Employment is one of the high-risk areas in the EU AI Act. But the real issue starts before classification: discrimination arises from the effect of a system rather than its intent, and a company that never measures the effect has nothing to show when it is asked.
Most hiring tools do not use gender, age or ethnic origin directly, and companies conclude from this that they have cleared the risk. But discrimination arises from the effect of the system, not its intent.
Even without seeing the protected characteristic, a system can reach the same outcome through proxies for it:
If the system was trained on your past hiring decisions, it may have learned the imbalances in them. The tool then reproduces the existing pattern efficiently — while the company reads the result as "objective measurement".
None of this is detectable by reading the system's code. It is detected by measuring the difference in pass rates between groups and recording that measurement with a date. Without the measurement, a company facing a complaint has nothing to show: the assertion "we did not discriminate" remains an assertion with nothing behind it.
The form below gathers that measurement and the obligations around it into a single document: risk class, data protection, discrimination screening, human oversight and candidate notice.
| Basis | Subject | What it means in practice |
|---|---|---|
| AI Act Annex III (4) | High risk | Employment and worker management |
| AI Act Art. 6(3) | Derogation | Unavailable where there is profiling |
| AI Act Art. 26 | Deployer duties | Oversight, input quality, logs, information |
| AI Act Art. 26(7) | Worker information | Informing those affected and their representatives |
| AI Act Art. 27 | FRIA | Fundamental rights impact assessment |
| GDPR Art. 22 | Automated decisions | Human intervention and right to contest |
| GDPR Art. 35 | DPIA | Required for high-risk processing |
| GDPR Art. 13–14 | Information duties | Telling candidates how data is processed |
| GDPR Art. 9 | Special categories | Risk of indirect inference |
| Equality law | Equal treatment | Effect-based, not intent-based |
Provisions reflect the text as at the date this page was prepared and should be confirmed against the version in force.
Complete a separate one for each system. Copy it or download it as markdown. No sign-up.
# AI IN HIRING — DISCRIMINATION RISK ASSESSMENT AND CANDIDATE NOTICE
Document code: AIA-HR-05 · Version 1.0 · Classification: Internal
Assessment: ……/……/20…… Renewal: annually and on every model change
PART A — SYSTEM RECORD
A.1 System / tool name: [……]
A.2 Provider: [……]
A.3 Place in the process: ( ) CV screening ( ) Ranking ( ) Video analysis
( ) Test scoring ( ) Other
A.4 Effect on the decision: ( ) Determinative ( ) Advisory ( ) Preparatory
A.5 Candidates processed per year: [……]
A.6 Any candidates located in the EU: ( ) Yes ( ) No
A.7 Your role: ( ) Deployer ( ) Provider ( ) Deemed provider (Art. 25)
PART B — RISK CLASS AND OBLIGATIONS
B.1 Employment and worker management falls within Annex III; HIGH-RISK as a
rule.
B.2 Derogation (Art. 6(3)) — arguable only if the system does not materially
influence the outcome. BUT where the system PROFILES candidates the
derogation is unavailable. Much CV ranking and scoring is profiling.
B.2.A Does the system profile candidates? ( ) Yes -> no derogation ( ) No
B.2.B If relying on it, is written reasoning attached? ( ) Y ( ) N
B.3 DEPLOYER OBLIGATIONS (Art. 26):
B.3.A Use in accordance with the instructions for use ( )
B.3.B Competent, trained human oversight assigned ( )
B.3.C Input data relevant and sufficiently representative ( )
B.3.D Retention of system logs ( )
B.3.E INFORMING AFFECTED WORKERS AND THEIR REPRESENTATIVES ( )
B.3.F Reporting serious incidents and risks ( )
B.4 Fundamental rights impact assessment (FRIA — Art. 27):
( ) Required ( ) Not required — reasoning: [……]
PART C — DATA PROTECTION
C.1 Legal basis: [……]
(Consent is contested in employment; whether it is freely given is
open to challenge.)
C.2 Are candidates told AI is used and at which stage?
( ) Y ( ) N (GDPR Art. 13-14)
C.3 Any solely automated decision? ( ) Yes ( ) No
If yes, GDPR Art. 22: human intervention, point of view, contest.
C.4 Does the system INDIRECTLY infer health, disability, ethnic origin?
( ) Y ( ) N (video and voice analysis carry this risk)
C.5 Candidate data retention period: [……]
C.6 DPIA carried out? ( ) Y ( ) N
PART D — DISCRIMINATION RISK TEST
D.1 Equal treatment: discrimination arises from the EFFECT of the system,
not its INTENT.
D.2 INDIRECT DISCRIMINATION — proxies for a protected characteristic:
D.2.A Address / postcode ( ) In use
D.2.B School attended ( ) In use
D.2.C Career gaps (parental leave) ( ) In use
D.2.D Photograph, video image, voice ( ) In use
D.2.E Name ( ) In use
D.2.F Age or year of graduation ( ) In use
D.3 OUTCOME-DIFFERENCE MEASUREMENT (pass rate):
Group breakdown | Applied | Passed | Rate | Difference
[……] | | | |
[……] | | | |
D.3.A Measurement period: [……]
D.3.B Action taken where a material difference is found: [……]
D.4 If trained on your past hiring decisions, the system may have learned
past imbalances. Checked? ( ) Y ( ) N
PART E — HUMAN OVERSIGHT
E.1 Person taking the final decision: [……]
E.2 Can that person OVERRIDE the recommendation? ( ) Y ( ) N
E.3 Cases in the last [PERIOD] where it was overridden: [……]
(A figure near zero suggests oversight has become nominal.)
E.4 Has the overseer been trained on the system's limits? ( ) Y ( ) N
E.5 Is a rejected candidate's file seen by a human? ( ) Y ( ) N
PART F — CANDIDATE NOTICE (SAMPLE)
"An AI-assisted [SYSTEM TYPE] is used at the initial screening stage of your
application. It assesses your application against [CRITERIA] and produces a
recommendation. The final decision is taken by [FUNCTION]; the
recommendation is not determinative on its own. Your personal data is
processed on the basis of [LEGAL BASIS] and retained for [PERIOD]. You have
the right to request human review, to express your point of view and to
contest the decision. Contact: [……]"
F.1 Published on the job posting / application form? ( ) Y ( ) N
PART G — DECISION AND SIGNATURE
G.1 ( ) Cleared ( ) Cleared subject to conditions ( ) Not cleared
G.2 Conditions / reasoning (mandatory): [……]
G.3 Next review date: [……]
SIGNATURE: Assessed by (HR) / Data protection officer / Legal review /
Approved by
This form is general in nature and does not constitute legal advice.
Employment and worker management falls within Annex III, so systems used there are high-risk as a rule. Art. 6(3) provides a narrow derogation, but it closes where the system profiles candidates — which much CV ranking and scoring does.
Transparency obligations require candidates to know how their data is processed, including that AI is involved and at which stage. Deployer obligations additionally require informing affected workers and their representatives.
There can be. Discrimination arises from effect. Postcode, school, career gaps, photographs and names can reflect a protected characteristic indirectly, which is why pass-rate differences between groups must be measured.
Only where the oversight is real. Where the recommendation is never overridden in practice, oversight may be assessed as nominal — which is why the form asks for the override count.
The application date for high-risk obligations was postponed. But data protection and employment law obligations apply today and call for substantially the same records, so the preparation is not postponed with them.
In a twenty-minute preliminary call we look at the tools you use and work out the profiling determination and the measurement breakdowns. If your exposure is low, we tell you that clearly too.
Reserve your spot for an online call The call is online · the form is yours either way