Guide

What the EU AI Act bans in hiring, and what it means for interviews

Last updated 11 October 2026

Some AI practices are banned outright under the EU AI Act. This guide explains which ones can touch hiring, the dates, and what to ask a vendor, in plain words.

What is banned under the EU AI Act?

Article 5 of the EU AI Act (Regulation (EU) 2024/1689) lists AI practices that are prohibited outright. Four groups can matter in hiring: inferring emotions in the workplace, categorising people by biometric data to deduce sensitive traits, social scoring, and manipulative or exploitative techniques.

Emotion inference at work (Article 5(1)(f)). The Act prohibits the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the system is intended for medical or safety reasons.
Biometric categorisation (Article 5(1)(g)). The Act prohibits biometric categorisation systems that categorise individual people based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
Social scoring (Article 5(1)(c)). The Act prohibits evaluating or classifying people over a period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, where the score leads to detrimental treatment in unrelated social contexts, or to treatment that is unjustified or disproportionate to the behaviour.
Manipulation and exploitation (Article 5(1)(a) and (b)). The Act prohibits AI systems that use subliminal, purposefully manipulative or deceptive techniques, or that exploit vulnerabilities due to age, disability or a specific social or economic situation, where the system materially distorts a person's behaviour in a way that causes or is reasonably likely to cause significant harm.

Article 5 also covers other practices that are not mainly about hiring, such as untargeted scraping of facial images and real-time remote biometric identification for law enforcement. Whether a particular tool falls inside any of these depends on what the tool does, which is why the vendor questions below matter.

Is the EU AI Act in force yet?

Yes. The EU AI Act (Regulation (EU) 2024/1689) is in force and applies in stages. The Article 5 bans have applied since 2 February 2025, the general date of application was 2 August 2026, and the high-risk rules for the hiring systems listed in Annex III apply from 2 December 2027.

Entry into force. The Act was published in the Official Journal on 12 July 2024 and entered into force twenty days later, on 1 August 2024 (Article 113).
2 February 2025. Chapters I and II apply from this date. Article 5 sits in Chapter II.
2 August 2026. Article 113 says the Act applies from this date, with listed exceptions. Article 50, the transparency rules, is not one of the exceptions. Article 50(1) says AI systems meant to interact directly with people must be designed so that the people concerned are informed they are interacting with an AI system, unless that is obvious.
2 December 2027. The high-risk rules for systems listed in Annex III, which include AI used for the recruitment or selection of people, apply from this date after the 2026 amendment. Annex I products follow on 2 August 2028.

Read the Commission timeline on the day you rely on a date, because the dates were amended in July 2026.

Who does the EU AI Act apply to?

The EU AI Act applies to providers that place AI systems on the market in the Union, to deployers established or located in the Union, and to providers and deployers in a third country where the output of the AI system is used in the Union. Article 2(1) also lists importers, distributors, product manufacturers and authorised representatives.

Article 3 defines a provider as a person or body that develops an AI system, or has one developed, and places it on the market under its own name. It defines a deployer as a person or body using an AI system under its authority, except in a personal non-professional activity. An Irish employer or recruitment agency that uses an AI tool in its hiring will usually fit the definition of a deployer. The company that builds the tool and sells it under its own name will usually fit the definition of a provider. A business can be both.

Article 2(1)(g) also lists affected persons who are located in the Union. Article 2(11) adds that the Act does not stop the Union or a Member State from keeping or introducing rules that are more favourable to workers in respect of AI systems used by employers.

What are the key changes to the EU AI Act in 2026?

Regulation (EU) 2026/1744, adopted on 8 July 2026 and published on 24 July 2026, amended the EU AI Act. It set the Annex III high-risk date at 2 December 2027 and added two new prohibitions, on non-consensual intimate material and child sexual abuse material, which apply from 2 December 2026. The amendment makes other changes not listed here.

