HR and recruitment
Hiring is where ordinary AI tools most often become high-risk under the EU AI Act. Screening CVs, ranking candidates and targeting job adverts usually count, including pasting CVs into ChatGPT for a shortlist. Normis helps you find those uses, record how you classified them, and set the rules for everyone who hires.
Where hiring meets the Act
The risk depends on what you use a tool for, not which tool it is. The same assistant can be minimal on Monday and high-risk on Tuesday.
AI that screens, scores or filters applicants usually counts as high-risk. That covers an applicant tracking system's AI match or auto-reject, and pasting CVs into ChatGPT to get a shortlist. Draft Commission guidance goes further: repurposing a general assistant this way may make you responsible as if you had built it.
Letting AI decide who sees a vacancy, such as audience targeting on LinkedIn, Meta or Google, is named in the Act's own list of high-risk employment uses.
Tools that monitor and evaluate how people work, or allocate tasks based on behaviour or personal traits, fall in the same category. Before using high-risk AI at work, you must tell staff and their representatives.
Call or meeting analytics that infer your own employees' emotions from their voice or face are banned, unless for genuine medical or safety reasons. Sentiment scoring of written text is not caught.
Writing with ChatGPT or Copilot is not high-risk. It goes on your register and falls under the general expectation to support your team's AI literacy, nothing more.
AI that books interviews, answers staff questions about policy, or formats a CV without judging it is not high-risk. Register it and move on.
Data protection rules on decisions made solely by automated means, the ban on reading staff emotions, and the expectation to support your team’s AI literacy.
The high-risk duties for businesses using hiring and staff AI: follow the instructions, assign human oversight, keep logs, and tell staff and candidates.
Customers ask how you use AI in procurement questionnaires. See how to answer a customer’s AI questionnaire.
How Normis helps
Tick your tools from a catalogue that includes the recruitment platforms SMEs actually use, then answer a few plain questions about how each one is used.
Publish your AI use policy with your own hiring rule in it, then get every hiring manager to acknowledge it.
Your register, classifications and sign-offs fold into one sealed evidence pack, ready when a customer, auditor or your own board asks how you use AI in hiring.
Honest scope
Normis helps you spot, classify and record high-risk hiring AI, and set the rules around it. It does not yet guide you through every high-risk duty, such as assigning human oversight or keeping system logs, and it is not a data protection tool. If you build or sell recruitment AI yourself, you are a provider with a much larger set of duties, and Normis is not the right fit - the classifier will say so.
Usually, yes. The Act treats AI used to filter, rank or evaluate job applicants as high-risk, and it does not matter that the tool is a general assistant. Draft Commission guidance suggests that using a general tool for this purpose can make you responsible for it as if you were its provider. Asking ChatGPT to tidy the wording of a job advert is a different thing and is not high-risk.
Both, for different things. The vendor, as provider, has to build the system to the Act's standard. You, as the business using it, have your own duties from 2 December 2027: use it as the instructions say, put a competent person in charge of oversight, keep the logs it produces for at least six months, and tell staff before it is used at work. Your register should record which of your tools do this, and how.
The AI Act's high-risk duties apply from 2 December 2027, after the Digital Omnibus moved them back from August 2026. But this is not a 2027 problem only. Data protection law on decisions made solely by automated means already applies today, the ban on reading staff emotions has applied since February 2025, and customers are asking suppliers about AI well before either date.
Under the AI Act, from 2 December 2027, people who are subject to decisions made with the help of high-risk AI must be told. Data protection law already expects you to be open about automated processing of candidates' data today.
Not yet. Normis helps you find hiring AI, classify it, set the rules for your team and keep the record. It does not yet walk you through every high-risk deployer duty, and it is not a data protection tool. If you run high-risk hiring AI, plan those duties with your provider and, where it matters, a lawyer.
No. Normis gives you plain-English guidance, templates and a record-keeping system, with the article reference kept next to every answer. It is not a substitute for legal advice on a complex or high-stakes case.
The classifier is free, no signup, no card. List your hiring tools and see which ones count as high-risk, and from when.