← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for recruiting teams and ATS vendors

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 4(a) covers AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. That is the whole hiring funnel: ad targeting, CV parsing with knock-out rules, chat pre-screening, asynchronous video interviews, and shortlists generated by an LLM. For workforce management after hiring, see HR tech.

One line to watch: Article 5(1)(f) prohibits emotion recognition in the workplace, except for medical or safety reasons, and has applied since 2 February 2025. The Commission's guidelines on prohibited practices read it as covering candidates during recruitment. Inferring enthusiasm or honesty from interview video is not a feature to ship.

The logging duties that follow

• Art. 12 (providers): the ATS or screening tool automatically records events, so any rejection can be traced to what the system saw and did.
• Art. 19 (providers): keep those logs, when under your control, for at least six months.
• Art. 26 (deployers), the hiring employer: competent human oversight of the shortlist (Art. 26(2)), logs kept for at least six months (Art. 26(6)), informing workers' representatives before putting the system into service (Art. 26(7)), and informing candidates that a high-risk system is used in decisions about them (Art. 26(11)).

Hiring campaigns often close and get forgotten long before a discrimination claim arrives. The six months run from the log, not from the claim. See retention under Art. 26 and Art. 14 human oversight.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

A rejected candidate's question is simple: was I filtered by a machine, and on what? The log should show the rule that fired, the model's ranking and the recruiter's decision, in order.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"parse_cv","input":{"application":"app_2291","req":"REQ-0457"}}}
{"seq":2,"type":"tool.result","data":{"name":"knockout_check","output":{"work_permit":true,"min_years":"unmet"}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"block","hits":[{"rule":"no-auto-reject","message":"rejection needs recruiter"}]}}
{"seq":4,"type":"tool.call","data":{"name":"queue_review","input":{"recruiter":"rec_08","reason":"knockout_unmet"}}}

The blocked auto-reject and the handoff to a named recruiter are exactly the oversight evidence Art. 14 asks you to design for.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each screening run per requisition, and keep the attestation with the requisition file for the retention period. The countersignature covers only a digest, so it carries no candidate data.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the selection was fair or unbiased. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. Langfuse, vs. OpenTelemetry alone.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.