All regulations
European UnionAnnex III high-risk compliance by December 2027

EU AI Act

Regulation (EU) 2024/1689

The EU AI Act treats AI used for recruitment, candidate filtering, promotion and termination as high-risk under Annex III. High-risk systems come with duties a bias audit feeds directly. Check the training data for bias. Keep technical documentation and logs. Put a human in the loop. And run a conformity assessment before the system goes to market. For employment systems that assessment is normally internal control under Annex VI, so an independent bias audit supports it as evidence rather than replacing it. The rollout is phased under Article 113, and the May 2026 omnibus agreement moved the Annex III deadline to December 2027.

Talk to us about an auditPlatform capabilities

At a glance

Classification

Annex III high-risk for employment AI

Data governance

Article 10 examination for possible biases

Conformity

Assessment required before placing on the market

Oversight

Article 14 human oversight measures

FRIA

Fundamental rights impact assessment for some deployers

Penalties

Up to 15M EUR or 3% of global turnover

Who has to comply

  • Providers placing employment AI on the EU market
  • Deployers using high-risk employment AI in the EU
  • Non-EU vendors whose output is used inside the EU
  • Public bodies and private entities providing public services, who owe a fundamental rights impact assessment

What the audit covers

  • Examination of training, validation and test data for possible biases
  • Performance and error rates across demographic groups
  • Technical documentation under Annex IV
  • Human oversight design and its effectiveness in practice
  • Post-market monitoring evidence

What non-compliance costs

Up to 15 million EUR or 3% of total worldwide annual turnover, whichever is higher, for breaches of high-risk obligations. Prohibited practices carry a higher ceiling.

EU AI Act questions

AI used for recruitment or selection, for decisions on promotion or termination, for task allocation and for monitoring or evaluating performance falls under Annex III. A narrow derogation exists where the system performs a purely preparatory or narrow procedural task, but it is read strictly and must be documented.
Article 10 requires that data sets be examined for possible biases likely to affect health, safety or fundamental rights. A bias audit produces exactly that examination, together with the group-level performance evidence Annex IV documentation expects.
The underlying statistical work overlaps substantially, so a single engagement can produce both. The reporting differs: the EU expects technical documentation and conformity evidence, while NYC expects a published summary of selection rates and impact ratios.
December 2027 for Annex III standalone high-risk systems, which is the category employment AI sits in, following the revised dates in the May 2026 omnibus agreement. Other parts of the Act already apply: prohibited practices and AI literacy duties since February 2025, and GPAI transparency since August 2025. AI embedded in Annex I regulated products has until August 2028.

Other regulations we audit against

NYC Local Law 144

New York City, USA

The first law anywhere to require an independent bias audit before an automated hiring tool can be used.

Colorado SB 26-189

Colorado, USA

Notice, explanation and human review when automated technology materially influences a consequential decision.

Illinois HB 3773

Illinois, USA

Makes discriminatory AI in employment decisions a civil rights violation, and bans zip code as a proxy for protected class.

Get audited against EU AI Act

One engagement can cover this and every other jurisdiction you operate in.

Talk to usHow we test
EU AI Act bias audit | VerifyWise