For HR tech · Written by Yobel Tzegai · Last checked 3 November 2026

What will enterprise customers ask about the AI in your HR software?

Whether it is high-risk. Recruitment and selection AI falls under point 4(a) of Annex III; AI making decisions affecting work terms, promotion or termination, allocating tasks based on individual behaviour or traits, or monitoring performance and behaviour under point 4(b). Unless Article 6(3) applies, high-risk obligations start on 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended). Complipath (complipath.io) answers that per system, with the article behind it.

What it is for: when an enterprise customer's review asks about your AI, the answers are ready, each with its source, so the review need not hold up the deal.

Get my risk classes, freeBook a 20-min call20 minutes with the founder.

Why do your enterprise customers ask about your AI?

A company that buys your HR software is the deployer of the AI in it.
For a high-risk system, Article 26 will make it answer for how that AI is used, among other things: in line with your instructions for use (Article 26(1)), under human oversight by people with the necessary competence, training, authority and support (Article 26(2)), monitored (Article 26(5)) and with the logs under its control kept (Article 26(6)).
So it asks you for what those duties rest on.

As an employer it also informs workers' representatives and the affected workers before putting a high-risk system into service or using it at the workplace (Article 26(7)), and it tells the people a high-risk system makes or assists decisions about that the system is in use (Article 26(11)).

And it needs to know your product does nothing prohibited.
Inferring the emotions of a natural person in the workplace has been banned since 2 February 2025, except where the system is intended for medical or safety reasons, and the ban covers both selling such a system and using it (Article 5(1), first subparagraph, point (f)).

Point 4 of Annex III, "Employment, workers' management and access to self-employment", lists: (a) "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates"; and (b) "AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships".
Under Article 6(2) those systems are high-risk.
Article 6(3) takes one out only where it poses no significant risk of harm and one of four conditions is met, and never where it profiles natural persons; a provider relying on that documents its assessment first (Article 6(4)) and registers the system (Article 49(2)).
Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply to these systems from 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)).

Which questions and audits do they send?

Is any AI in the product high-risk, and under which point of Annex III?
Does the system profile candidates or employees? If it does, Article 6(3) cannot take it out of high-risk.
What do your instructions for use say about accuracy, limitations and human oversight (Article 13(3))?
Can a recruiter disregard, override or reverse a ranking (Article 14(4), point (d))?
How do you examine training data for possible biases and act on them (Article 10(2), points (f) and (g))?
Does any feature infer the emotions of employees (Article 5(1), first subparagraph, point (f))?
Which logs does the system generate, and can we keep them for at least six months (Article 26(6))?
What should we tell workers' representatives and affected workers before go-live (Article 26(7))?

What does Complipath do for you?

A register of your AI systems, each classified by fixed rules with the article behind it, and confirmed by you.
Requirements per system, each with an owner, a status and a date.
An evidence library, and Annex IV documentation part by part.
Customer questionnaires answered in the customer's own Excel, Word or PDF, each answer with its source; what it cannot answer is marked "needs your answer" (Starter and up).
A whole security review: 17 common topics answered from what you confirmed (Starter and up).
An audit room, an audit report in PDF or Word and an audit pack (Starter and up); on Growth, the audit room shared with your customer.

What one system looks like, as an example

Example · a fictional system, not a customer
AI system	What it does	Risk class	Article	What it owes
Applicant Ranker	Ranks job applications against a vacancy's requirements for recruiters at customer companies.	High risk	Point 4(a) of Annex III; Article 6(2)	From 2 December 2027 the provider owes the Chapter III, Section 2 requirements and the Article 16 obligations, conformity assessment by internal control among them (Article 43(2)). If it profiles applicants, Article 6(3) cannot take it out of high-risk. The customer tells applicants the system is in use (Article 26(11)).

A questionnaire already waiting?

Questionnaire waiting? We answer it in 48 working hours.

Starter

€499 a month

or €4,990 a year. Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
The Free plan is for one AI system and one user, with no end date

Get my risk classes, free

All plans

Questions

Is a CV-ranking tool high-risk under the EU AI Act?

Usually. Point 4(a) of Annex III lists AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Article 6(3) exempts one only on one of four conditions and no significant risk of harm, never one that profiles candidates.

When do the high-risk obligations apply to HR software?

Chapter III, Sections 1, 2 and 3, except Article 6(5), apply to Annex III systems from 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended by Regulation (EU) 2026/1744). The ban on inferring emotions in the workplace and the AI literacy duty in Article 4 have applied since 2 February 2025.

Can HR software infer employees' emotions?

Not outside medical or safety reasons. Article 5(1), first subparagraph, point (f) prohibits placing on the market, putting into service for this specific purpose, or using AI systems to infer emotions of a natural person in the areas of workplace and education institutions. It has applied since 2 February 2025 (Article 113, third paragraph, point (a)), to the vendor and the employer alike.

Do employees have to be told about a high-risk HR system?

Yes, by your customer. Before putting into service or using a high-risk AI system at the workplace, an employer that deploys it informs workers' representatives and the affected workers, following Union and national rules and practice where they apply (Article 26(7)), from 2 December 2027. Your instructions for use should give it what it needs.