What Is the EU AI Act? Risk Tiers, GPAI Systems & EU Rules

Imagine applying for a job and never hearing back. You assume the role was filled, or maybe your résumé just got lost in the pile. But here's the part nobody tells you: an algorithm scored you before any human ever looked at your application. You got a number. The number was low. And you were quietly filtered out, no explanation, no appeal, no way to even know it happened.

This isn't science fiction. It's Tuesday.

The Score You Never See

Here's how it works in practice. A company posts a job. Five hundred people apply. Before a recruiter touches a single résumé, an AI system, think of it as automated sorting software, scans every application, assigns each one a score, and hands the recruiter a shortlist of maybe ten names. The other 490 people? Eliminated. Gone. Often before the recruiter's coffee has even cooled.

The tool that does this is called an ATS, an Applicant Tracking System (basically a digital gatekeeper for job applications). Most large companies use one. Many mid-sized ones do too. And increasingly, these systems don't just sort applications, they rank them using AI, weighing factors like keyword matches, employment gaps, school names, and past job titles.

According to College Recruiter, the EU AI Act draws a sharp line here. The scoring tool itself? Legal. The use of that score as a silent, unexplained verdict on a real person's career, without any transparency or ability to challenge it? That's where regulators are now drawing the red line. This article is part of a series, start with One Stolen Badge Shouldnt Unlock Your Whole Office Heres Wha.

Legal Tool, Illegal Secrecy

What Is the EU AI Act and Why Risk Tiers Matter

So what is the EU AI Act, exactly? It is Europe's first-ever legal framework for regulating artificial intelligence across every industry, and it works by sorting AI systems into risk tiers rather than treating all AI the same way. The risk tiers range from minimal risk, like spam filters, up to unacceptable risk, which is banned outright, and the tier a system lands in decides which rules apply to it.

This distinction matters more than it sounds. The EU AI Act, Europe's sweeping new law governing artificial intelligence, which took effect in stages starting in 2024, classifies job-screening AI as "high-risk." That phrase has a specific legal meaning: it doesn't mean the tech is banned. It means it has to meet strict standards. Transparency. Human oversight. And crucially, the right of candidates to know that AI was involved and to get a clear explanation of how the system reached its conclusion.

In other words: the score alone is not enough. The reasoning behind the score is what the law demands.

As HeroHunt explains in their breakdown of AI hiring obligations, employers can't hide behind vendor tools and claim they didn't make the decision. If an AI system effectively determines who gets considered, regulators treat that as an automated decision, full stop. The human who technically clicked "approve" on the shortlist doesn't change that calculus.

"The regulatory breakthrough here isn't banning the technology, it's banning opacity disguised as objectivity. Companies long treated algorithmic scoring as a neutral administrative step, hiding behind vendor black boxes. The EU AI Act forces a reckoning: AI scoring must be explainable, and an AI that produces a candidate score without any indication of how it was derived fails this requirement." Expert analysis, College Recruiter

That "hiding behind vendor black boxes" line hits differently when you realize most companies genuinely don't know how their own screening tools work. They bought software. The software came with a score. They used the score. Nobody asked questions, because the system looked objective. Numbers feel neutral. They're not.

When "Objective" Just Means "Harder to Argue With"

The European Commission's Role in Enforcing AI Systems

The European Commission oversees how the EU AI Act gets applied across member states, and it works alongside a dedicated AI Office that coordinates enforcement for the most powerful general-purpose AI systems. That matters for hiring tools too, because guidance from the European Commission shapes what "compliance" actually looks like in practice for the ATS software companies rely on every day.

Here's the part that should make you genuinely angry. These systems are often trained on historical hiring data, meaning they learn what a "good" candidate looked like based on who companies previously hired. And if those past hiring decisions were skewed (more men promoted into engineering, more certain universities represented in senior roles), the algorithm learns to replicate that bias. It doesn't know it's biased. It just knows those patterns correlated with "success" in the past.

Legal analysts at Fisher Phillips LLP have flagged a specific danger here: EU courts are increasingly treating AI-generated scores as legally binding automated decisions, even when a human technically reviewed the shortlist. The logic is straightforward. If a recruiter only ever sees the ten names the algorithm surfaced, their "review" is barely more than a rubber stamp. The real decision happened earlier, invisibly, at the scoring stage. Courts are starting to say: that's where accountability needs to live. Previously in this series: Lose Your Phone Lose Your Life The Password Replacement Nobo.

And the bias risk isn't hypothetical. Selection algorithms trained on historical data have been shown to systematically disadvantage women, older applicants, and people with non-linear career paths, not because anyone programmed in discrimination, but because past patterns become future predictions, and past patterns were often discriminatory. The University of Tübingen published peer-reviewed research examining exactly this problem, how algorithmic systems can replicate legally prohibited discrimination while appearing to operate on purely neutral criteria.

