Applied AI
EU AI Act for recruitment and HR: high-risk hiring AI explained
The EU AI Act names AI used in recruitment and employment as high-risk: systems that place targeted job advertisements, filter or screen applications, evaluate candidates, decide on promotion or termination, allocate tasks, or monitor and evaluate performance. Emotion recognition in the workplace is prohibited outright. UK agencies, RPOs and HR software vendors are in scope where candidates, employees or clients are in the EU, or where the system’s output is used there. Hexploits does the engineering side of alignment: classification, documentation, logging, bias testing and human oversight built into the systems rather than written up afterwards.
A named engineer replies within one working day. A written scope and an indicative price within two.
Who this is for
- UK recruitment agencies and RPOs placing candidates into EU roles or working for EU clients.
- HR technology vendors selling screening, matching or performance tools into the EU, who carry the heavier provider obligations.
- In-house HR and talent teams using bought AI tools for screening, and now responsible for them as deployers.
- Compliance and legal functions asked whether the tools already in use are in scope.
What you get
Deliverables, not slogans. Each one appears in the statement of work.
- An inventory of every AI use in hiring and employment, bought or built, classified against Annex III with the reasoning written down.
- Provider or deployer determination per system, including whether configuring or fine-tuning a vendor tool has made you a provider.
- For high-risk systems: risk management records, technical documentation, automatic logging, human-oversight procedures and a post-market monitoring plan.
- Bias testing against your own candidate data across protected characteristics, with results on file and refreshed on a schedule.
- Transparency notices for candidates and employees, and the worker-information duties met before deployment.
- A dated plan to the December 2027 deadline and a completed AI section for client and candidate due-diligence questionnaires.
Our engineers work across the major languages, frameworks and cloud platforms. We build on the stack you already run, with technology choices explained in writing before work begins.
How it is delivered
The same four stages as every Hexploits engagement, applied to this capability.
Stage 1
Inventory and classify
Two to four weeks. Every AI use in the hiring and employment flows is listed and mapped to the Act’s categories and prohibitions. Most turn out to be limited risk; screening, ranking and evaluation tools do not.
Stage 2
Gap analysis
Current controls, documentation and the vendor’s own conformity evidence are compared with what the Act requires, and gaps are ranked by deadline and exposure.
Stage 3
Build the controls
Logging, oversight points, bias testing and documentation are built into the systems and the release process, so the evidence is produced by the system running.
Stage 4
Monitor and maintain
Post-market monitoring, incident handling and periodic review under deployment and monitoring, with the inventory kept current as tools and guidance change.
Built by the same team
We are the core engineering team behind swarmd.ai
swarmd.ai is an EU AI Act readiness platform for governing AI agents in highly regulated industries: policy enforced on every action, tamper-evident audit trails, per-tenant isolation and customer-owned identity. The same patterns are what we apply to a recruitment business’s own screening and matching systems, and to the bought tools it deploys.
How success is measured
Every engagement agrees its measures and the measurement period in writing before work starts.
- Every hiring and employment AI use classified, with reasoning a client or regulator can be shown.
- High-risk systems with complete documentation and logging before the deadline.
- Bias test results across protected characteristics on file and refreshed on schedule.
- Client due-diligence questionnaires answered from evidence rather than assertion.
Proof
Case studies with numbers, and reviews linked to Google where they were left there.
swarmd.ai · Software vendor · 6 months
Enterprise AI control plane delivered in six months at 75% under budget for a UK software vendor
JobVantage · Recruitment technology · Duration TBC
99.9% availability and sub-100ms responses for a recruitment intelligence platform, at negligible infrastructure cost
Director, JobVantage
“Working with Hexploits has genuinely been a pleasure, and I see them as my scaling partner for the foreseeable future as JobVantage grows. If you’re looking for a development team who combine strong AI/engineering capability with honesty, flexibility and a real interest in your business, I’d strongly recommend them.”
Director, IO Solutions
“Fantastic to work with. High level of attention to detail and flawless communication throughout. Would recommend to anyone looking to develop or improve a software product.”
Questions we get asked
Why is recruitment AI high-risk under the EU AI Act?
We are a UK agency. Does it apply to us?
What about the screening tool we buy from a vendor?
When is the deadline?
What does UK law say?
Is this legal advice?
Related
Sectors where this is most often needed
More in applied ai
Internal AI assistants and copilots for UK businesses
EU AI Act readiness for UK businesses
AI document and email processing
AI decision support and forecasting
Agentic AI workflows with governance
AI sovereignty: private and EU-hosted AI
AI governance and ISO 42001
AI in payments, credit and fraud under the EU AI Act
AI for recruitment: sourcing, screening and matching automation
AI governance readiness for recruitment and HR businesses
Next step
Request a proposal.
Tell us about the system and the sector. A named engineer replies within one working day. A written scope and an indicative price within two working days of a short scoping call.