AI tools promise faster preselection, better candidate outreach and less administrative effort. At the same time regulatory pressure is increasing in the EU: The EU AI Act (Artificial Intelligence Act) is coming into force step by step and also affects applications in HR. For Austrian employers this means: At the latest by 2 August 2026 recruiting processes should be set up so that they are explainable, fair and documentable – and for particularly sensitive systems (e.g. automated suitability assessment) further obligations apply from 2 August 2027 relevant.
In this article you get a practical checklist: Which AI in recruiting is considered "sensitive", which deadlines are important, which questions you should ask your provider – and which organizational measures are already worthwhile in 2026, even if you (still) don't have to comply with all high‑risk rules.
Why AI in recruiting is now a compliance issue
Recruiting is not an arbitrary process: decisions about access to employment affect fundamental rights, equal opportunities and often sensitive personal data. AI can be helpful here – but it can also amplify risks, for example when training data are biased or when a scoring model weights factors in an indirectly discriminatory way. This is exactly where the EU AI Act comes in: it classifies certain AI applications by risk and links obligations for providers and users ("deployers") to those classifications.
Austria faces additional practical pressure: the labor market remains tight in many areas (skilled workers, care, IT), and companies are trying to speed up processes. At the same time candidates' expectations for transparency and fairness are rising. If you use recruiting AI, you should therefore be able to answer not only "am I allowed to do this?" but also "can I explain, substantiate and take responsibility for it?"
AI Act in three dates: What applies from when?
- Since 2 February 2025: Certain parts (including Chapters I/II) are already in effect – incl. obligations around AI Literacy (AI competence) and prohibitions of certain practices.
- From 2 August 2026: The AI Act is generally applicable (standard cutoff date).
- From 2 August 2027: Certain rules for classification as "high-risk" (Art. 6(1) and related obligations) take effect later – relevant for many recruiting use cases that fall under "Employment, workers management and access to self-employment".
Which AI in recruiting is particularly risky?
In practice the range extends from "harmless" to "highly sensitive":
- Less critical: AI text suggestions for job ads, summaries of interview notes, internal FAQ chatbots for HR (depending on the setup, still pay attention to data protection/transparency).
- Medium risk: Matching tools that map profiles to requirements, automatically rank candidates or provide "recommendations". This can tend toward high-risk – depending on whether it effectively prepares selection decisions.
- High risk: Systems that assess suitability, reliability or performance (scoring), video/audio analysis, emotion recognition, automated rejection/shortlisting without sufficient control. You should be particularly strict here.
Practical rule of thumb: The closer the system is to a decision about acceptance or rejection the more you need proper documentation, human oversight and an explainable procedure.
Checklist 2026: How to prepare in a structured way
1) Inventory: Where do you actually use AI in HR?
- List all tools and features (ATS, applicant management, CV parsing, matching, chatbots, assessment platforms).
- Document for each tool: purpose, data types, decision influence (informative vs. decisive), provider, hosting (EU/non-EU), interfaces.
2) Risk scan: What could be discriminatory or non-transparent?
- Which attributes are included (directly/indirectly)? Could they disadvantage protected groups?
- Are there 'proxy' effects (e.g. postal code as an indirect indicator)?
- How explainable is the result for HR and for candidates?
3) Human-in-the-loop: Clear rules for human oversight
- Define which decisions are never to be made fully automatically (e.g. automatic rejection).
- Set review steps: who reviews, according to which criteria, how is it documented?
- Create escalation paths (e.g. if the tool shows 'anomalous' patterns).
4) Data & data protection: Think GDPR through properly
- Check legal basis, information obligations, retention periods, and data processing agreements.
- Minimize data: Only use what you truly need for the purpose.
- For sensitive setups: consider a data protection impact assessment (DPIA).
5) Provider questions: What you should get in writing
- Which data were used for training (as far as possible)?
- What measures exist against bias? Are there test reports, benchmarks, audit information?
- How are logs/decision bases stored? Can you reconstruct decisions?
- How does human oversight work in the tool (override, justification fields, versioning)?
- Where are data processed (region), who is a subprocessor?
6) AI literacy: Make the HR team fit (relevant since 2025)
AI competence does not mean everyone has to be a data scientist. It's about practical skills: recognizing limits, understanding bias risks, not taking results at face value, and being able to explain the key terms. Plan short trainings for HR and managers (e.g. 60–90 minutes), including case studies from your process.
