Engineering perspectives
AI in Recruitment and HR in Portugal: AI Act, GDPR and Labour Rules (2026)
Which ATS features are high-risk, how to keep human decisions lawful, and what candidates can ask.
5 November 2026 · 7 min read
Recruitment and workforce management are among the highest-intent AI searches in HR: CV screening, interview transcription, sentiment analysis, performance scoring. In Portugal, three legal layers overlap: RGPD, the EU AI Act (employment systems in Annex III), and Portuguese labour law on algorithmic management (Lei 13/2023 and related transparency duties). EURES and EU institutions actively publish candidate rights content in 2026 as transparency rules expand. This guide is for HR directors, recruiters, people ops, legal counsels and IT selecting or building tools — not a generic “future of work” essay. It complements AI Act business checklist, shadow AI policy and enterprise data governance. Damascode integrates ATS, ERP and custom workflows (see Mundimat workforce case study) via software outsourcing and IT consulting.
Table of contents
- Why recruitment AI draws regulators and candidates
- Map of laws in Portugal (AI Act, RGPD, Labour Code)
- Which HR tools are high-risk vs preparatory
- Deployer obligations under Article 26 (simplified)
- RGPD: transparency, minimization, Art. 22
- Portuguese labour transparency (algorithms at work)
- Vendor due diligence checklist
- Human oversight that satisfies auditors
- Bias, fairness and documentation
- Implementation playbook (12 weeks)
- What candidates can ask — and how to answer
- FAQ
- References
Why recruitment AI draws regulators and candidates
| Driver | Effect |
|---|---|
| Volume of applications | Teams accept ATS “auto-rank” to cope |
| Skills-based hiring trend | More structured data → more automation temptation |
| EU AI Act Annex III | Recruitment screening listed as high-risk category |
| Candidate awareness | EU portals explain rights to human review and explanation |
| Shadow AI | Recruiters paste CVs into ChatGPT without DPA |
Bad implementation creates discrimination claims, CNPD complaints, reputational damage and wasted spend on tools that cannot be used lawfully at scale.
Map of laws in Portugal (AI Act, RGPD, Labour Code)
| Instrument | What it regulates for HR AI |
|---|---|
| RGPD | Personal data of candidates and employees; lawful basis; rights; DPIA; automated decision rules |
| AI Act (2024/1689) | Risk classification, deployer duties, transparency, logging, oversight for AI systems |
| Lei 13/2023 (Agenda Trabalho Digno) | Transparency on algorithmic parameters affecting employment access and working conditions |
| Equality law | Non-discrimination; algorithms must not encode prohibited bias |
| Código do Trabalho | Information to works council / employee reps on algorithmic systems (Arts. 424º, 466º parallels) |
AI Act applies directly; CNPD enforces RGPD; ACT (Autoridade para as Condições do Trabalho) enforces labour rules. Align all three in one process map.
Which HR tools are high-risk vs preparatory
Not every HR feature is high-risk. Practical classification for deployers:
| Function | Typical risk tier | Notes |
|---|---|---|
| Grammar check on job ad | Minimal | Still review biased wording |
| Duplicate application detection | Often lower if procedural | Document human decision |
| Ranking/scoring candidates against role | High-risk (Annex III employment) | Full deployer duties by 2027 |
| AI video interview analysis (emotion, tone scoring) | High-risk / prohibited combinations | EURES warns on emotion inference for hiring |
| Scheduling interviews | Usually limited/minimal | |
| Performance monitoring with individual scoring | High-risk workforce management | Overlaps Art. 20 remote surveillance limits |
| Translation of CV | Limited if no profiling | Anonymize where possible |
Art. 6(3) AI Act lists narrow exclusions (purely clerical automation, human-completed work enhancement). Ranking fit to a job profile generally does not qualify — plan for high-risk compliance, do not rely on exclusions.
Timeline: many Annex III employment obligations apply from 2 December 2027 after Digital Omnibus delay; transparency and RGPD apply now.
Deployer obligations under Article 26 (simplified)
As deployer of a high-risk HR AI system you must (non-exhaustive):
- Use the system per provider instructions
- Assign human oversight — competent, trained, empowered to override
- Ensure input data relevance and representativeness where you control inputs
- Monitor operation; suspend if risk emerges; notify provider
- Keep automatic logs at least six months where applicable
- Inform workers’ representatives and affected workers before use
- Inform candidates they are subject to AI-assisted assessment
Build these into RACI before purchase, not after go-live.
| Role | Responsibility |
|---|---|
| HR owner | Process design, candidate comms |
| DPO | RGPD alignment, DPIA |
| Legal | Classification, contracts |
| IT/security | Access, logs, integration |
| Vendor manager | Evidence pack from SaaS |
RGPD: transparency, minimization, Art. 22
Candidates are data subjects. Minimum program:
- Privacy notice — name tools, purposes, retention, rights contact
- Lawful basis — often legitimate interest or pre-contract; document balancing test
- Minimization — do not ingest irrelevant social media scraping
- Retention — delete application data when process closes unless legal hold
- Art. 22 RGPD — if decision is solely automated with significant effect, provide meaningful information, right to human intervention, contest. Most lawful HR flows keep human final decision; document that workflow in screenshots and SOPs
DPIA recommended when systematic monitoring or high-risk AI combine.
