AI offers many opportunities in HR, from CV screening to the automatic generation of job descriptions. At the same time, however, it also brings risks: bias in the data, a lack of transparency, and even unintended discrimination. The EU AI Act was therefore introduced to identify these risks and promote the responsible use of AI.

The EU AI Act distinguishes between four levels of risk, depending on the application (not the tool itself). In other words, what matters most is what you do with AI, not whether you use ChatGPT or another model.

Below is a helpful visual overview of the different risk levels:

If you use AI to make decisions about people—such as determining who advances in a recruitment process, who gains access to training opportunities, or who is identified as a high-potential employee—you fall within the “high-risk” category of the AI Act. And with that come additional responsibilities.

Some of the key expectations set by the legislation include:

• Establishing a risk management system: you must be able to demonstrate that you understand the risks associated with your AI application and how those risks are monitored.
• Appointing a responsible owner: this responsibility is often assigned to a multidisciplinary AI board (for example, involving representatives from HR, IT, Legal, and the business).
• Ensuring transparency: individuals affected by the system must be informed that AI is being used, for example during recruitment procedures.

In many cases, compliance is primarily about thinking things through carefully and documenting decisions properly, rather than simply working through complex compliance checklists.

AI in HR is often presented as an efficient solution, but without critical oversight it can produce undesirable or even harmful outcomes, even when the intentions are good.

Example: using the “ideal profile” as a starting point

Imagine you develop an AI model to screen job applications. To train the system, you use historical data from successful candidates. The data shows that people who performed well in the past:

• have a master's degree,
• have at least 3 years of work experience,
• and write fluent Dutch.

The model therefore learns: “People with these characteristics perform well.” Sounds logical... until you realize what is not included in the data:

• Candidates who were never invited because they were considered “too junior”
• Profiles with strong competencies but less traditional career paths
• Anyone who was previously excluded due to bias in the initial screening

The result? Your AI unintentionally reinforces the blind spots of the past. You keep recruiting the same type of profile and exclude valuable, diverse voices. And all of this can happen without you immediately noticing it.

You do not need to be a data scientist to start taking steps towards safe AI in HR today. During the webinar, Jos shared several accessible actions that every HR professional can take:

1. Create an inventory of your AI use cases

Which applications are you already using today (e.g., for job descriptions, internal mobility, reporting, etc.)? And do they fall into the low-, medium-, or high-risk category?

2. Start with low-risk applications

AI is ideal for tasks such as drafting standard communications or extracting structured information from unstructured data (for example, extracting specific information from CVs or cover letters). These are areas where you can experiment with minimal risk.

3. Ask critical questions to suppliers

Are you the “provider” (= the party that develops or builds the AI system) or the “deployer” (= the party that uses or implements the AI system within an organization)?

Most HR teams are deployers. You purchase a tool or implement an AI system, but you do not develop it yourself. However, according to the AI Act, you are still partly responsible for how the system behaves and the impact it has. Therefore, ask your supplier:

• What data was used?
• How is bias monitored?
• Do they have an ISO certification for AI risk management?

Tip: use the AI Act Explorer as a guide to analyze your risks.

The EU AI Act may sound complex, but its core principles are familiar: know what you are doing, communicate transparently, and take responsibility. AI in HR does not have to be a black box, as long as you approach it with common sense and a critical mindset.

“Start small,” Jos advised. “And build from there. That is almost always better than waiting for the perfect system.”

Take inspiration from the Yields story and discover how your organization can also unlock value from HR data. Would you like to start exploring your own HR data? Or even more inspiration on HR analytics? Be sure to subscribe to our bi-monthly newsletter for tips, trends, and insights on HR analytics, or feel free to contact us.