So What Can You Actually Do?

Start-ups and Small Employers Face the Same Rules

It's tempting to assume this only applies to big corporations, but start-ups that build or deploy hiring AI in Europe fall under the same EU AI Act obligations as large enterprises. A smaller company using an off-the-shelf ATS still has to be able to explain how its AI systems reach a score, even if it didn't build the underlying model itself.

Look, this problem isn't solved yet, even in the EU. The law exists. Enforcement is still catching up. But there are things a smart job seeker can do right now, regardless of where they live.

First: if you apply for a role with a company that operates in the EU and you get rejected, you may now have a legal right to ask whether AI was used in the screening process and to request an explanation. That right is real. Most people don't know to use it, so most companies haven't been forced to prepare a real answer. Start asking. The question itself puts companies on notice.

Second: pay attention to whether a company's application process asks you to go through an automated video interview or a "fit quiz" before speaking to any human. These are often AI-scored. They're not illegal, but under EU rules, you can ask how the scores are used and whether you can have a human review your application. Again, asking is the move. Silence is what they're counting on.

Third, and this applies everywhere, not just EU jurisdictions, understand that the systems doing the screening are only as fair as the data they were trained on. If a company can't tell you in plain language what factors their system weighs and why, that's a red flag about how much they've actually thought about whether the tool is working as advertised. As Carv notes in their explainer on recruitment AI obligations, true transparency means being able to explain the system's reasoning to a candidate in terms they can actually understand, not pointing at a vendor contract and calling it done. Up next: Why Passkey Adoption Is Stalling Recovery Problem.

Here's a thing worth knowing: any organization serious about getting identity decisions and screening decisions rightwhether in hiring, in verification, or in any process where a person's life is affected by an automated output, needs to be able to explain how it reached its conclusion. Not with jargon. Not with a vendor name. With real reasoning, in plain language. If you've ever wondered whether a profile or result is trustworthy, the question you're really asking is: can someone walk me through exactly how they got here? That question is now the law in one of the world's largest economies. It should be the baseline everywhere.

The engagement question hanging over all of this is a sharp one: If a company used an algorithmic score to screen you out, what would you want first, the raw data they used, a plain-language explanation of how the score was calculated, or a human being who could actually look at your full application? Your answer probably says something important about what "fairness" really means to you.

But here's the more unsettling thought. Most of the companies doing this right now couldn't give you any of those three things even if they wanted to. They bought a tool. The tool produced a number. The number did its job quietly. And somewhere between the algorithm and the job offer, you became a score nobody wrote down where you could read it.

The EU just said that has to change. The real question is whether companies start treating that as a legal minimum, or an actual standard worth meeting.

So what is the EU AI Act in plain terms? It is the European Union's attempt to make sure artificial intelligence gets used responsibly, especially in situations like hiring where an AI system's output can quietly decide someone's future. The eu ai act does this by requiring that any high-risk AI system, including the ai systems used in recruitment, meet standards for transparency, oversight, and explainability before and after deployment.

Understanding what is the eu ai act also means understanding what it does not do. It does not ban artificial intelligence, and it does not ban ai systems from scoring or ranking candidates. What the eu ai act is is a compliance framework: it tells companies operating anywhere in europe that if their ai touches a high-risk decision like hiring, they must be able to show their work, not just show a number.

The ai act is built around the idea that risk should determine regulation, not fear of ai in general. Low-risk ai, like a chatbot that recommends song playlists, faces almost no obligations. But an ai system that can end someone's shot at a job faces the heaviest compliance burden the law offers, and that burden includes documentation, human oversight, and the right of the person affected to get an explanation.

For an ai act is to actually protect job seekers, companies need to treat ai systems as tools that require real oversight, not black boxes that generate a verdict and disappear. The european commission has made clear through its guidance that compliance is not a paperwork exercise done once and forgotten. It is an ongoing obligation that applies every time a company's ai systems make or shape a decision about a real person.

This is also where gpai models enter the picture. Some hiring tools are now built on top of general-purpose ai, meaning the underlying gpai models were not originally designed for recruitment at all. The eu ai act treats these general-purpose systems differently from narrow, purpose-built ai systems, but once a company plugs a gpai model into a hiring pipeline, the high-risk rules for that use case still apply. Compliance follows the use case, not just the underlying technology.

Risk sits at the center of almost every eu ai act obligation. The law asks a simple question: how much risk does this ai system pose to a real person's rights, safety, or opportunities? A hiring decision carries obvious risk to someone's livelihood, which is exactly why job-screening ai systems land in the high-risk category rather than the minimal-risk one reserved for things like spam filters or video game AI.

Compliance under the eu ai act is not a single checkbox. It includes keeping records of how an ai system was trained, testing for bias before deployment, allowing human reviewers to actually override the system, and giving affected people a plain-language explanation on request. Companies that treat compliance as a one-time certificate rather than an ongoing practice are the ones most likely to find themselves on the wrong side of a future enforcement action.

