Use case assessment
Is AI CV screening worth building?
Technically straightforward and legally the most expensive thing on most AI roadmaps.
This is real AI and it is explicitly Annex III high-risk under the EU AI Act. The build is the easy part; the obligations attached to it are not.
What it usually means
Ranking, filtering or scoring job applicants automatically, whether that is keyword matching against a job description or a model assessing fit.
Is it genuinely AI?
Yes, and that is not the interesting question here. Semantic matching between a CV and a role genuinely benefits from a model — the same experience gets described in wildly different vocabulary, and keyword filters miss good candidates for that reason alone.
The interesting question is what attaches to it.
What the EU AI Act says
Annex III lists employment, worker management and access to self-employment as a high-risk area. AI systems used for recruitment or selection — including to filter applications and evaluate candidates — fall inside it.
Following the Digital Omnibus amendments, Annex III high-risk obligations apply from 2 December 2027. That is not a reason to defer thinking about it, because the obligations are the sort that have to be designed in rather than retrofitted: risk management, data governance, technical documentation, logging, human oversight and accuracy testing.
And Article 25 matters here more than almost anywhere. If you buy a screening tool and put your own branding on it, or change what it is used for, you can acquire provider obligations rather than deployer ones.
What the simpler version looks like
Structured application questions with knockout criteria you can state out loud. Not "rank these 400 CVs" but "which of these applicants have the right to work, the required certification and the stated minimum experience." Those are facts, an applicant can answer them directly, and the filter is explainable to anyone who challenges it.
That handles the volume problem for most roles, and it does not put you in Annex III.
What it costs to run
Substantially more than the inference. Bias testing across protected characteristics, documented and repeated. Human oversight that is effective rather than nominal. Logging retained. An appeals path for rejected candidates. Technical documentation maintained as the system changes.
Set that against the time saved. For a company hiring at moderate volume, the compliance cost per hire frequently exceeds the screening time per hire, and that calculation is the assessment.
When it is worth building
At genuinely high volume, where the screening burden is measured in FTE rather than hours, and where you have the governance capability to carry Annex III obligations properly.
Not because the ATS vendor added an AI toggle. That toggle can move a compliance posture without anyone deciding to.
Common questions
Is AI CV screening high-risk under the EU AI Act?
Yes. Annex III lists employment, worker management and access to self-employment as a high-risk area, and AI used to filter applications or evaluate candidates falls inside it. Following the Digital Omnibus amendments, those obligations apply from 2 December 2027.
What obligations come with high-risk classification?
Risk management, data governance, technical documentation, logging, effective human oversight, accuracy and robustness testing, and post-market monitoring. These have to be designed in rather than retrofitted, which is why the December 2027 date is not a reason to defer.
What is the alternative to AI CV screening?
Structured application questions with knockout criteria you can state out loud: right to work, required certification, stated minimum experience. Those are facts rather than judgements, the applicant answers them directly, and the filter is explainable when challenged.
Does buying an AI screening tool keep us out of provider obligations?
Not reliably. Under Article 25, putting your name or trademark on a high-risk system, modifying it substantially, or changing its intended purpose can transfer provider obligations to you.
Scoring 40 AI use cases in a regulated enterprise — how the governance surface changes what a use case is actually worth.