The EU AI Act: What employers in Ireland need to know about using AI for recruitment

The EU AI Act now places firm compliance duties on Irish employers that use AI to screen, rank or assess job candidates. Business leaders need to identify where AI influences recruitment, check whether those systems are classed as high-risk, retain meaningful human oversight and document how decisions are made. GDPR obligations continue to apply alongside the Act.

AI screening is already part of many recruitment processes. Applicant tracking systems may rank CVs, recommend candidates or filter applications against set criteria. Interview platforms can analyse responses, while assessment tools may generate suitability scores.

Under the EU AI Act, several of these uses are classed as high-risk because they can affect a person’s access to employment. The European Commission specifically includes systems used to analyse and filter job applications or evaluate candidates. Most obligations covering these systems became applicable on 2 August 2026.

For organisations reviewing AI hiring regulations Ireland, the central question is straightforward: does an AI system materially influence who progresses, who is rejected or how a candidate is evaluated?

What counts as high-risk AI in recruitment?

An AI tool is likely to fall within the high-risk category when it is used to:

• analyse or filter job applications
• rank or match candidates
• evaluate candidates during recruitment
• make decisions that affect employment or access to self-employment

The label attached by the supplier is less important than the system’s actual purpose. A product described as an “assistant” may still be high-risk if its score or recommendation shapes a recruitment decision.

Simple administrative tools may sit outside this category. Software that schedules interviews or stores applications without assessing people is less likely to qualify. Employers should still confirm the classification rather than assume it.

What has Ireland done to enforce the Act?

The EU AI Act applies directly in Ireland. Ireland has also passed the Regulation of Artificial Intelligence Act 2026, establishing the AI Office of Ireland as an independent central coordinating body.

Ireland is using a distributed regulatory model. The AI Office will coordinate implementation, while existing regulators, including the Data Protection Commission, will retain roles linked to their areas of responsibility.

This matters because recruitment technology can engage several legal duties at once. The AI Act governs the risks created by the system. GDPR governs the processing of candidate data. Irish employment and equality law may also apply where a process disadvantages particular groups.

Compliance with one regime does not cancel the others.

What must employers do when using AI screening tools?

Most employers buying recruitment software will be “deployers” rather than providers under the Act. This still carries direct responsibilities.

Create an inventory of recruitment AI

List every system used across recruitment, including features built into an applicant tracking system. Record what each tool does, which data it uses and how its output affects candidates.

Include tools used by recruitment agencies on your behalf. Outsourcing a process does not remove the need to understand it.

Check the supplier’s evidence

Ask vendors to confirm whether the system is classified as high-risk and to provide the instructions, documentation and information needed for compliant use.

Procurement teams should ask how the tool was tested, how errors and bias are monitored, which data shaped its development and what records it produces. Contract language should cover access to logs, incident support and notification of material system changes.

A general claim that a product is “AI Act ready” is not enough.

Keep meaningful human oversight

A recruiter should be able to understand the system’s output, recognise when it may be wrong and disregard or override it.

Human oversight cannot mean clicking approval on every recommendation. The reviewer needs suitable training, authority and enough information to challenge the result. The Act requires deployers of high-risk systems to assign oversight to people with the necessary competence and authority.

An automatic rejection based solely on an unexplained score creates particular risk. The Irish Data Protection Commission states that people generally have the right not to be subject to solely automated decisions that produce legal or similarly significant effects.

Tell candidates what is happening

Candidate privacy information should explain when automated decision-making or profiling is used, how it affects the process and what its likely consequences are.

Use plain language. Telling candidates that “advanced analytics” may process their data does not give them a useful account of the decision. The DPC says organisations should provide meaningful information about how automated decisions are made and their significance.

Document risks and outcomes

Keep records of system instructions, staff training, monitoring, overrides, complaints and unexpected results. Where processing is likely to create a high risk to candidates’ rights, complete a data protection impact assessment before deployment.

The DPC describes a DPIA as a way to identify and reduce data protection risks early in a project.

Testing should also examine whether outcomes differ across groups. A tool can apply the same scoring method to everyone and still produce discriminatory results.

What should business leaders do now?

A sensible first step is to pause the purchase or expansion of any AI screening feature until someone owns the compliance review.

HR, legal, data protection, procurement and information security should agree who approves these systems and who monitors them after launch. Recruiters should know when AI is being used and what they must do when a candidate challenges an outcome.

The same discipline should extend to background screening. Employers should choose checks that are proportionate to the role, use reliable evidence and retain human review where context matters. Veremark’s guides to AI in background checks, GDPR compliance in employment screening and background checks in Ireland offer further practical guidance.

The clearest response to AI hiring regulations Ireland is good governance. Know which systems are making judgements about candidates, require evidence from suppliers and ensure a trained person remains accountable for every hiring decision.

‍