Examine each AI use, beyond a promise of compliance

In the HR service presented, Upikajob acts as the provider of the AI system and the client as the deployer. Under the GDPR, for HR processing carried out on its behalf, the client is the controller and Upikajob the processor.

The AI Act, an adopted regulation, complements the GDPR: it replaces neither personal data rules nor employment law. A sales presentation or a human sign-off is not an overall certificate of compliance.

The high-risk category covers, among others, certain systems for recruiting, managing, monitoring, or evaluating workers, under Article 6 and Annex III. A review summary or a dashboard is assessed by its actual purpose and effects.

Human review alone does not take a system out of the high-risk regime. You must document the intended use, limits, effective human oversight, and applicable requirements; a module’s name is not enough to conclude.

• Describe the input: data, origin, and purpose of collection.
• Describe the output: draft, summary, suggestion, or indicator.
• Identify the users and the people affected.
• Examine the output’s effect on a decision: can it really be challenged or corrected?

People must be informed when they interact with an AI in situations covered by the transparency obligations. For a review, also explain the purpose, the recipients, and how answers are used.

Meaningful human oversight requires time, understandable information, and the ability to reject or correct the suggestion, not just a “Reviewed by a human” label.

Among other things, the regulation prohibits certain uses of emotion recognition in the workplace based on biometric data, subject to the exceptions it provides. This overview proposes no such use.

Text analysis is not unrestricted for all that: it remains subject to the rules on data and on its purpose. Health or well-being data must not be diverted into named rankings or HR decisions.

According to the CNIL’s Q&A updated on August 17, 2026, deadlines vary by obligation and system category. The table draws on this source without covering every transitional provision.

A future deadline for certain high-risk rules does not suspend obligations that already apply, notably on personal data and transparency. The editorial review date is not a product audit date.

Certain transparency obligations

Apply from August 2, 2026

High risk (Annex III), including certain employment uses

Apply from December 2, 2027

• Intended uses and excluded uses.
• System classification and allocation of responsibilities.
• Instructions for use, known limitations, and human oversight guidance.
• Data, service providers, retention, and transfers.
• Input for the risk assessment and, if required, the data protection impact assessment.

• Read the privacy information
• Prepare your project’s questions