AI hiring: AI advises, people decide

Why we started with the candidate

heyree was founded in September 2025 by three cofounders from recruiting and technology. Our public story says the goal is not just to process more CVs, but to stop losing the right people. The candidate first principle includes an answer and respect for every applicant. That makes AI hiring a workflow question as much as a model question: does the system give the recruiter more room for a conversation, or simply make rejection faster?

Separate assistance from candidate evaluation

Drafting a message or organising information is not the same as ranking applicants. AI outputs still need checking in either case, but the consequences differ. heyree's About us page identifies Ree, CV scoring and candidate verification as part of the AI work led by Adrián Horváth. Candidate evaluation deserves particular scrutiny: what evidence is used, what information is missing, and could a score cause a recruiter to overlook someone? Do not treat a recommendation as an established fact.

Which AI hiring uses are high risk in the EU?

The AI Act's Annex III, point 4(a), lists recruitment and selection uses such as placing targeted job ads, screening or filtering applications and evaluating candidates. Article 6(3) allows limited exceptions for systems that do not pose a significant risk and meet specific conditions, for example certain narrow procedural or preparatory tasks. Systems profiling natural persons in these listed uses remain high risk. The classification is about intended use and impact, not simply whether the product is called an AI ATS.

Human oversight has to change the decision

Under the high risk framework, oversight must allow someone to understand the system's limitations, recognise automation bias and disregard or override its output. My practical recommendation is to keep the original application accessible and allow the recruiter to challenge a recommendation without fighting the workflow. A person who merely approves every score is not meaningful oversight. Hiring criteria should also be relevant to the role; subjective assumptions about personality or team fit can carry bias even when a human makes them.

GDPR already protects candidates

GDPR Article 22 gives people the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to specific exceptions and safeguards. Recruitment rejection can have that significance. Where an exception applies, the required safeguards depend on its legal basis; human intervention, expressing a view and contesting a decision are important protections. Employers also need a lawful basis for processing, clear privacy information, suitable retention and security, and a data protection impact assessment where processing is likely to create high risk. Consent is not a universal shortcut.

Do not infer workplace emotions with AI

The AI Act prohibits AI used to infer emotions in the workplace, except for medical or safety reasons. That prohibition has applied since 2 February 2025. Claims that facial expression or voice analysis reveal a person's emotions should therefore trigger legal review, not enthusiasm for a new interview feature. Separately, providers and users of AI systems must take measures to support staff AI literacy under the amended Article 4. People need to know how to check an output before being asked to rely on it.

What applies now, and what comes next?

As checked on 13 October 2026, Regulation (EU) 2026/1744 has amended the AI Act. The rules for high risk systems listed in Annex III, including covered recruitment uses, apply from 2 December 2027. This later date does not suspend GDPR, employment or discrimination law, or the AI Act prohibitions already in application. When the high risk duties apply, Article 26 also requires informing affected people where such a system makes or assists decisions about them. Preparing a clear candidate explanation now is sensible practice, not a promise of automatic legal compliance.

Start with one accountable workflow

For a first AI hiring trial, I would choose one administrative bottleneck, set relevant evaluation criteria and name the person responsible for checking results. Review mistakes as well as time saved. Tell candidates how their data is used and how to reach a person. heyree's public principles give the direction; the employer still needs to verify the actual configuration, documentation and legal obligations for its own process.

Sources and further reading

• heyree: About us and the founders' story
• EU AI Act: Article 6, Articles 14 and 26, Annex III
• Digital Omnibus on AI: Regulation (EU) 2026/1744
• GDPR: Articles 5, 6, 13, 14, 22 and 35

The heyree story is based on its public About us page. EU rules are summarised as checked on 13 October 2026. This is general information, not legal advice or a compliance certification of heyree.