What does the EU AI Act require for engineering hiring?_

Does the EU AI Act apply to your hiring process?

Most likely yes, if you use an AI system to recruit, screen, or evaluate candidates. Regulation 2024/1689 names employment as a high-risk domain, and Annex III Section 4 covers systems used for recruitment, application screening, and candidate evaluation.

The obligations reach deployers, the organizations that use these systems in their hiring, alongside providers, the organizations that build and supply them. Many employers are deployers even when a vendor built the tool.

The reach is extraterritorial. A company based outside the EU can fall in scope when its system assesses candidates for roles in the EU, or when the outputs are used inside the EU. Article 111 sets transition provisions for systems already on the market, so timing can vary. Confirm how it applies with legal counsel.

What must be in place by December 2027?

High-risk obligations for hiring apply from December 2, 2027. The AI Omnibus, which entered into force on July 27, 2026, moved them from the original date of August 2, 2026. By then, deployers need a defined set of controls in place. In plain language, that means human oversight of decisions, documentation and record-keeping, adverse impact monitoring, and evidence you can produce on request.

The Act has had 2 rules in force since February 2, 2025: employers must take steps to help staff understand the AI they use, and they may not use AI to read people’s emotions at work, except for medical or safety reasons.

A human should review and own every hiring decision, with no automated rejection. Records should show how a decision was reached and what evidence supported it.

The checklist further down mirrors these obligations so a talent or engineering team can work through them line by line. Because the obligation set is detailed and guidance is still arriving, treat the checklist as a working aid and confirm the full list with legal counsel.

Where does a coding assessment sit under the Act?

A coding assessment sits under the Act wherever AI or machine learning makes or materially informs the hiring decision. That single question does more to place your assessment than any product label.

Both carry obligations, so both sides of the relationship matter: the vendor is often the provider of the system, and the employer is usually the deployer.

Codility’s posture is deterministic scoring, with no AI or machine learning making automated hiring decisions on the platform. AI Follow-Up Questions are intentionally not scored, so they inform a human reviewer rather than drive an outcome. Final compliance depends on customer configuration, so confirm how your own deployment is set up.

What evidence should you demand from any assessment vendor?

Demand evidence that the assessment is fair, documented, and reviewable by a human. Four items carry most of the weight: adverse impact data at every cut score, linguistic fairness auditing, a technical manual, and reviewable evidence trails.

Codility monitors adverse impact to the EEOC four-fifths threshold at every measured cut score. A cApStAn linguistic audit found 65 percent of tasks at or below B1 CEFR, which helps fairness for non-native English speakers. The Technical Manual is structured to APA Standards, and every result carries a reviewable evidence trail.

Accessibility belongs in the same request. Ask for conformance to WCAG 2.2 AA, so candidates are not disadvantaged by the tool itself.

What does this have to do with cheating and integrity controls?

Candidate monitoring is itself in scope, so integrity controls need the same defensibility as your scoring. Behavioral monitoring and risk scoring process candidate data, which brings them squarely into the compliance conversation.

Codility’s integrity risk level is deterministic, with four bands from None to High, and a human confirms every flag. A signal informs a decision, and it never triggers an automated rejection.

Our companion article on preventing cheating in coding assessments covers the layered controls in full, and it shares the same evidence-first posture this piece describes.

What happens before the rules apply?

Further guidance will keep arriving before December 2, 2027, so treat compliance as ongoing work you maintain.

This page carries visible published and last-updated dates, and it will be updated as guidance lands. We updated it on October 21, 2026, after the AI Omnibus moved the high-risk date for hiring to December 2, 2027.

The through-line is simple: defensible hiring is designed, not bolted on. Teams that build oversight, documentation, and reviewable evidence into the process before the date will only need to confirm what they already do. Teams starting now have time to close the gap, and the checklist below is where to start.

