Original practice question. The scoring rubric is our teaching guide. How we research and score answers
TL;DR: AI used to screen or rank job applicants is a high-risk use under the Act (Annex III, employment). As the provider, we would need a risk management system, data governance for training and test data, technical documentation, logging, instructions for deployers, effective human oversight, accuracy and robustness testing, a conformity assessment and registration, then post-market monitoring. As of November 2026, under the 2026 amending regulation, those Annex III obligations apply from 2 December 2027. Some practices, such as emotion recognition in the workplace, have been prohibited since February 2025. This is product framing; counsel gives the legal advice.
How to approach it
Clarify what the tool does (ranking CVs, scoring video interviews, chat screening), who uses it (employers, the deployers), and who we are (the provider). Then classify the use, list obligations by role, translate each into product work, and put dates on it, hedged as of today and confirmed with counsel.
A strong answer
Classification. The Act lists employment uses, including recruitment and selection (placing targeted job ads, filtering applications, evaluating candidates), as high-risk in Annex III. A screening tool falls squarely in that category. If any feature infers candidates' emotions from video or voice, that is a prohibited practice in workplace settings, applicable since 2 February 2025, and must be removed for EU use.
Roles. We are the provider (we develop the system and place it on the market). The employer using it is the deployer. Obligations differ: providers carry most of the design and documentation duties; deployers must use the system as instructed, assign human oversight, monitor it and, among other things, inform affected people.
Read diagram description
Obligations under the EU AI Act for a high-risk hiring tool, as described in the answer. The provider, which builds the system and places it on the market, owes a risk management system, data governance and bias examination, technical documentation, automatic logging, instructions for deployers, human oversight by design, the Article 15 accuracy and security duties, conformity assessment and registration, and post-market monitoring. The deployer, the employer, must use it as instructed, assign human oversight, monitor it in use and inform affected people. Inferring candidates' emotions from video or voice has been prohibited at work since 2 February 2025.
Provider obligations turned into product work.
| Obligation | Product requirement |
|---|---|
| Risk management system | Documented, ongoing process identifying risks (bias, errors, misuse) with mitigations and testing |
| Data governance | Training and evaluation data documented for relevance, representativeness and bias examination |
| Technical documentation | Model, data, design choices, evaluation results, limitations, kept current |
| Record-keeping | Automatic logs of system operation sufficient for traceability |
| Transparency to deployers | Clear instructions: intended purpose, accuracy, limitations, how to oversee |
| Human oversight | Design that lets recruiters understand outputs, override them, and avoid automation bias; no fully automated rejections |
| Accuracy, robustness, cybersecurity | Measured and declared accuracy; testing across groups; resilience to manipulation |
| Conformity assessment and registration | Before placing on the EU market |
| Post-market monitoring and incident reporting | Ongoing monitoring of performance and serious incidents |
Dates, checked 6 November 2026 against the Commission timetable and the 2026 amending regulation. The Act's obligations phase in. Prohibitions and AI-literacy duties have applied since 2 February 2025, though the 2026 amendments softened the literacy duty to taking measures that support it. General-purpose AI model obligations have applied since 2 August 2025, and transparency duties under Article 50 (for example, telling people they are interacting with an AI system) since 2 August 2026. Under the amended Article 113, high-risk obligations for Annex III uses such as employment apply from 2 December 2027. Counsel confirms the exact dates and scope before we commit the roadmap.
Roadmap.
Follow the flow, one stage at a time.
Illustrated sequence; animation speed does not represent processing time.Read diagram description
Now: remove any prohibited emotion-inference features for EU use and add Article 50 disclosures. Over the next two quarters: a risk management system, data documentation and bias testing. Then human oversight design, logging and deployer instructions; then technical documentation and conformity assessment; then registration before the Annex III date, 2 December 2027 under the amended Act as of November 2026; then post-market monitoring.
Product design changes that matter beyond compliance. Recruiters see why a candidate was ranked (the evidence from the application against job criteria), can override easily, and are prompted to review rather than rubber-stamp. Fairness testing across groups is part of release gates. These also make the product more trustworthy to US and Indian customers, where hiring discrimination law already applies.
The US already tests this product. New York City's Local Law 144 has required bias audits of automated employment decision tools since 2023. The city's FAQ sets out the shape: an independent auditor calculates selection or scoring rates and impact ratios across sex, race and ethnicity, and intersectional categories; the audit must be less than a year old; candidates get notice ten business days before the tool is used. The legal duty sits with the employer, and the FAQ says the vendor is not responsible for the audit but may have an independent auditor audit its tool. That makes a vendor-commissioned annual audit, with the impact-ratio tables ready for customers to publish, a sales requirement for any New York customer, and the same fairness testing feeds the EU file.
Liability is also moving toward vendors. In Mobley v. Workday, a federal court in California on 16 May 2025 granted preliminary certification of a nationwide collective of applicants aged 40 and over who allege that Workday's screening tools discriminated by age. The case was still being litigated when we last checked, and nothing here predicts its outcome. The product lesson stands either way: a screening vendor should expect its own logs, test results and design choices to be examined, so build them to be examined.
What interviewers probe next
"Can we avoid high-risk status by calling it 'decision support'?" Unlikely if it filters or ranks candidates. Classification follows what the system does, whatever the marketing calls it.
"The deadline moved once already. Should we wait?" No. Much of the work (bias testing, documentation, oversight design) improves the product and is expected by enterprise buyers now, and building it late is far harder.
How it's scored
| Signal | Weak | Hire | Strong Hire |
|---|---|---|---|
| Classification | Unsure or "probably fine" | Identifies high-risk | High-risk under Annex III, flags prohibited emotion recognition, distinguishes provider and deployer |
| Obligations | Vague "compliance" | Lists several duties | Maps each provider obligation to concrete product work |
| Timing and care | Undated claims | Some dates | Phase-in dates stated with the date checked, hedged and confirmed with counsel, a roadmap, and the US audit duties that already apply |
Common mistakes
Stating regulatory dates without "as of" or without noting they were amended.
Treating compliance as documentation only, rather than product design.
Ignoring the deployer's obligations, which shape what customers need from the product.
See EU AI Act for PMs.