Description

A focused course, tailored for you

EU AI Act Compliance for HR Technology

For HR IT security professionals who need to classify, document, and operationalize EU AI Act requirements in their HR technology stack.

Recruitment screening tools, performance monitoring analytics, and absence prediction engines are explicitly listed under EU AI Act Annex III as high-risk AI use cases. That classification brings conformity assessments, Fundamental Rights Impact Assessments, technical documentation obligations, human oversight procedures, and a registration requirement in the EU AI Act database. Most HR technology environments have no existing process for any of these.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

An HR IT Security Officer at a financial institution has inherited a technology stack that includes AI-powered features no one formally risk-classified at procurement. The recruitment module scores and ranks candidates. The performance tool flags outliers. The absence management system predicts patterns. Each is now a high-risk AI system under EU law, and the gap between current state and a compliant state is a specific set of documents: the technical documentation package, the Fundamental Rights Impact Assessment, the human oversight procedure, the training data governance record, and the registration entry. The data protection authority and the national AI supervisory body both have jurisdiction over failures, and fines under the EU AI Act reach 3% of global annual worldwide turnover for deployers who fail to meet their Article 26 obligations. The vendor may have supplied a conformity declaration, but deployer obligations are separate and non-delegable.

What you walk away with

Run the Annex III classification test on every AI-powered feature in your HR technology stack and produce a signed classification register with a rationale row for each tool.
Build the technical documentation package that a conformity assessment or supervisory inspection expects to find on day one.
Conduct a Fundamental Rights Impact Assessment for each employment-related AI use case using the Article 27 methodology.
Write the human oversight procedure for your recruitment AI that satisfies Article 14 and can be approved by your Data Protection Officer.
Produce the vendor due diligence questionnaire that extracts the provider-side documentation obligations your HRIS supplier carries under the regulation.
Leave with a 12-month compliance calendar mapped to each Article obligation and an internal owner assigned to every line.

The 12 modules

Module 1. The Annex III Classification Test

EU AI Act Annex III lists employment, workers management, and access to self-employment as a high-risk AI use case. This module walks through the four-step classification test: intended purpose, deployment context, impact on workers, and whether a natural person can meaningfully override the output. You apply the test to each AI-powered feature in your HR technology environment and produce a classification register with a rationale row for every tool and feature in scope.

Module 2. Technical Documentation Requirements for HR AI Systems

Article 11 requires high-risk AI providers to maintain a specific technical documentation package before placing a system on the market. This module maps Article 11 to the HR technology context: general system description, training data summary, intended purpose statement, accuracy metrics and validation approach, and post-market monitoring plan. You build a documentation template that survives a conformity assessment, and you identify which sections your HRIS vendor must supply versus which you complete as deployer.

Module 3. Fundamental Rights Impact Assessment for Employment AI

Article 27 requires certain deployers of high-risk AI systems in employment contexts to conduct a Fundamental Rights Impact Assessment before deployment. This module covers the FRIA methodology for HR AI use cases: identifying affected groups such as job applicants and employees subject to performance monitoring, mapping relevant fundamental rights including non-discrimination and data protection obligations, and documenting residual risks after technical controls. You produce a FRIA template calibrated to recruitment and performance management tools.

Module 4. Training Data Governance Records and Bias Audits

Article 10 requires high-risk AI systems to be trained on data that is accurate, representative, and free from discriminatory patterns. This module covers what the data governance record must contain for an HR AI system: dataset description, preprocessing steps, bias assessment methodology, and training data date range. For procurement scenarios where the HRIS vendor controls the training data, you build the contractual rider that makes the vendor's data governance record auditable by you as deployer.

Module 5. Human Oversight Procedures Under Article 14

Article 14 requires high-risk AI systems to allow human oversight that can interrupt, override, or disregard the AI output. This module translates Article 14 into a workable procedure for an HR technology environment: who holds override authority in the recruitment workflow, what the override log looks like, and how you handle cases where the AI ranked a candidate low but a recruiter wants to proceed. You produce a human oversight SOP that the Data Protection Officer can review and approve.

Module 6. Logging Obligations for High-Risk HR AI

Article 12 requires high-risk AI systems to automatically log the system's operation throughout its lifetime. For HR AI tools deployed by a financial institution, this module explains what the log must capture: activation periods, input data reference without storing the data itself, results produced, and the human review outcome. You build the logging specification to send to the IT vendor, define the retention period under the GDPR Article 5 storage limitation balancing exercise, and identify who holds log access rights.

Module 7. Conformity Assessment: Self-Assessment vs. Notified Body

High-risk AI systems in the employment category require either a self-assessment conformity procedure or a third-party conformity assessment depending on whether the system uses a harmonized standard. This module covers the decision tree for a financial institution deploying a commercial HRIS with embedded AI features: when self-assessment is permissible, what the internal control record looks like, and when you need to engage a notified body. You produce the conformity assessment decision memo for each tool in the classification register.

Module 8. EU AI Act Database Registration

The EU AI Act requires deployers of high-risk AI systems in employment contexts to register the system in the EU AI Act public database before deployment. This module covers who registers, meaning provider versus deployer obligations, which fields are mandatory in the registration form, and how to handle systems already deployed before the employment provision's application date. You complete a registration template for each tool in your classification register and identify the internal signatory for the deployer submission.

Module 9. Vendor Due Diligence for HRIS Suppliers

When the HR AI system is embedded in a commercial HRIS platform, the provider obligations for technical documentation, conformity assessment, and the EU declaration of conformity sit with the vendor. This module builds the vendor due diligence questionnaire you send to your HRIS supplier: documentation they must provide, the declaration of conformity reference, the post-market monitoring SLA, and the incident notification clause. You also map which Article 26 deployer obligations remain yours regardless of what the vendor provides.

