The EU AI Act's high-risk hiring provisions take effect on 2 December 2027. For recruitment agencies using AI in candidate assessment, this changes what tools you can use, what documentation you need, and what your clients will expect. Here's the practical breakdown.
If your recruitment agency operates in the EU — or serves EU-based clients — the 2 December 2027 deadline is now on your compliance radar.
That's when the EU AI Act's high-risk provisions for hiring AI take effect. Every recruitment agency using AI tools in candidate assessment will need to document what those tools do, how they've been evaluated for bias, and what oversight sits around their outputs. The provisions were formally agreed and originally scheduled to activate sooner — the December 2027 date was set as part of the negotiated delay to give the ecosystem time to prepare.
For CV formatting tools specifically, the picture is more nuanced than for full AI screening or decision-making systems. This guide covers what the EU AI Act actually requires, where CV formatting tools sit within the framework, and how recruitment agencies should evaluate their vendor stack ahead of the December 2027 deadline.
Note: This article is written for recruitment agency operations leaders and is not legal advice. Compliance obligations depend on specific tool functionality, agency operations, and jurisdiction. Consult qualified legal counsel for definitive guidance.
The Basics: What the EU AI Act Actually Covers
The EU AI Act — passed in 2024 and rolled out in phases — categorises AI systems into four risk tiers: unacceptable risk (banned), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated).
Hiring AI is classified as high risk. Specifically, AI systems used for:
- Sifting or evaluating candidates
- Making or informing hiring decisions
- Assessing candidate suitability for a role
- Ranking or scoring candidates
- Automated interview evaluation
Systems in this category face significant obligations: mandatory bias audits, technical documentation, human oversight requirements, transparency to candidates, ongoing performance monitoring, and CE marking equivalent.
For recruitment agencies, this creates two questions: which tools in your current stack are covered, and what does your agency itself need to document?
Where CV Formatting Tools Sit in the Framework
CV formatting tools — specifically tools whose primary function is reformatting candidate CVs into a branded template — are generally not classified as "high-risk hiring AI" under the EU AI Act.
The distinction that matters: is the tool making or informing hiring decisions, or is it purely processing content?
A CV formatting tool that does this is typically NOT high-risk:
- Parses candidate CV content
- Applies agency branded template
- Standardises dates, titles, formatting
- Removes candidate identifiers for blind screening
- Outputs formatted documents
A CV formatting tool that ALSO does this MAY BE high-risk:
- Scores or ranks candidates
- Recommends candidates for specific roles
- Predicts candidate suitability
- Generates candidate "fit" ratings
- Auto-decides which candidates progress
The distinction is functional. CVFormatter, for example, focuses on formatting, branding, standardisation, and anonymisation — content processing rather than candidate evaluation. It doesn't score candidates, doesn't rank them, doesn't make progression decisions. That functional scope places it outside the high-risk category as currently interpreted.
However — and this matters — the recruitment agency using any tool remains responsible for the overall hiring process. If your agency uses a CV formatting tool alongside separate scoring or ranking tools, the combined workflow is what regulators evaluate, not each tool in isolation.
What Recruitment Agencies Themselves Need to Do
Beyond vendor selection, the EU AI Act creates obligations for recruitment agencies as deployers of hiring AI. Even if the individual tools in your stack are relatively low-risk on their own, your agency's overall use of AI in hiring likely triggers some obligations.
Areas most agencies will need to address:
Documentation of AI use. Comprehensive record of which AI tools are used at which stages of your recruitment workflow, what they do, and what human oversight sits around each.
Bias audit documentation from vendors. For any AI tool that touches candidate evaluation, you'll need documentation from the vendor about how the system has been assessed for bias — including protected characteristics like age, gender, ethnicity, disability status.
Candidate transparency. Candidates must be informed when AI is used in their assessment. This affects your outreach messaging, application flows, and privacy notices.
Human oversight processes. Documented processes showing that AI outputs are subject to meaningful human review — not just rubber-stamped.
Impact assessment. For high-risk AI use, a formal impact assessment covering the risks the system creates and how you mitigate them.
Ongoing monitoring. Regular review of AI system performance, including performance across different candidate demographics.
For agencies operating only in non-EU markets, the direct legal obligations don't apply — but many clients (particularly multinationals with EU operations) are extending EU AI Act requirements globally as a matter of policy. This effectively makes EU AI Act compliance a global standard for competitive recruitment agencies.
Questions to Ask Every AI Vendor in Your Stack
Ahead of December 2027, agencies should systematically evaluate every AI tool they use. The core questions:
What does the tool actually do? Content processing, candidate evaluation, decision support, autonomous action? The answer determines the risk category.
Is it classified as high-risk under the EU AI Act? Vendors should be able to give you a clear position on this — and increasingly should provide written documentation.
What bias audits have been conducted? Even for tools outside the strict high-risk definition, bias audit documentation is becoming a de facto requirement.
How is candidate data processed? Data residency, retention policies, and processing purposes all matter for compliance beyond the AI Act itself (GDPR interactions).
What documentation does the vendor provide for your compliance? Some vendors are proactively providing compliance packs; others expect you to build the documentation yourself.
How are updates handled? AI systems change over time. Vendors should have processes for informing you of material changes to system behaviour.
Is there transparency about how outputs are generated? For evaluative tools, the ability to explain outputs to candidates and to auditors matters.
