← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for HR tech teams

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Why HR tech is squarely in scope

Annex III, point 4 of the EU AI Act lists employment, workers' management and access to self-employment as a high-risk area. It covers AI systems intended to be used:

for the recruitment or selection of people, in particular to place targeted job ads, analyse and filter applications, and evaluate candidates;
to make decisions affecting terms of work relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of workers.

That describes a large share of what LLM features in HR products do: CV screening, candidate ranking, interview summaries with scores, performance review drafting. An agent that "only suggests" a shortlist can still be part of a high-risk system.

The logging duties that follow

Art. 12 (providers): design the system to automatically record events so its operation is traceable over its lifetime.
Art. 19 (providers): keep those logs, when under your control, for at least six months.
Art. 26 (deployers), meaning the employer using your product: keep logs under their control for at least six months (Art. 26(6)), assign competent human oversight (Art. 26(2)), and, for workplace deployments, inform workers' representatives and affected workers before putting a high-risk system into service (Art. 26(7)).

Your customers, the deployers, will ask you, the provider, for logs they can actually use. See Art. 12 logging, Art. 14 human oversight and retention under Art. 26.

On timing: under the Digital Omnibus agreement, Annex III obligations move to December 2027 (details and caveats). Enterprise HR buyers are already putting these questions into procurement questionnaires.

Why integrity matters more in HR

Hiring and employment decisions are contested: rejected candidates, discrimination claims, works councils, labour courts. In those settings the log of an AI-assisted decision is evidence, and the other side will ask whether it was edited after the complaint.

An export from your database, however complete, is a claim by an interested party. What holds up better:

a hash chain across the run, so a removed step, such as a human override that was never recorded or a tool call quietly dropped, breaks verification;
a timestamped countersignature from an independent party, which the other side can verify without trusting you.

How Vetro Attest fits

Vetro Attest takes the trace your agent already emits, OpenTelemetry GenAI (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

a full EU AI Act report (Markdown and HTML) mapping the run onto logging obligations, including where human oversight shows up in the log;
an ed25519 countersignature by this service over the digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign the runs that produce a screening outcome or an evaluation, and store the attestation with the candidate or employee record for the retention period. Keep personal data minimisation in mind: the countersignature covers a digest, so the attestation itself contains no candidate data.

Limits: the countersignature proves the log verified at a time, not that the decision was fair or unbiased. The report is not a conformity assessment and not legal advice.

Next steps

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.