AI in recruitment: from Annex III classification to evidence pack

Classification is not the finish line

Many organisations treat AI Act classification as a legal exercise. Is the tool high-risk or not? Does it fall under Annex III or not? Can it go live or should it wait?

For recruitment and workforce management, that is too narrow. Classification is the start of the evidence trail, not the end. An HR-AI system that filters applications, evaluates candidates, produces matching scores or assesses workers needs a practical translation into processes, documents and training.

The question is therefore not only: "which route applies?" The better question is: "which evidence do we need to use, explain and improve this system responsibly?"

Step 1: draw the HR workflow

Do not start with the software. Start with the HR decision.

For recruitment, the workflow may look like this:

1. job description and target group;
2. campaign and targeted job advertising;
3. application form;
4. CV parsing and knockout questions;
5. ranking or matching;
6. shortlist;
7. interview selection;
8. final decision.

For workforce management, the workflow may be very different:

1. scheduling or task allocation;
2. productivity or performance analysis;
3. absence or retention signals;
4. promotion advice;
5. improvement plan;
6. contractual decision.

Only when the workflow is visible can you see where AI influences a person. That is where the evidence pack starts.

Step 2: link each AI touchpoint to Annex III point 4

Annex III point 4 has two routes[1].

Route 4(a) covers recruitment and selection: targeted job advertisements, analysing and filtering applications, and evaluating candidates.

Route 4(b) covers worker management and employment relationships: decisions on terms of work, promotion, termination, task allocation, monitoring and evaluation of performance or behaviour.

Many organisations have both routes in one tool stack. An ATS may provide candidate matching, while the same vendor also offers workforce analytics or internal mobility. Classification should therefore happen per function and per workflow.

A simple classification table contains:

• system name;
• vendor;
• AI functionality;
• target group: candidate, worker, manager or recruiter;
• HR decision influenced;
• possible Annex III route;
• reason for classification;
• owner of the evidence file.

Step 3: ask for evidence, not policy

An evidence pack is not a folder of generic policies. It is a compact set of documents that explains a concrete HR-AI workflow.

For a first HR-AI evidence pack, request at least:

• use case register;
• Annex III classification note;
• data and bias check;
• human oversight playbook;
• candidate or worker notice;
• vendor due diligence summary;
• AI literacy role matrix;
• monitoring and incident process.

It does not need to be perfect legal prose in phase one. It does need to be usable for legal, privacy, HR, compliance, worker representation and the vendor.

Step 4: make human oversight concrete

Human oversight fails when it stays abstract. A recruiter who is "responsible" but does not know how the model produced a score cannot meaningfully review it.

For each AI output, define:

• what the user sees;
• which uncertainties are visible;
• which signals trigger extra review;
• when the AI output must not be used;
• how an override is recorded;
• who periodically checks whether overrides reveal structural patterns.

This is not a paper appendix. It is an instruction layer that must fit daily workflow.

Step 5: connect training to the system

AI literacy is often organised separately: a generic e-learning, a certificate and done. For HR-AI, that is not enough.

A recruiter must recognise bias signals and illogical rankings. A hiring manager must know that a shortlist is not objective truth. An HR business partner must understand when workforce analytics becomes monitoring. Legal and privacy teams must know which documentation to request.

That is why training belongs in the evidence pack:

• which roles work with the tool;
• which system risks they need to understand;
• which scenarios they have practised;
• which assessment proves practical competence;
• when they receive a refresher.

LearnWize can support the training and proof layer, while Embed AI organises the governance and implementation layer.

Step 6: build a rhythm, not a one-off check

An HR-AI evidence pack is not a one-time deliverable. Recruitment data changes, candidate pools change, vendors update models and managers develop habits around AI output.

Record:

• monthly or quarterly monitoring;
• bias and data quality checks;
• vendor update review;
• training refreshers;
• incident and complaint analysis;
• annual reclassification.

The Commission's draft guidelines underline that classification must be contextual and documentable[2]. That fits a living evidence file better than a static memo.

The practical route

For many organisations, the best sequence is:

1. inventory HR-AI systems;
2. classify per workflow;
3. prioritise systems that directly affect candidates or workers;
4. build a compact evidence pack;
5. train the roles using the system;
6. monitor bias, overrides and incidents;
7. update the file after vendor changes.

The HR-AI Risk & Evidence Sprint is built for exactly this route. If you first need to identify the most urgent use cases in your organisation, start with the AI Act Gap Intake.

Final note

Classification without an evidence pack remains fragile. You may know the legal route, but you still cannot show how the system is controlled in practice.

For AI in recruitment, that difference matters. Candidates and workers are affected by scores, filters, rankings and advice. A good evidence pack shows that your organisation takes that influence seriously.