European Union — Artificial Intelligence Act (high-risk hiring systems)
AI hiring lawHigh-risk duties from December 2, 2027Reviewed
What it asks of employers
- Assign human oversight and use the system as instructed. Assign trained people to oversee the automated screening, use it in line with Amp's instructions for use, and monitor how it operates — keeping a genuine human in the hiring decision. This applies from 2 December 2027.
- Tell candidates (and workers' representatives) that high-risk AI is used. Inform candidates that they are subject to a high-risk automated screening system, and inform your workers and their representatives before you put it into use. This applies from 2 December 2027.
- Explain the AI's role in a decision when a candidate asks. When the screening system played a role in a decision that affects a candidate, give them, on request, a clear explanation of the system's role in that decision; Amp's documentation package helps you produce it. This applies from 2 December 2027.
- Assess the impact on fundamental rights before you deploy. Before putting the high-risk system into use, assess its impact on candidates' fundamental rights where the Act requires it (for example, public bodies and certain deployers). This applies from 2 December 2027.
- Tell candidates they are speaking with an AI. Make sure candidates are clearly told they are interacting with an AI system, not a person, and that an AI-generated (synthetic) voice is marked as artificial. This transparency duty applies from 2 August 2026.
What Amp does
- Amp bias-tests and governs the screening system's data and accuracy. Amp tests candidate scoring across demographic groups and applies the same job-related scoring to everyone, and records the results — the data-governance, bias-examination, and accuracy work the AI Act requires of the system provider.
- Technical documentation, logging, and instructions for use. Amp provides a tamper-evident package documenting how the screening system works, its intended purpose, known limits, and how to operate, monitor, and keep a human in the loop — the technical documentation, record-keeping, and instructions the provider must supply to you.
European Union — General Data Protection Regulation (GDPR)
Candidate privacyReviewed
What it asks of employers
- Pick a lawful basis and give candidates the required privacy information. Before you collect candidate data, decide and record your lawful basis for processing, and give candidates the information the GDPR requires (who you are, why, how long, their rights, and any automated decision-making).
- Correct inaccurate candidate data on request. When a candidate says their information is wrong, correct it — in your applicant tracking system if the record is there, or by asking Amp to update data held in Amp, which Amp does through support on request.
- Add safeguards when a hiring decision is made solely by software. If a decision that significantly affects a candidate is based solely on automated processing, make sure you have a lawful ground and give the candidate safeguards — the right to obtain human intervention, to express their view, and to contest the decision — and meaningful information about the logic; Amp's evidence package helps you explain and review it.
- Run a data-protection impact assessment and keep processing records. Because AI-assisted screening is likely high-risk processing, carry out a data-protection impact assessment before you use it, keep records of your processing, and appoint a data-protection officer where required.
- Report personal-data breaches. If candidate data is breached and there's a risk to candidates, notify your supervisory authority within 72 hours, and tell affected candidates when the risk is high.
What Amp does
- Amp answers candidate requests to see their data. When a candidate asks for the personal data you hold, Amp gathers the categories, sources, purposes, and the data itself so you can respond within the one-month deadline.
- Amp carries out candidate erasure requests. When a candidate asks to erase their data, or it's no longer needed, Amp deletes it across candidate records and passes the request to the services that received it.
- Amp provides candidate data in a portable format. When a candidate asks for a copy to take elsewhere, Amp produces the data they provided in a structured, commonly used, machine-readable format.
- Amp keeps candidate data only as long as your policy allows. Amp follows your organization's retention policy and deletes candidate data once it's no longer needed for the purpose it was collected for.
- Evidence of how an automated evaluation was reached. Amp scores every candidate on the same job-related setup and can produce a tamper-evident package documenting the factors and method behind a score, which you can use to give the candidate meaningful information about the logic and to support a human review.
This page is informational only and is not legal advice. Every rule links to the primary source.