None of this means artificial intelligence is going away from hiring, in europe or anywhere else. AI systems are faster and cheaper than an all-human screening process, and that is not going to change. What is changing is the expectation that ai, wherever it is used to judge a person, has to be accountable for how it reaches its conclusions, and that accountability is now written into law rather than left to a company's goodwill.

GPAI Models and the Purpose-Built AI Systems Question

GPAI models, short for general-purpose AI, are systems trained to handle many different tasks rather than one narrow purpose. When a company repurposes a general-purpose model for a specific purpose like screening job applicants, the eu ai act still requires the same documentation and oversight that any other high-risk ai system needs. The practical consequence is that providers cannot avoid obligations simply by pointing to a general tool instead of a custom-built one.

Governance Under the EU Artificial Intelligence Act

Governance under the eu artificial intelligence act means more than writing a policy and filing it away. Providers of high-risk ai systems must show ongoing governance, including risk assessments, documentation of how a system was tested, and a clear process for a person to exercise their rights if an automated decision affects them. Real governance is what separates a company that treats compliance as a checkbox from one that treats it as a genuine safeguard for the people it screens.

Europe's Purpose in Setting Global AI Compliance Norms

Europe's purpose in building this framework was never just to regulate one region in isolation. Because so many providers sell ai systems across borders, compliance built for eu obligations tends to spread outward, shaping how gpai models and hiring tools get built for markets far outside europe. That ripple effect is part of why the ai act is often described as a global rulebook disguised as a regional law.

What Providers of AI Systems Must Document

Providers of high-risk ai systems carry specific documentation obligations under the ai act, including records of training data, testing results, and known limitations of the system. This documentation is not optional paperwork, it exists so that a regulator, an employer, or an affected candidate can actually trace how a score got produced. Without it, a company cannot demonstrate compliance even if the underlying ai systems happen to work reasonably well in practice.

Purpose matters just as much as risk when regulators evaluate an ai system, because the same underlying technology can be low-risk in one setting and high-risk in another depending on how it is deployed. A purpose-built resume-ranking system and a general chatbot are judged by completely different standards precisely because their purpose differs. That is why compliance conversations always start with a simple question: what is this ai system's purpose, and who does it affect.

The rights an affected candidate holds under the eu ai act are still new enough that many employers have not fully built out a process for them. But the obligations are not optional, and providers who supply ai systems into the EU market are expected to support employers in meeting them, not leave companies to figure out documentation and governance alone.

What GPAI System Providers Owe the Market

A gpai system provider carries obligations that travel downstream to every company that builds on top of its model. When a gpai system gets folded into a recruitment product, the provider's technical documentation becomes the foundation the deploying company relies on to prove its high-risk systems meet the ai act's transparency obligations. If that documentation is thin, the whole chain of compliance underneath it is thin too, which is why regulators are pushing gpai system providers to publish clearer summaries of training data and known limitations.

Risk Tier Placement and What It Changes

The risk tier a system falls into is not a label decided once and forgotten, it is reassessed whenever the system's purpose changes. A tool that starts as a low-risk resume formatter can slide into a higher risk tier the moment a company starts using its output to rank or eliminate candidates. That is why legal teams are told to revisit risk tier classification every time an existing ai system gets a new use case bolted onto it.

Transparency Obligations Employers Cannot Outsource

Transparency obligations under the ai act fall on the employer using the system, not just the vendor who built it. A company cannot point to a supplier's paperwork and call its transparency obligations satisfied if it cannot itself explain, in plain language, how a candidate's score was produced. Meeting transparency obligations in practice means training whoever handles candidate complaints to actually answer the question, not forward it to a vendor's support inbox.

When the Act Prohibited Certain AI Practices Outright

Before risk tiers even come into play, the act prohibited a narrow set of practices entirely, regardless of how well documented or explainable they are. Manipulative techniques that exploit a person's vulnerabilities, and certain uses of biometric categorization, fall into this banned category rather than the high-risk one. The distinction matters for hiring teams because it means some shortcuts are not a compliance question at all, they are simply off the table.

The European Union's Wider Reach on Risk Systems

The European Union built this framework to cover risk systems used anywhere a person's opportunities are shaped by an automated score, not hiring alone. Credit scoring, tenant screening, and insurance pricing sit alongside recruitment as examples of risk systems the European Union treats with the same high-risk scrutiny. That breadth is part of why compliance teams outside the hiring function are watching this law just as closely as HR departments are.

What Parliament Debated Before the Final Text

Parliament spent years negotiating exactly where the lines between risk tiers should sit, particularly around biometric surveillance and high-risk classification for employment tools. Those debates are why the final text reads less like a blanket ban and more like a tiered rulebook, since lawmakers kept weighing innovation against the real harm an unexplained automated decision can cause a job seeker.