EU AI Act compliance for AI hiring in France

What makes hiring AI high-risk?

Under EU AI Act Annex III, point 4(a), AI systems intended for the recruitment or selection of natural persons are classified as high-risk, in particular to place targeted job advertisements, to analyse and filter applications, and to evaluate candidates. This covers CV filtering, automated interviews, and candidate scoring.[1] Prohibited practices have been enforceable since 2 February 2025, and breaches can attract fines up to EUR 35,000,000 or 7% of global turnover.[3]

CSE consultation (operative now)

Employee-representative consultation is already operative under national law, independent of the EU AI Act deadlines, and this applies in France, Germany, Belgium, the Netherlands, and other jurisdictions.[5] In France, the Comité social et économique (CSE) must be consulted when introducing new technology and candidate-evaluation methods, and skipping that consultation can trigger delays and legal challenges.[6] In practice, you must plan and document the CSE consultation before launching an AI interview tool.

National data-protection and anti-discrimination angle

France applies the GDPR as the RGPD, with the CNIL as supervisory authority. The CNIL has published guidance on automated decision-making in recruitment and data minimisation, and high-risk automated candidate evaluation typically requires a DPIA (AIPD). On the discrimination side, the Défenseur des droits oversees hiring discrimination and can field complaints when AI selection produces discriminatory outcomes. Human oversight and bias monitoring are therefore a requirement of national law, not only the EU AI Act.

Deployer obligations checklist

As an employer-deployer, here is what you have to document under Article 26 and related articles:

• Human oversight: assign reviewers with the authority and training to override AI rankings (Articles 14 and 26(2)).[4]
• Event logging: keep automatically generated logs for at least six months (Articles 12 and 26(6)).[4]
• Worker notification: inform workers and their representatives before deployment (Article 26(7)) and consult the CSE.[4][5]
• Individual notice: inform individuals subject to decisions and ensure AI-interaction transparency (Articles 26(11) and 50).[4]
• Fundamental rights impact assessment: run it where required (Article 27) and keep it with your DPIA.[4]

How Intrvio's trust stack maps to these

Intrvio turns your deployer evidence into a by-product of daily operations. It provides the provider Annex IV technical file, a DPIA helper for high-risk systems, immutable audit logs retained for at least six months, candidate notice text, and human-oversight steps. EU data residency and security posture are documented on the Security and Trust Center pages.

What to ask any vendor

Risk-classification rationale, bias-testing methodology, logging and traceability guarantees (≥6 months), human-oversight controls, candidate notice text, EU data residency, and change-notification obligations. For the full pillar overview, see our EU AI Act compliance guide.

This page is not legal advice; work with your in-house legal and compliance team.