AI Act in HR: 7 AI use cases under the regulatory microscope for 2026
From October 28, KRiBSI will start accepting complaints and may impose fines. We compiled seven uses of AI in recruitment and people management that the law either prohibits or classifies as high risk. For each one, we explain what it means for a microbusiness and for a corporation.
From October 28, 2026, the Commission for the Development and Safety of Artificial Intelligence (KRiBSI), the new Polish AI supervisory authority, will obtain full inspection powers. It will be able to examine technical documentation and implementation procedures, issue binding individual opinions, and impose fines. A complaint may be filed by an employee, candidate, client, or competitor. It is enough to identify the AI system, describe the circumstances, and explain what the breach of the EU AI Act or the Polish Act on artificial intelligence systems consists of. The main part of that act has been in force since August 11.
For HR departments, this is a practical change, because AI reached them faster than procedures did. According to the “Cyber Portrait of Polish Business 2026” report by ESET and DAGMA IT Security, 62 percent of employees already use AI tools at work. 10 percent admit they share sensitive company data with open models. Extracting data from CVs is among the most common first AI deployments in Polish companies.
How we compiled the seven use cases
The basis is Annex III to the AI Act, which in point 4 lists high-risk uses in employment, and Article 5 with its list of prohibited practices. We supplemented these with legal analyses and data on implementation costs. We describe each use case according to three criteria:
- legal status: prohibition or high risk, and from when the rules apply,
- company scale: how the same use case looks in a microbusiness with an off-the-shelf system and in a corporation with its own implementation,
- cost on the user side: what the rules require from an employer that buys the system rather than creates it.
One illusion needs to be dispelled right away. A company that buys an off-the-shelf ATS (applicant tracking system) with AI functions is, under the AI Act, a deployer, not a provider. Buying a tool marketed as compliant does not release it from its own obligations. It must use the system in accordance with the provider’s instructions, designate trained people with a real right to intervene, monitor the system’s operation, and store logs for at least six months. It must also inform candidates whose decision was influenced by AI and warn employee representatives before deployment. There is no general exemption for small companies, although the rules assume proportionality to the organization’s scale.
These obligations concern high-risk systems and were originally meant to apply from August 2, 2026. The Digital Omnibus package is meant to postpone them to December 2, 2027. A political agreement was reached on May 7, 2026, but the act is still awaiting formal adoption. The prohibitions from Article 5 of the AI Act and the transparency requirements that entered into force on August 2, 2026, already apply now.
1. CV filtering and analysis
Who it is for: any company that receives more applications than a recruiter can read. In a microbusiness, this is usually a function built into a subscription ATS; in a corporation, often a custom integration. What it offers: quick elimination of applications that do not meet formal requirements.
Limitations: the algorithm learns from the company’s history, including its biases. Starting in 2014, Amazon built a tool that rated CVs on a scale from one to five stars, trained on applications from ten years dominated by men. The system lowered the rating of CVs containing the word “women’s” and downgraded graduates of women’s colleges. In 2017, the project was abandoned. What it requires: real oversight. A recruiter who automatically accepts the ranking because they do not have time to review 800 rejected CVs does not meet this requirement.
2. Targeted job ads
Who it is for: companies that publish openings through platforms that match audiences algorithmically. A small company usually uses the platform’s settings; a large one often outsources campaigns to an agency. What it offers: reaching people with a matching profile.
Limitations: Annex III explicitly lists targeted job ads as high risk. The decision about who even gets to see the offer happens outside the recruiter’s sight. What it requires: knowing on what basis the system selects recipients. When working with an agency, this question is worth putting into the brief and the contract.
3. Candidate assessment and ranking
Who it is for: companies running many recruitment processes at the same time and companies using tests or interviews scored automatically. What it offers: a comparable assessment of a large number of candidates.
Limitations: in the US, the Mobley v. Workday case is ongoing. Derek Mobley claims that since 2017 he has been rejected in more than 100 recruitment processes run by companies using Workday because of age, race, and disability. In July 2024, a federal court held that an AI provider could be liable as the employer’s “agent.” In May 2025, it preliminarily certified a class action. Workday denies the allegations and stresses that its tools do not make hiring decisions. This is US law, not the AI Act, but it is a signal that liability for the algorithm may also extend to the provider. What it requires: documentation on the provider’s side and oversight on the employer’s side.
