection (FADP), Article 21. Duty to provide information in the case of an automated individual decision. In force since 1 September 2023. https://prighter.com/resources/laws/swiss-fadp/fadp/articles/article-21
- Federal Data Protection and Information Commissioner (FDPIC). Data processing by the employer. Undated guidance page. https://www.edoeb.admin.ch/edoeb/en/home/datenschutz/arbeit_wirtschaft/datenbearbeitung-arbeitgeber.html
- Swiss Federal Council. AI regulation: Federal Council to ratify Council of Europe Convention. 12 February 2025. https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-104110.html
- Federal Office of Communications (OFCOM). Artificial intelligence: overview of regulatory approaches. 10 March 2025. https://www.bakom.admin.ch/en/artificial-intelligence
