AI Agents in HR & Recruiting: The Future of HR Process Automation for SMEs

The skilled labour shortage is one of the greatest growth obstacles for German SMEs. At the same time, administrative recruiting tasks tie up valuable capacity: screening applications, matching qualifications, coordinating interview slots. AI agents can take that work on. For part of it, however, a regulatory regime applies from December 2027 that most HR departments have not yet registered.

Key takeaway: AI systems for applicant selection are high-risk systems under Annex III number 4 of the EU AI Act. Following the Digital Omnibus the duties covering human oversight, logging and informing employees apply from 2 December 2027, no longer from 2 August 2026. A fully automated rejection is already impermissible today under Article 22 GDPR. Everything that evaluates nobody stays uncritical: scheduling, acknowledgements, status enquiries. That is also where the biggest time saving sits for SMEs.

Where does it hurt in HR?

Mid-sized companies face dual pressure. Qualified candidates are often on the market only briefly, and slow processes mean they decide elsewhere. At the same time, recurring administrative tasks consume a substantial share of capacity in an HR department that is rarely large.

The reflex to solve this with automated pre-selection is understandable. It leads straight into the regulated zone. For most businesses the time saving sits somewhere else, namely where the regulation does not bite.

What is permitted and what is regulated?

The decisive line runs between organising and evaluating.

The good news for SMEs: the first three rows account for the bulk of the administrative load. An agent that acknowledges receipt, requests missing documents and arranges interview slots takes a lot of work off HR without triggering the duties of a high-risk system.

What does the EU AI Act require?

Annex III number 4 of the AI Act names employment and workforce management explicitly: systems for the recruitment or selection of natural persons, in particular for targeted job advertisements, analysing and filtering applications and evaluating candidates. The duties attached to it were originally due to apply from 2 August 2026. The Digital Omnibus (Regulation (EU) 2026/1744) moved the date to 2 December 2027. Anyone choosing a system today should still measure it against these duties, because an applicant tracking system is rarely replaced after a year.

As the deployer of such a system, from that date Article 26 imposes duties on you including:

• Human oversight by suitable people. Whoever monitors the system must be professionally capable and hold the necessary authority. Oversight that cannot in practice overturn a pre-selection is not oversight.
• Operation according to the provider's instructions. Unilateral changes of purpose can make you the provider yourself, with substantially wider duties.
• Appropriate input data. The data fed in must be relevant and sufficiently representative for the purpose.
• Logging. Automatically generated logs must be retained, at least six months, in so far as they are under your control.
• Informing employees. Under Article 26(7) you must inform worker representatives and affected employees before putting the system into use at the workplace.

On top of that comes the literacy duty from Article 4, which has applied since February 2025 and applies to any AI use regardless of risk class. What it requires in practice is set out in our article on the AI literacy obligation.

What does Article 22 GDPR forbid?

Independently of the AI Act, an older limit applies that bites particularly hard in recruiting. Article 22 GDPR gives data subjects the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them.

A rejection in a hiring process meets that condition. In practice:

Impermissible is the flow in which the system automatically rejects below a score threshold and nobody ever sees the filtered-out applications.

Permissible is pre-sorting where a person reviews the pre-selection substantively and can overturn it. What matters is that the review is real. A checkbox confirming a list of two hundred names in seconds is not a human decision but a facade of one.

In addition, Article 86 of the AI Act gives data subjects a right to an explanation of the role a high-risk system played in a decision affecting them.

Why "objective and free of bias" is a fallacy

This promise appears in many proposals, and it is wrong. An AI system is not more neutral than a person; it is differently biased. It reproduces the patterns of its training data and configuration, and it does so evenly across all applications, which means evenly wrongly too.

Legally this matters. The German General Equal Treatment Act (AGG) prohibits disadvantage on grounds including age, sex, origin, religion and disability. And Section 22 AGG reverses the burden of proof: once the claimant presents indications of disadvantage, the employer must prove that no breach occurred.

Anyone who cannot set out the criteria by which a system filtered candidates out cannot carry that burden. Every automated screening therefore needs documentation of the selection criteria and a regular check on whether particular groups drop out unusually often. That check is effort, but it is the only way to keep the liability risk manageable.

What applies to data protection and co-determination?

Applicant data are employment-related data in the wider sense. Section 26 of the German Federal Data Protection Act permits their processing in so far as it is necessary for the decision on entering into an employment relationship. That limits data collection: what is not needed for the specific role may not be collected, not even "for later".