Portuguese labour transparency (algorithms at work)
Employers must disclose parameters, criteria, rules and instructions underlying algorithms or AI that affect:
- Access to employment and staying in employment
- Working conditions including profiling and activity monitoring
Provide information through channels required for your company size (works council, union delegates, written policy). This is already enforceable independent of AI Act 2027 dates.
Combine with internal register of:
- Vendor model version
- Features used (rank only vs rank + explain)
- Override rate (% candidates moved by human after AI suggestion)
Vendor due diligence checklist
Before signing ATS AI modules:
| # | Question | Pass criteria |
|---|---|---|
| 1 | Annex III high-risk conformity plan? | Written roadmap + docs by 2027 |
| 2 | EU representative if non-EU provider? | Contact details |
| 3 | Subprocessors and model updates? | Notification SLA |
| 4 | Bias testing methodology? | Published summary or audit report |
| 5 | Explainability for rank score? | Candidate-appropriate explanation |
| 6 | Log export for deployer? | Six-month retention support |
| 7 | Human override in UI? | Demonstrated in sandbox |
| 8 | DPA with AI annex? | Signed |
| 9 | Prohibited use (emotion inference)? | Contractual ban for hiring |
| 10 | Exit plan / data deletion? | Defined |
Reject “black box rank” without logs for regulated sectors.
Human oversight that satisfies auditors
Oversight must be real, not a checkbox:
| Weak | Strong |
|---|---|
| Manager sees only “AI score 87” | Manager sees factors + raw CV + override button |
| Bulk reject top 50% auto | Human reviews borderline band |
| No audit trail | Log: user, time, decision, model version |
| Recruiter trained once | Quarterly calibration on bias scenarios |
Define bands: auto-advance only for clear administrative rules (e.g. missing mandatory certification); everything else human-reviewed.
Bias, fairness and documentation
| Test | Frequency |
|---|---|
| Outcome rate by gender/nationality proxy (where lawful to measure) | Per campaign |
| Keyword bias in job ads | Each posting |
| Score drift after model upgrade | Each vendor update |
| Language fairness PT/EN | If bilingual hiring |
Document negative results too (“no disparity detected at 95% CI on sample X”) with sample size limits stated.
Implementation playbook (12 weeks)
| Week | Deliverable |
|---|---|
| 1–2 | Inventory HR AI; stop shadow paste of CVs |
| 3 | Risk classification memo; DPIA kickoff |
| 4 | Vendor shortlist + due diligence |
| 5–6 | Sandbox on historical data (anonymized) |
| 7 | Candidate notice templates PT/EN |
| 8 | Works council / rep briefing |
| 9 | Pilot one role family |
| 10 | Measure time-to-hire, override rate, quality of hire proxy |
| 11 | Policy update + training |
| 12 | Go/no-go for scale |
Parallel track: company AI policy.
What candidates can ask — and how to answer
Prepare official responses (legal review):
| Candidate question | Principle answer |
|---|---|
| Did AI assess me? | Yes/no + purpose + human role |
| Can a person review? | Yes — how to request |
| What data used? | Categories, not necessarily full algorithm |
| Delete my data? | Process under RGPD timelines |
| Was emotion analyzed? | Should be no for standard hiring |
Train recruiters not to improvise legal answers.
FAQ
Can we use ChatGPT to summarize CVs?
Only on approved enterprise accounts with DPA, minimized data, human final decision, and policy alignment — not personal free tiers.
LinkedIn Recruiter AI — who is deployer?
You are deployer for your hiring process; demand vendor documentation.
Does high-risk mean banned until 2027?
Not necessarily banned — means conformity requirements bite on applicable dates; RGPD and labour transparency apply earlier.
Internal promotions with AI scoring?
Annex III covers decisions on terms, promotion, termination — same rigor as hiring.
Recording video interviews for AI analysis?
Consent, transparency, retention limits; avoid prohibited biometric/emotion uses.
Building custom HR AI in-house?
You may be provider and deployer; budget legal + secure architecture.
Public sector recruitment?
Add procurement and accessibility rules; often stricter transparency.
References
- Regulation (EU) 2024/1689 — Annex III point 4 (employment)
- Regulation (EU) 2026/1744 (Digital Omnibus timelines)
- Lei n.º 13/2023 (Portugal) — algorithmic transparency in employment
- EURES — jobseeker rights in AI hiring (2026)
- CNPD guidance on employment data
- AI Act Portugal community guides (HR chapter)
- Damascode: AI Act checklist, Mundimat case
Integrating HR systems with governed workflows?
Tell us about ATS, ERP and compliance constraints. We scope integration-first delivery from Portugal.