Is my hiring AI really high-risk?

Yes. AI that evaluates candidates, filters applications, or places targeted job ads is high-risk under EU AI Act Annex III point 4(a), regardless of company size.[1]

How does the AGG connect to AI hiring?

The Allgemeines Gleichbehandlungsgesetz (AGG) is Germany's anti-discrimination law. If AI-driven selection produces indirect discrimination based on protected characteristics, the employer remains liable under the AGG. Human oversight and bias monitoring are therefore required not only by the AI Act but by the AGG as well.[8]

Do I have to tell candidates AI is being used?

Yes. Article 26(11) and Article 50 require that individuals subject to a high-risk AI decision are informed. The EU AI Act also requires informing workers and their representatives before deployment (Article 26(7)).[4]

What should I ask a vendor for?

The Annex IV technical file, bias-testing methodology, a ≥6-month log guarantee, human-oversight controls, candidate notice text, and EU data residency. Intrvio's trust stack produces this evidence.

EU AI Act for AI Hiring in Germany

EU AI Act compliance for AI hiring in Germany

Last updated: June 14, 2026

In Germany, AI interview and candidate-evaluation tools are regulated on two layers: high-risk classification under the EU AI Act, and national works council, anti-discrimination, and data-protection law that is operative right now. As the employer you are the deployer and you must document the evidence.

What makes hiring AI high-risk?

Under EU AI Act Annex III, point 4(a), AI systems intended for the recruitment or selection of natural persons are classified as high-risk, in particular to place targeted job advertisements, to analyse and filter applications, and to evaluate candidates. This covers CV filtering, automated interviews, and candidate scoring.[1] Prohibited practices (for example emotion recognition in the workplace) have been enforceable since 2 February 2025, and breaches can attract fines up to EUR 35,000,000 or 7% of global turnover.[3]

Betriebsrat co-determination (operative now)

Works council consultation is already operative under national law, independent of the EU AI Act deadlines, and this applies in Germany, France, Belgium, the Netherlands, and other jurisdictions.[5] In Germany, works councils have co-determination rights (Mitbestimmung) that can effectively block introduction of such a system.[6] In practice, you must involve the Betriebsrat under the Betriebsverfassungsgesetz (BetrVG) before launching an AI interview tool, because skipping that consultation can invalidate the rollout and trigger delays.

National data-protection and anti-discrimination angle

Two more national codes apply. The Allgemeines Gleichbehandlungsgesetz (AGG) prohibits discrimination, and the employer stays liable if AI selection produces indirect discrimination based on protected characteristics.[8] On the data side, the Bundesdatenschutzgesetz (BDSG) governs employment-data processing alongside the GDPR, and high-risk automated candidate evaluation typically requires a DPIA. Human oversight and bias monitoring are therefore a requirement of national law, not only the EU AI Act.

Deployer obligations checklist

As an employer-deployer, here is what you have to document under Article 26 and related articles:

Human oversight: assign reviewers with the authority and training to override AI rankings (Articles 14 and 26(2)).[4]
Event logging: keep automatically generated logs for at least six months (Articles 12 and 26(6)).[4]
Worker notification: inform workers and their representatives before deployment (Article 26(7)) and involve the Betriebsrat.[4][5]
Individual notice: inform individuals subject to decisions and ensure AI-interaction transparency (Articles 26(11) and 50).[4]
Fundamental rights impact assessment: run it where required (Article 27) and keep it with your DPIA.[4]

How Intrvio's trust stack maps to these

Intrvio turns your deployer evidence into a by-product of daily operations. It provides the provider Annex IV technical file, a DPIA helper for high-risk systems, immutable audit logs retained for at least six months, candidate notice text, and human-oversight steps. EU data residency and security posture are documented on the Security and Trust Center pages.

What to ask any vendor

Risk-classification rationale, bias-testing methodology, logging and traceability guarantees (≥6 months), human-oversight controls, candidate notice text, EU data residency, and change-notification obligations. Without these, a vendor leaves you exposed to AGG and EU AI Act risk. For the full pillar overview, see our EU AI Act compliance guide.

This page is not legal advice; work with your in-house legal and compliance team.

FAQ

Yes, in companies that have a Betriebsrat. Introducing AI hiring and performance tools is subject to co-determination (Mitbestimmung) under the Betriebsverfassungsgesetz (BetrVG). This duty is operative now, independent of the EU AI Act timeline, and the works council can effectively block introduction of the system.[5][6]