New dates. Chapter III, Sections 1, 2 and 3, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those classified under Article 6(1) and Annex I.
Two new bans. New points (ba) and (bb) of Article 5(1) prohibit AI systems that generate or manipulate realistic intimate images, video or audio of an identifiable person without consent, and material within the meaning of the child sexual abuse directive. Neither is about interviewing.
AI literacy. Article 4 is replaced. Providers and deployers now must take measures to support the development of AI literacy of their staff. The earlier text said they must ensure, to their best extent, a sufficient level of it.
Bias detection. A new Article 4a lets providers of high-risk systems, and in stricter conditions other providers and deployers, exceptionally process special categories of personal data to the extent strictly necessary for bias detection and correction, with safeguards.
Generated content. A new Article 111(4) gives providers of systems that generate synthetic audio, image, video or text, placed on the market before 2 August 2026, until 2 December 2026 to comply with Article 50(2).

Regulation (EU) 2026/1744 does not amend Article 5(1)(f), so the emotion-inference ban reads as it did before.

Does the emotion-recognition ban cover job candidates?

The European Commission's guidelines on prohibited AI practices say it does. Paragraph 254 says the notion of workplace in Article 5(1)(f) should also be understood to apply to candidates during the selection and hiring process. The guidelines are not binding, and only the Court of Justice can give an authoritative interpretation of the Act.

The Commission gives its reason in the same paragraph: there is an imbalance of powers, and the intrusive nature of emotion recognition may already apply at the recruitment stage. Its list of examples there includes this one: "Using emotion recognition AI systems during the recruitment process is prohibited."

What counts as emotion recognition matters too. Article 3(39) defines an emotion recognition system as an AI system for identifying or inferring emotions or intentions of people on the basis of their biometric data. The guidelines say:

Emotions are to be understood widely, and the prohibition should not be avoided by calling the result an attitude (paragraphs 247 and 248).
Physical states such as pain or fatigue are not emotions, and merely detecting a readily apparent expression, such as a smile, is not emotion recognition unless it is used to identify or infer an emotion (paragraph 249).
Inferring emotions from facial expressions, body postures or movements, or from typing style, is based on biometric data and is inside the prohibition. Inferring emotions from written text alone is not based on biometric data, and the guidelines say it is outside the prohibition (paragraph 251).

Emotion recognition systems that are not prohibited are listed as high-risk in Annex III, point 1(c), and Article 50(3) of the Act requires deployers of an emotion recognition system to inform the people exposed to it.

Questions to ask a vendor about banned practices

Put these to any vendor of hiring software and ask for the answers in writing.

Does any part of the tool identify or infer emotions, moods or attitudes of a candidate from their face, voice, body movement or typing? If yes, where does the result appear: in a score, a report, a label or a summary?
Does the tool assign candidates to categories based on their face or voice, such as by race, religion, political opinion, trade union membership, sex life or sexual orientation?
Does the tool build a score of a person from their social behaviour or personal characteristics, or reuse data collected for another purpose?
Does the candidate experience use any technique designed to push a candidate towards an answer or a decision without their awareness?
Does the tool exploit vulnerabilities linked to age, disability or a social or economic situation to influence a candidate's behaviour, and how is that tested?
Has the vendor assessed the tool against Article 5, in writing, and who signed that assessment?
Which parts of the report come from the candidate's words, and which come from their face or voice?
Are candidates told what the system does and does not analyse before they start?

About Fios AI

Fios AI is an Irish product in private build. Seamus finds candidates, Cara delivers a test and Aoibheann runs a first interview by video. Candidates are told they are talking to an AI. For each candidate who completes the interview, a recruiter reads the report and decides whether to proceed, hold or decline. Because it ranks and interviews candidates, we treat Fios AI as a high-risk system under Annex III. See how it works.

Related guides

Read The EU AI Act and hiring in Ireland for the high-risk rules, AI interview software for high-volume hiring for what such tools do, and screening questions for job applicants in Ireland for what to ask and what not to.

Sources

This page is general information, not legal advice.