EU HR AI Risk Checklist

Put a governance structure around the AI behind your people decisions: a guide to what the EU AI Act treats as high-risk in HR, a classifier that flags high-risk, prohibited, or out-of-scope use, the deployer records, and a register that holds the whole inventory.

Four pieces that inventory and govern your HR AI

A guide to read, records you fill in per tool, a workbook that classifies and tracks, and a one-page orientation. Built to be used together across every tool you run.

• HR AI Risk Guide. What the AI Act treats as high-risk in HR, what it bans outright, the duties that fall on you as a deployer, the five risks to manage, and how to govern HR AI without a large team. A PDF to read first.
• Templates and Records. An inventory entry, a classification worksheet, a deployer checklist, a human oversight record, a notice checklist, a vendor questionnaire, and a decision record. A Word file to fill in per tool.
• HR AI Risk Workbook. An AI System Register, a Risk Classifier that flags each tool as high-risk, prohibited, or outside the list, a Readiness Tracker for the actions, and a definitions tab. It works in Excel or Google Sheets.
• Start Here. What each piece does and the order to use them. One page, read it first.

The method in the order governance runs

Classify first, inventory second, then the records and the readiness work. The checklist structures and documents the work; counsel and your data protection adviser handle anything near a banned practice.

• Classify each tool. Read the Guide, then run every tool through the Risk Classifier to see whether it is high-risk, prohibited, or outside the list, and how ready it is.
• Inventory it. Add every tool to the AI System Register so the whole inventory sits in one place.
• Document each one. Fill in the Records for each tool: the classification worksheet, the human oversight record, the notice checklist, and the vendor questionnaire.
• Work the readiness actions. Take the Readiness Tracker actions to done, set owners and due dates, and keep the evidence on file.

Built on the AI Act and honest about its limits

HR AI is the area where a single automated decision can cross a line that carries real legal weight, so the checklist is careful with classification and clear that the timeline is still settling.

• Never a stand-in for legal advice. Anything that may touch a banned practice, such as workplace emotion recognition, a decision no person can change, or a use that crosses borders, carries real legal weight, so the checklist prepares a documented position and tells you when to bring in qualified counsel and your data protection adviser.
• The timeline with the caveat it needs. The Act treats employment AI as high-risk, covering recruitment, selection, performance evaluation, task allocation, worker monitoring, and decisions on promotion or termination. The high-risk obligations were provisionally moved to 2 December 2027 by the Digital Omnibus agreement, which is not yet adopted, so treat that date as the planning baseline and confirm enactment, while the original 2 August 2026 date remains the text on the books.
• What already applies. The prohibited-practice rules and the AI literacy duty have applied since 2 February 2025, and the transparency duty for AI-generated content is set for 2 December 2026, so part of the work is live regardless of the high-risk date.
• Dated and reviewable. The rules are set by Regulation (EU) 2024/1689 and apply on a phased timeline that moves, so every file carries a last-reviewed date and the register keeps the record current.

Who it is built for

Built for

• An HR or people team running recruitment, assessment, monitoring, or scheduling AI with workers in the EU, and no governance structure around it yet.
• A deployer that needs an inventory, a defensible classification, human-oversight and notice records, and a vendor questionnaire in one place.
• A team preparing for the high-risk obligations now, because the inventory, oversight, and records take months to stand up whatever the final date.

If you are looking for

• US multistate AI-in-hiring governance, not the EU Act. The AI Hiring and HR Governance Kit covers the bias-audit, notice, and oversight rules across US locations.
• One AI policy across the whole HR function. The AI in HR Policy and Risk Checklist covers AI use beyond hiring.

Before you buy

What format are the files and can I edit them?

One Guide PDF, one Word file of templates and records, one Excel workbook, and a Start Here PDF. The workbook works in Excel or Google Sheets, everything is editable, and the files are yours to keep.

Is this legal advice?

No. It is general information and a self-review structure for planning. The checklist marks where to bring in qualified counsel and your data protection adviser, and it does not determine that any tool or use complies. Take anything near a banned practice to counsel before you act.

What does the Act treat as high-risk in HR?

AI used in employment decisions: recruitment, candidate selection, performance evaluation, task allocation, worker monitoring, and decisions on promotion or termination. The Risk Classifier flags each tool as high-risk, prohibited, or outside the list.

The high-risk date moved. Why set up now?

The Digital Omnibus agreement provisionally moves the high-risk obligations to 2 December 2027, but it is not yet formally adopted, so the original 2 August 2026 date remains the text on the books. Either way, the inventory, oversight, and records take months to build, and the prohibited-practice and AI literacy duties already apply, so the work starts now.

Does the Act reach a company based outside the EU?

It applies where you operate in the EU or the output of your AI is used on people in the EU. If your hiring or monitoring touches EU-based workers, the deployer duties can reach you, so confirm your position with counsel.

Will it stay current as the rules settle?

This area moves, so each file carries a last-reviewed date and meaningful updates are released as the timeline settles. Confirm the current status of the high-risk obligations before you rely on a date.

What is the refund policy?

Digital products are covered by a 14-day money-back guarantee. See the refund policy for the full terms.

What happens after I buy?

Checkout delivers an instant download link, and a receipt with the same link arrives by email. Open the Start Here page first; it tells you the order to work in. If a file gives you trouble, email support@truestephr.com.

A guide, templates, a workbook, and general business information for planning, not legal or tax advice. The rules are set by Regulation (EU) 2024/1689, the EU AI Act, and apply on a phased timeline that is still settling, so confirm the current rules with qualified counsel and your data protection adviser. Last reviewed June 2026.