How CVFormatter Approaches EU AI Act Considerations
CVFormatter's design places it in the content processing category rather than the candidate evaluation category:
Formatting and standardisation. CVFormatter reformats candidate CVs into your agency's branded template. It doesn't rank, score, or evaluate candidates.
Anonymisation. Candidate names, contact details, and company names can be removed or replaced with accurate industry descriptors. This is content processing, not decision-making.
AI features (proofreading, summarisation, rewriting) operate on content, not on evaluation. These features improve the polish of the output — they don't make judgements about whether the candidate should progress.
No scoring, ranking, or predictive fit ratings. CVFormatter doesn't tell you whether a candidate is suitable for a role. That judgement remains with the recruiter.
Human oversight built into the workflow. Every formatted CV is reviewed by a human before submission. There's no autonomous decision path.
Book a free demo here to discuss how CVFormatter fits into your agency's compliance planning.
Data Handling
Data residency and processing. CVFormatter operates under Aimanack LLC (Wyoming, USA) with sub-processors including GCP (candidate file storage), MongoDB Atlas (extracted CV data), AWS, and Microsoft Azure. Standard Contractual Clauses are in place for international transfers.
Retention. Candidate data is retained within the agency's account until deleted by the agency. The system doesn't process candidate data for purposes other than the specific formatting task requested.
Access controls. Role-based access (Owner, Admin, Member) supports the accountability requirements agencies need to demonstrate.
Documentation. CVFormatter's Terms of Service, Privacy Policy, and DPA are published and available to review during procurement.
What Agencies Should Do Between Now and December 2027
Practical timeline for recruitment agency preparation:
Q3-Q4 2026: Inventory current AI tool stack. Categorise each by function (content processing vs candidate evaluation). Request initial compliance documentation from vendors.
Q1 2027: Complete vendor documentation review. Identify tools where compliance evidence is weak or missing. Begin conversations with vendors about their compliance roadmaps.
Q2 2027: Update internal processes. Document AI use at each stage of your recruitment workflow. Update candidate-facing materials (privacy notices, application flows) to include AI transparency where required.
Q3 2027: Complete bias audit documentation for any high-risk AI tools. Update client-facing materials about your compliance posture.
Q4 2027: Final compliance check ahead of December deadline. Ensure human oversight processes are documented and demonstrable. Confirm ongoing monitoring procedures are in place.
Agencies that leave this to Q4 2027 will likely find their vendor stack has significant gaps — and won't have time to remediate them before the deadline.
The Bigger Picture: Compliance as Competitive Advantage
For most recruitment agencies, EU AI Act compliance won't create competitive advantage on its own. But lack of compliance will actively hurt agencies competing for enterprise mandates, EU-based clients, and multinational clients extending EU standards globally.
Client procurement processes are increasingly asking for AI compliance documentation as standard. Agencies that can respond quickly and comprehensively signal operational maturity. Agencies that can't — or that have to scramble when asked — signal the opposite.
Practical framing: EU AI Act compliance is table stakes for competitive recruitment through 2027 and beyond. It's the price of admission to serious client relationships, not a differentiator. But the price of admission is going up, and agencies without their house in order will find certain doors closed.
The full pricing breakdown for CVFormatter is published on the website. Monthly plans start at $79/month for 100 CVs with unlimited team members and no per-seat fees.
Quick FAQ
Q: If I only work with UK clients, does the EU AI Act apply to me? Directly, no. But the UK is developing analogous frameworks, and many UK clients (particularly larger enterprises) are aligning with EU standards as a matter of policy. In practice, treating EU AI Act as the compliance baseline is prudent.
Q: What about clients in the US, Australia, or South Africa? Similar picture. NYC Local Law 144 already imposes bias-audit requirements for automated employment tools. Colorado's AI Act has similar provisions. Australia and other markets are developing frameworks. Aligning with the strictest applicable standard is generally the operational approach.
Q: Is CVFormatter's AI classified as high-risk under the EU AI Act? Based on current functionality and interpretation, CVFormatter's core capabilities (content processing, formatting, standardisation, anonymisation) are outside the high-risk hiring AI category. Agencies should still document their overall AI use — the tool being outside the high-risk category doesn't remove agency-level documentation obligations.
Q: Will vendors provide compliance documentation on request? Serious vendors will. If a vendor can't provide documentation of how their AI has been evaluated, or is evasive about compliance questions, that's a signal about the vendor's maturity.
Q: Does this apply to us if we're a small agency (5-10 recruiters)? Compliance obligations don't have a size exemption. However, the specific documentation burden may be proportionate. Small agencies focusing on non-evaluative tools have a lighter compliance load than large agencies deploying sophisticated AI-driven screening.
Final Thoughts
The EU AI Act deadline is 18 months away as of mid-2026. That sounds like a long time, but for agencies with meaningful AI use across their recruitment workflow, the compliance preparation is substantial — and most vendors will be under pressure closer to the deadline. Getting ahead of this now is significantly cheaper and less disruptive than remediation later.
CV formatting tools are one of the simpler categories to navigate because most focus on content processing rather than candidate evaluation. That makes them lower-risk from a compliance perspective — but doesn't remove the responsibility to document your overall AI use.
CVFormatter's positioning as a content-processing tool (not a candidate-evaluation tool) makes it straightforward to place within a compliant workflow. But the broader compliance question — what does your whole AI stack look like, and can you document it? — is the one every recruitment agency needs to answer before December 2027.
Start your free trial or book a demo to see how CVFormatter fits your agency's compliance planning.