Module 10. Serious Incident Notification Under Article 73

Article 73 requires deployers of high-risk AI systems in employment contexts to report serious incidents to the national market surveillance authority without undue delay. This module defines what constitutes a serious incident for an HR AI system, including a bias-driven batch rejection affecting a protected group or a system malfunction corrupting performance data. You build the internal triage procedure, draft the notification template, map the 15-working-day notification clock, and identify who holds sign-off authority for each incident category.

Module 11. NIS2, DORA, and the HRIS as an ICT Third-Party Service

Financial institutions subject to DORA treat the HRIS platform as an ICT third-party service provider. This module maps DORA Article 28 requirements onto the HRIS vendor relationship: the contractual provisions required in the ICT contract, the exit strategy clause, the audit rights provision, and the sub-processor chain disclosure requirement. It also covers where NIS2 obligations for HR system resilience overlap with and extend DORA requirements for the same vendor, so you avoid duplicating assessment work across the two regimes.

Module 12. Building the Ongoing Compliance Calendar

EU AI Act obligations for high-risk employment AI are not a one-time exercise. Article 9 requires the risk management system to remain current throughout the system's lifecycle. This module builds the annual compliance calendar: the classification register review trigger, the FRIA refresh after a significant system update, the logging retention audit, the vendor due diligence refresh cycle, and the post-market monitoring review schedule. You leave with a 12-month task schedule mapped to each Article obligation and an internal owner for every line.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1 and 2 cover the classification and documentation foundation you need before any inspection can begin.

Modules 3 through 5 cover the impact assessment, oversight procedure, and logging obligations that regulators examine first.

Modules 6 through 9 cover conformity assessment, database registration, and vendor due diligence, where financial institutions most commonly have gaps.

Modules 10 through 12 cover incident notification, the NIS2 and DORA intersection, and the ongoing compliance calendar that keeps the framework current without a crisis sprint each time an audit arrives.

What you get with this course

Twelve written modules covering the full EU AI Act compliance lifecycle for HR technology environments.
Classification register template with rationale rows for each tool and feature in scope.
Technical documentation template mapped to Article 11 fields, split by provider and deployer responsibility.
FRIA template for employment use cases under Article 27.
Human oversight SOP template for recruitment and performance AI.
Vendor due diligence questionnaire for HRIS suppliers.
Serious incident notification template and triage procedure.
12-month compliance calendar with Article-level owner mapping.
Hand-built implementation playbook tailored to your specific HR technology environment, delivered alongside course access.
Access to the Art of Service learning environment, provisioned within 24 hours of purchase.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

A growing pile of AI-powered features in the HR technology stack, no classification register, no FRIA, no human oversight procedure, and HR Legal asking whether any of it needs to be registered before the supervisory authority starts asking.

After

A signed classification register, a complete technical documentation package, a FRIA for each high-risk use case, a vendor due diligence record from the HRIS supplier, and a 12-month compliance calendar that keeps the framework current without a crisis-mode sprint each time an audit arrives.

What happens if you do not address this

The EU AI Act's deployer obligations under Article 26 are not contingent on the vendor being compliant. A financial institution that deploys a commercially available high-risk HR AI system without completing its own FRIA, without maintaining oversight procedures, and without registering the system faces fines of up to 3% of total annual worldwide turnover. The national market surveillance authority and the data protection authority both have jurisdiction, and employment AI is one of the categories the European AI Office has flagged for early supervisory attention.

Who it is for

HR IT Security Officers, HR Technology Security Leads, and IT Security professionals with HR systems responsibility at regulated financial institutions operating in the European Union. They understand access controls, data classification, and third-party risk management but have not previously built compliance frameworks for AI systems specifically. They work across HR, IT, Legal, and the Data Protection Officer function to operationalize new regulatory requirements.

Who this is NOT for. AI engineers building models from scratch, HR business partners without systems responsibility, or organizations outside the EU AI Act's geographic scope.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 8 to 10 hours to complete all twelve modules. Most professionals work through two or three modules per session alongside building the artefacts for their specific environment.

Why $199 is the right number

General EU AI Act training courses cover the regulation broadly across all sectors and risk categories. This course is built specifically for the HR technology environment inside a regulated financial institution, where the DORA and NIS2 overlap, the HRIS vendor as ICT third party, and the employment-specific FRIA methodology are the actual problems on the desk. Generic compliance training does not produce working artefacts. Legal advisory engagements produce the artefacts but not the skills to maintain them across system updates and vendor changes.

FAQ

Does this course apply if the AI features are embedded in a commercial HRIS platform rather than built in-house?

Yes. Deployer obligations under Article 26 apply to your organization regardless of whether you built the AI system or procured it from a vendor. Module 9 covers how to extract the provider-side documentation from your HRIS supplier and what your residual obligations are after the vendor provides their conformity declaration.

What is the difference between the FRIA and the Data Protection Impact Assessment we already run under GDPR?

The DPIA focuses on data processing risks to data subjects. The FRIA required under the EU AI Act is broader, covering all fundamental rights affected by the AI system's deployment, including non-discrimination rights, access to employment, and fair treatment obligations that go beyond data protection. Module 3 covers the FRIA methodology and how to run it alongside your existing DPIA process rather than replacing it.

Our HRIS vendor says they will supply a conformity declaration. Does that cover our obligations as deployer?

No. A provider's declaration of conformity covers their Article 16 obligations. Your deployer obligations under Article 26 are separate: the FRIA, the human oversight procedure, the registration, the logging oversight, and the serious incident notification chain. Module 9 covers exactly what the vendor declaration covers and what it does not.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.