The European Commission released this morning the draft guidelines on what counts as a high-risk AI system under Annex III of the AI Act, in stakeholder consultation phase. The employment section (point 4) is more specific than anything the Commission had put on paper before, and there is one example inside it that anyone running a two-sided talent platform has to read twice.
The example, on page 66 of the draft, describes an online platform "designed to help consumers in finding a self-employed service provider," using an AI-enabled job-matching tool that ranks providers and determines which are presented to potential clients. The Commission's conclusion is unambiguous: this falls within point 4(a) of Annex III, the system "directly and meaningfully affects selection of natural persons," its output shapes access to future assignments and "may have a decisive impact on the careers of self-employed persons, along with their livelihoods and rights," and none of the exceptions in Article 6(3) apply. High-risk. No filter available.
That paragraph collapses a lot of the ambiguity the marketplace category had been living in. Matching as a verb, when the output is consumed by the buyer side, is now explicitly inside the perimeter. Everything else in the HR section of the draft branches out from that line.
What the draft actually says about matching
The Commission's logic for point 4(a) is consistent across every example in the chapter, and worth pulling out cleanly because most of the operational decisions in HR-AI now hinge on it.
The personal scope is broad. Point 4 covers "employment, workers' management and access to self-employment," and the Commission's reading of the last term explicitly includes freelancers, independent professionals, service providers, and platform workers regardless of contractual status (paragraphs 240–241). The "workplace" notion is defined as any physical or virtual space where a person performs assigned tasks — including, by reference, work coordinated through a platform.
The high-risk triggers inside point 4(a) are: placing targeted job advertisements, analysing and filtering applications, and evaluating candidates. The Commission treats all three as functional verbs, not product labels. Anything that "appreciably influences the decision-making process" — by producing scores, rankings, fit categories, shortlists, or competence profiles consumed by the recruiting side — falls inside.
The mirror case is the only clean exit. Two of the "outside scope" examples in the chapter are systems that recommend positions to candidates and share those recommendations exclusively with the candidate. One tailors the candidate's CV to an open position. The other ranks job vacancies for the candidate's review. In both, the Commission's reasoning is the same: the system's use is initiated and managed by the candidate, the employer never sees the output, the system "occurs outside of the recruitment and selection process." Outside Annex III.
Same engine. Different audience. Different regime. The product decision and the legal decision are now one decision, and the line cuts right through the middle of every marketplace's product surface.
Two structural carve-outs make the regime tighter still:
Profiling closes the filter. The last subparagraph of Article 6(3) excludes any system that performs profiling on natural persons from benefiting from the filter exemptions at all. The Commission underlines this for targeted job ads (paragraph 250): if the targeting relies on profiling, the system is high-risk, full stop, no narrow-procedural-task escape route available.
Emotion recognition in the workplace is not high-risk — it is prohibited. Article 5(1)(f) treats it as a per se unlawful practice. Any matching, screening, or evaluation system that infers emotion from a candidate's video, voice, or text is outside the high-risk debate entirely. It cannot be deployed at all (paragraph 242).
The job description example shows how granular the verb test is
The clearest illustration of how the line works comes from a second example in the chapter, on page 64, about an AI system that writes job descriptions.
In the first version, a human recruiter sets the requirements — title, qualifications, must-have skills — and the AI only drafts the text. The Commission classifies this as a narrow procedural task under Article 6(3)(a). Exempt from high-risk. The system does not meaningfully influence the application process; it is doing what a copywriter would do.
In the second version, the AI generates the qualifications and skills itself from a high-level brief, or it picks up adjacent tasks that shape how applicants will later be evaluated. The classification becomes conditional. It may be high-risk, depending on how much the upstream choices propagate into the downstream decisions.
In the third version, the same system also evaluates submitted CVs against the job description it wrote. High-risk. No exemption available. The Commission is explicit: a tool that authors the criteria and then scores candidates against those criteria cannot be considered a narrow procedural task, even if every individual step looks innocuous.
The unit of analysis is not the product. It is the verb the model owns. Writes versus decides. Drafts versus evaluates. Suggests versus selects. When you cross the verb boundary, you cross the classification boundary, regardless of how the feature is packaged. A human approving a JD that the model authored and tuned for CV-matching is not enough to pull the system out. The verb has already been delegated.
What the draft rules in, with examples
Read against the catalogue of HR-AI products that have shipped in the last two cycles, the draft closes the door on a long list of patterns that until now were operating in a grey zone. Each of these is named, with a worked example, inside point 4(a). None of them benefit from the Article 6(3) filter.