Retention periods follow from purpose limitation. After the process concludes, the documents of rejected applicants are to be deleted, though in practice retention for the duration of the limitation period under Section 15(4) AGG plus a reasonable margin is customary. Longer storage in a talent pool requires separate consent.

The works council holds an enforceable co-determination right under Section 87(1) no. 6 of the Works Constitution Act for technical devices designed to monitor the conduct or performance of employees. Under settled case law, objective suitability for monitoring is sufficient; an intention to monitor is not required. An HR agent that logs processing times regularly falls under it.

A project that involves the works council only after rollout therefore stalls quickly. The information duty under Article 26(7) of the AI Act applies in any case and can sensibly be combined with that involvement.

How to introduce this without running into the regulation

In three steps that deliberately start with the uncritical part.

First: automate the organisation, not the selection. Acknowledgement, requesting missing documents, scheduling, status enquiries. This is where the largest time saving sits at the lowest regulatory cost, and the effect on response speed is immediate.

Second: the summary, not the evaluation. An agent that summarises an application in structured form without assigning a judgement or a rank helps HR read. The moment it sorts or awards points, the classification changes.

Third: automated pre-selection only with the full framework. If it really is needed, it needs documented criteria, a genuine human review instance, logging, works council involvement and a regular analysis for patterns of disadvantage. For most mid-sized businesses with manageable applicant numbers, that effort does not pay off.

Frequently asked questions

Is AI in recruiting a high-risk system under the EU AI Act? Yes, as soon as it concerns selection. Annex III number 4 of the AI Act explicitly names systems for the recruitment or selection of natural persons, in particular for targeted job advertisements, filtering applications and evaluating candidates. Following the Digital Omnibus (Regulation (EU) 2026/1744) the deployer duties apply from 2 December 2027; the original date was 2 August 2026. Pure scheduling and acknowledgements evaluate nobody and do not fall under it.

May an AI reject an application on its own? No, not without human review. Article 22 GDPR gives data subjects the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. A rejection in a hiring process falls under this. What is permitted is pre-sorting followed by substantive review by a person who can also overturn the pre-selection.

Does the works council have to approve AI in recruiting? As a rule yes. Section 87(1) no. 6 of the German Works Constitution Act establishes an enforceable co-determination right for technical devices designed to monitor the conduct or performance of employees. Under settled case law, objective suitability for monitoring is sufficient. Independently of that, Article 26(7) of the AI Act requires informing worker representatives and affected employees before putting the system into use at the workplace.

Can AI screening lead to a discrimination claim? Yes, and the evidential position is unfavourable for employers. Section 22 of the German General Equal Treatment Act reverses the burden of proof once the claimant presents indications of disadvantage. The employer must then prove that no breach occurred. Anyone who cannot document the criteria by which a system filtered candidates out cannot carry that burden. An AI system is not automatically more neutral than a person; it reproduces the patterns of its training data and configuration.

Which HR systems can be connected? Common interfaces exist to established HR platforms such as Personio, Workday and SAP SuccessFactors, as well as to communication channels such as email, WhatsApp and Microsoft Teams. What matters less is the platform and more the question of which fields the agent is allowed to read and write.

Conclusion

AI agents do not replace the human element in HR; they create room for it. The point where things get complicated is not the technology but the evaluation of people. Automate the organisation and leave the selection with people, and you capture most of the benefit without triggering the duties of a high-risk system.

This article was published on 7 July 2026 and fully revised on 11 September 2026: the classification under the EU AI Act, Article 22 GDPR, the AGG and the Works Constitution Act was added, and unverifiable example calculations were removed. On 18 September 2026 the dates were aligned with the Digital Omnibus. It does not constitute legal advice.

---

Sources

• Regulation (EU) 2024/1689 (AI Act), Annex III no. 4 (employment, workforce management), Article 26 (obligations of deployers), Article 86 (right to explanation)
• Regulation (EU) 2016/679 (GDPR), Article 22 (automated individual decision-making)
• Section 26 BDSG - data processing for employment purposes
• Section 22 AGG - burden of proof and Section 15(4) AGG (time limit for compensation claims)
• Section 87(1) no. 6 BetrVG - co-determination on technical monitoring devices
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), new date of 2 December 2027 for high-risk systems under Annex III