7) Documentation: Record the 'why'
- Why are you using the tool? Which problem does it solve?
- Which risks were identified – and how are they mitigated?
- Which KPIs do you monitor (e.g. hit rate, dropout rates, diversity indicators without personal references)?
Concrete examples: What Austrian SMEs often overlook
- Job ad optimization: AI can unintentionally 'gender' or de-gender phrasing, or exclude certain target groups. Use checklists and counter-reading.
- CV parsing: If parsing performs worse on atypical CVs, a structural disadvantage arises. Test with realistic examples.
- Automated ranking: A ranking appears objective, but is often just a weighting of assumptions. Make the weightings transparent and review them regularly.
Roles in the AI Act: providers, operators ('deployers') and HR practice
In practice many companies use an external applicant management system or an assessment platform. The distribution of roles is important:
- Provider develops or provides the AI system. Depending on classification, they must meet technical requirements (e.g. risk management, data governance, documentation).
- User/Operator (Deployer) deploys the system in the company. For HR this means: you must ensure that the tool is operated responsibly (with human oversight, appropriate processes, information of the affected persons, monitoring).
Even if the provider advertises as 'AI Act-compliant', employers still have to ask: Does the tool fit your process? The same system can be merely supportive in one setting (lower risk), but in another actually decide on rejections (higher risk). Therefore a clear process definition pays off in 2026 – before simply 'switching on' features.
Transparency in recruiting: What candidates should know
Regardless of the legal technicalities, candidates increasingly expect clarity about whether and how AI is used. This reduces friction and can improve the candidate experience. Practical measures:
- Short notice in the privacy policy or in the application form: Which automated aids are used (e.g. CV parsing, matching)?
- Contact option for inquiries (HR address) and a clear statement that decisions are not made purely automatically.
- Internal guideline for recruiters: How AI results are used – and when they are ignored?
Austria special: equal treatment, works council and practical pitfalls
In Austria you should also think about the 'classic' topics in recruiting AI that often come too late in projects:
- Equal treatment: Check whether criteria or data points could indirectly lead to disadvantages. This applies especially to rankings, automatic preselection and standardized assessments.
- Works council: When new systems are introduced that affect employees (e.g. internal mobility, performance or potential assessments), co-determination may become relevant. Even if recruiting appears external: processes that later move into 'workers management' (e.g. internal transfers) should be coordinated early.
- Documentation obligation in everyday practice: The most important lever is not a 40-page concept, but a continuous audit trail: Which decision was made, on the basis of which information, and how AI was used in the process?
Mini-template: AI tool fact sheet (copyable for HR)
- Name/Provider: …
- Use case/Area: Job ad / CV parsing / Matching / Assessment / Interview support
- Decision influence: only recommendation / ranking / automatic action
- Data sources: CV, cover letters, profiles, test results, notes
- Human oversight: Who reviews? Which overrides are mandatory?
- Bias checks: Which tests? How often? Who documents?
- GDPR: DPA in place? Subprocessors? Retention periods?
FAQ: Short answers for practice
"Am I allowed to use AI to sort applications?"
Yes – but the more the system influences selection decisions, the more important human oversight, transparency and documented risk measures become.
"Is it enough if the provider says they are compliant?"
No. You also need process rules (human-in-the-loop), an explainable application and written evidence of how you manage risks.
"What is the most sensible immediate measure for 2026?"
A tool inventory plus a standardized fact sheet per system. That way you can prioritize risks and explain decisions later.
Further reading on jobspot.at
- Austrian labor market in spring 2026: What job seekers can do strategically now
- Tips for the interview
- Becoming a web developer: How to get into the IT industry
Conclusion: start in 2026, fine-tune in 2027
Even though many high‑risk obligations for certain AI systems take effect later: those who start in 2026 with an inventory, human oversight, clean documentation and AI competence reduce risks – and build trust with candidates. This is especially important for Austria: in a tight labor market, those who recruit fairly, quickly and transparently win.
CTA: Want to find suitable jobs or apprenticeships right now? Browse the latest offers on jobspot.at and set up search profiles – that way you won't miss an opportunity when the next suitable job goes online.