Automated matching and ranking tools that process structured and unstructured data (CVs, skills, education, past placements, competencies) and produce quantitative scores, rankings or fit categories ("top 5 candidates," "high fit / low fit") for use by internal or external recruiters. The Commission notes explicitly that the existence of human discretion to "review, override, or supplement" recommendations does not change the classification, because the rankings serve as a primary input for decision-making.
Candidate or contractor sourcing tools that search social media, professional sites, job boards, and internal CV databases on pre-defined criteria and generate shortlists. The Commission treats this as direct and meaningful effect on selection, regardless of how the data is gathered or how the shortlist is delivered.
Platform-marketplace matching that ranks self-employed providers for consumers — the example we opened with. Inside scope because the output shapes career opportunities for natural persons.
Targeted job ads on social platforms that go beyond matching strict requirements (accreditations, geography) and prioritise audiences using behavioural or demographic signals. The Commission specifies that when this relies on profiling, the system is automatically high-risk; when it does not, it is still high-risk if it meaningfully conditions who learns about a vacancy.
Employment-agency assignment systems that recommend candidates to vacancies or vacancies to jobseekers based on processed CV data, occupational classifications, and labour-market data, especially when caseworkers rely on the recommendations to manage volume.
Automated background-check systems producing composite risk scores or risk categories from official records, employment history, social-network history, and credit data. The Commission flags the practical problem: even when a human review step is formally present, in practice the system's output heavily influences which candidates advance.
Scoring systems for assessment answers (written or oral) during recruitment, including avatar-driven video interviews evaluating linguistic and substantive criteria.
What survives, on the candidate side, is the inverse: a system that helps the candidate tailor a CV or find the right job, with output shared only with the candidate. That is the design pattern the Commission has explicitly drawn around.
What the draft exempts via the Article 6(3) filter
The other side of the draft is also worth reading carefully, because it tells you what does not need to carry the full Annex III obligations. These systems sit inside the employment use case, but qualify for one of the filter exemptions.
Narrow procedural tasks under Article 6(3)(a) include: verification of professional accreditations against official registries with a binary confirm/not-confirm output; interview scheduling, including accessibility accommodations; sending personalised acknowledgement emails to applicants.
Preparatory tasks under Article 6(3)(d) include: recognising and organising information in submitted CVs into an internal database that recruiters then search themselves. The Commission's framing matters here — the system structures, it does not evaluate.
Detection of decision-making patterns under Article 6(3)(c) covers retrospective bias audits over anonymised historical recruitment data, where the audit does not influence ongoing decisions or assess identifiable persons.
Two more falling outside point 4(a) entirely: generic employer-branding ads not tied to a specific vacancy, and employer reputation monitoring against anonymised online mentions.
The pattern is consistent across the exempt list. Each system performs a clearly defined, limited function whose output does not appreciably shape who gets the job. The moment any of them starts producing evaluative weight — even soft scoring, even indirectly — they cross the line into the high-risk category. The draft is unusually explicit that the test is functional, not nominal.
The grandfather clause and the strategic window
One detail in the broader AI Act text matters more in this draft than it has before. Article 111(2) grandfathers high-risk systems placed on the market or put into service before the date of application of the high-risk rules. Grandfathered systems do not have to comply with Annex III requirements unless they undergo a significant change in design after that date.
For HR-AI vendors, this is the strategic clock. Systems already in production retain their existing legal posture, provided their architecture is not materially modified. Any rebuild, any meaningful change to the model, the scoring logic, or the data plane will pull the system into the new regime. The implication is that vendors will face a choice between freezing legacy systems in place — preserving the grandfather — and rebuilding them properly under Annex III obligations, which carries the full conformity assessment, documentation, logging, and post-market monitoring stack.
The teams I respect in this space have been operating against the second option for over a year already, on the bet that the regulation would land roughly where it has. The teams that bet the other way are now looking at the grandfather as a tactical pause rather than a strategy.
The verb is the unit
The reading of the Commission text most teams will land on this week is that the AI Act got more permissive than expected for some HR features, and stricter than expected for the central matching and evaluation use cases. The Commission has drawn a line that does not match the feature taxonomy product managers use. It matches the legal taxonomy of who decides what about whom.
For marketplaces and platform businesses, the line is more concrete than for almost any other category. The matching engine surfaced to the buyer side carries Annex III. The same engine surfaced to the talent side does not. The data plane can be shared. The product surface cannot.
The translation, for anyone building in this space, is to stop arguing about whether the product is high-risk. The product is not the unit. The verb is the unit. Each verb in the system gets its own classification. The features compose. The risk does too.
The consultation window is open. The text is going to move before it is final. The architectural decisions you make against this draft will be the ones that survive.