Prof. Paweł Wajda, in an interview with pulsHR, points to the scale of this change:
Given that AI tools are currently commonly used in recruitment processes, it can safely be said that these changes will affect the entire labor market.
4. Decisions on promotion, working conditions, and dismissal
Who it is for: mainly medium-sized and large organizations with performance review systems and career paths. In a microbusiness, such decisions rarely go through a system. What it offers: it organizes performance data before a conversation about promotion or parting ways.
Limitations: Julie Bedard’s study from Boston Consulting Group was not about promotions, but it shows a general problem of AI oversight. Managers who were told the work had been done by an “AI employee” caught 18 percent fewer errors than those who knew it was an “AI tool.” The takeaway for HR: the more human a system seems, the easier it is for oversight to weaken. What it requires: documented, independent human judgment in every decision.
5. Task allocation and shift scheduling
Who it is for: retail, logistics, manufacturing, courier platforms. What it offers: faster shift scheduling and work allocation.
Limitations: this is a borderline case. High risk covers task allocation based on behavior, personality traits, or personal characteristics. A schedule created solely according to preferences declared by employees is usually outside the scope of the rules. Systems deciding on work allocation on courier platforms are already covered by regulation. What it requires: checking whether the tool only collects preferences or also infers things about people.
6. Performance monitoring and evaluation
Who it is for: remote teams, contact centers, sales. What it offers: an ongoing picture of workload and results.
Limitations: classification depends on profiling, meaning automatic evaluation of a person’s performance, behavior, reliability, or location. An Annex III system that profiles people is always high risk. The exception applies only to narrow procedural tasks that do not significantly affect a human decision and do not involve profiling. What it requires: informing employee representatives before deployment, logs, and oversight.
7. Emotion recognition in the workplace
Who it is for: nobody. What it offers: the promise of assessing “enthusiasm,” “self-confidence,” or “cultural fit” from facial expressions, voice, and body language.
Limitations: Article 5(1)(f) of the AI Act has prohibited this since February 2, 2025, and the postponement of deadlines does not apply to this ban. The rationale is the power imbalance between employer and employee. The exception covers only medical and safety purposes. Biometric categorization that infers race, sexual orientation, opinions, religious beliefs, or trade union membership is also prohibited. As early as 2019, HireVue stopped using facial analysis in video interviews after criticism from the Electronic Privacy Information Center. What it requires: disabling such features in every tool in use.
How much preparation costs, and how much a mistake costs
We did not find data on implementations in HR alone, but general AI costs in small companies provide some guidance. A process audit costs PLN 4,000-6,000, a pilot on one or two processes PLN 5,000-10,000. An AI system with integrations costs from PLN 50,000. Licenses and API access (the interface through which a program connects to the AI model) cost PLN 50-5,000 per month. Only 8.4 percent of Polish companies employing at least 10 people had implemented AI by the end of 2025, compared with the EU average of 20 percent.
On the other side are the fines: up to 35 million euros or 7 percent of turnover for prohibited practices, and up to 15 million euros or 3 percent for other violations. Small and medium-sized companies pay the lower of those limits. The Polish act reduces the fine by 30-90 percent for self-reporting a violation. Complying with KRiBSI recommendations within three months provides for a reduction of 10-50 percent.
The oversight requirement also covers what employees do with AI on their own. Marcin Mika from ADP Polska proposes a simple approach in pulsHR:
Artificial intelligence should be treated like an intern who does not have access to internal information at the level of an experienced employee, and whose work output must be checked before it is released into the world.
Checklist: where to start preparing
Even if the main obligations arrive in December 2027, it is worth doing an inventory now. The bans and complaints are already in effect today.
- List the tools with AI functions used in recruitment and people evaluation.
- Disable emotion, facial expression, and voice analysis features.
- Ask the provider for technical documentation and user instructions.
- Designate a person with the real right to change the system’s decision.
- Prepare information for candidates and employee representatives.
What to choose if…
You are a small company with an off-the-shelf ATS: do not further train the model on your own data and do not label it with your brand. Such a change can make you a provider with the full set of obligations. Choose a tool whose provider will show documentation, and always let a human decide on rejection.
You are a large organization with your own implementations: assume that you may be a provider, not just a user. The review of each system should include the legal department, the privacy team, and IT security, not just HR. If you have doubts, from October 28 you can apply to KRiBSI for an individual opinion.