The EU AI Act hiring readiness checklist

The checklist below mirrors the obligations in this article. It doubles as a working document for talent, engineering, legal, and procurement. Confirm the complete obligation set with legal counsel before you rely on it.

Scope

• Confirm whether your recruitment, screening, or candidate-evaluation tools use an AI system covered by Annex III Section 4.
• Identify your role for each system: provider, deployer, or both.
• Confirm whether the Act reaches you through extraterritorial scope, for example assessing candidates for roles based in the EU.
• Check whether Article 111 transition provisions affect the timing for any system already in use, and confirm with legal.
• Confirm the 2 rules in force since February 2, 2025: staff who use AI get help to understand it, and no tool reads people’s emotions at work, except for medical or safety reasons.

Obligations that apply from December 2, 2027

• Confirm a human reviews and owns every hiring decision, with no automated rejection.
• Keep documentation and reviewable evidence trails for each assessment and decision.
• Monitor adverse impact at every cut score you use.
• Record where AI or machine learning sits in your scoring path, and whether it makes or materially informs any decision.

Vendor evidence to request

• Adverse impact data at every cut score.
• Linguistic fairness auditing evidence.
• A technical manual you can hand to legal and procurement.
• Reviewable evidence trails on every result.
• Accessibility conformance to WCAG 2.2 AA.

Integrity and monitoring

• Confirm candidate monitoring is proportionate and its data handling is documented.
• Confirm integrity signals inform a human decision and never trigger an automated rejection.
• Confirm any risk scoring is explainable, for example deterministic bands rather than an opaque model.

Frequently asked questions

When do the EU AI Act rules for hiring apply?

The EU AI Act classes AI systems used in recruitment and candidate evaluation as high risk. The AI Omnibus, a 2026 package of amendments to the Act in force since July 27, 2026, moved the high-risk obligations for these systems to December 2, 2027, from the original date of August 2, 2026. The Act has had 2 rules in force since February 2, 2025: employers must take steps to help staff understand the AI they use, and may not use AI to read people’s emotions at work, except for medical or safety reasons.

Is a coding assessment a high-risk AI system under the EU AI Act?

It can be. If the assessment uses an AI system to recruit, screen, or evaluate candidates, Annex III Section 4 places it in the high-risk category. A deterministic assessment with no AI or machine learning making or materially informing the decision changes that analysis. Confirm the scoring path with your vendor, because final classification depends on how the system is configured and used.

What are the fines for non-compliance?

Fines run up to EUR 15 million or 3 percent of global annual turnover for the relevant violations under the EU AI Act. The reach is extraterritorial, so companies outside the EU can be exposed when they assess candidates for roles in the EU. Treat the figure as a ceiling, and confirm the exact tier with legal counsel for your situation.

Does Codility use AI to make hiring decisions?

No. Codility scores assessments deterministically, and no AI or machine learning makes automated hiring decisions on the platform. AI Follow-Up Questions are intentionally not scored. Results are one input for a human reviewer, backed by a reviewable evidence trail, so a person always makes and owns the final call rather than any model.

What is a deployer under the EU AI Act?

A deployer is the organization that uses an AI system in its own processes, for example an employer running an AI-based assessment to screen candidates. The provider is the organization that builds and supplies the system. Both carry obligations under the Act, and many employers are deployers even when a vendor is the provider of the tool.

Does the Act apply to companies outside the EU?

Yes. The EU AI Act has extraterritorial reach, so a company based outside the EU can fall in scope when its AI system assesses candidates for roles in the EU, or when the outputs are used inside the EU. Confirm your specific exposure with legal counsel, because it depends on where your candidates and roles sit.

What should I ask my assessment vendor about the EU AI Act?

Ask where AI or machine learning sits in the scoring path, and whether it makes or materially informs any decision. Request adverse impact data at every cut score, linguistic fairness auditing, a technical manual, and reviewable evidence trails. Finally, ask who makes the final call, and confirm that a human owns every decision with no automated rejection.