Does the EU AI Act apply to staffing agencies using Bullhorn?

Yes. Staffing agencies using Bullhorn's AI features to screen, match, or rank candidates for EU-based roles are deployers of high-risk AI under Annex III Category 4. The deployer is the entity putting the AI into service in a professional context — that is the staffing agency, not just the end-client employer. Agencies must add candidate disclosure, ensure human oversight, and retain decision logs.

Is Bullhorn AI high-risk under the EU AI Act?

Bullhorn's AI-powered candidate matching, ranking, and predictive sourcing features are high-risk under EU AI Act Annex III Category 4. The basic CRM and ATS workflow features (contact management, job order tracking, timesheet processing) are not high-risk.

Bullhorn EU AI Act Compliance — Staffing Agency Guide 2026

Bullhorn EU AI Act Compliance: Guide for Staffing Agencies

Bullhorn is the CRM/ATS of choice for thousands of staffing and recruitment agencies. If your agency uses Bullhorn's AI features to match or rank EU-based candidates, you are a high-risk AI deployer — and your obligations are yours to meet, regardless of what your client employers do.

Bullhorn feature classification

Feature	Classification	Notes
AI candidate matching — fit scoring for open roles	HIGH RISK	Annex III Cat.4 — AI influences employment opportunity access
Predictive sourcing — AI identifies likely candidates	HIGH RISK	AI determines who gets surfaced for roles
Automation: candidate outreach sequencing	HIGH RISK (if AI-targeted)	If AI selects who to contact — high risk. If human curated — not
CRM contact management, job orders	NOT HIGH RISK	Workflow tool, no AI assessment of persons
Timesheet, payroll processing	NOT HIGH RISK	Calculations, not AI-based assessment

Staffing agency deployer obligations

Inform candidates that AI assists in matching them to roles — add to your candidate registration process
Ensure a consultant reviews every AI match score before submitting a candidate to a client
Retain Bullhorn logs of AI-assisted matching decisions for at least 6 months per candidate file
Update your candidate privacy notice to cover AI-assisted matching (separate from GDPR lawful basis)
Request Bullhorn's EU AI Act technical documentation for AI matching features
Clarify in client contracts that you as the agency hold the EU AI Act deployer obligation — not the client

Staffing agency compliance pack — coming soon

Candidate disclosure for agency registration, consultant oversight checklist, client contract AI clause, and candidate file log retention guide — tailored for staffing and recruitment agencies.

Get notified when available →

The staffing agency compliance puzzle

Why agencies — not client employers — are the deployer

In a typical staffing placement, the agency runs the AI-assisted screening and presents a shortlist to the client employer. The client then interviews and selects. The EU AI Act deployer obligation falls on the entity that puts the AI system into service in their professional context — that is the agency, not the client.

This is a significant distinction. Even if your client says "we handle compliance," that does not transfer your EU AI Act obligations. The agency using Bullhorn AI to shortlist candidates is the deployer, and must meet disclosure, oversight, and log retention requirements independently of the client.

Candidate disclosure at registration

The most practical point to add candidate disclosure is at registration — when a candidate first enters your system. A brief notice at this point covers all subsequent matching activity in Bullhorn, rather than requiring per-role disclosure for every job order. Include it in your candidate terms, registration form, or onboarding email.

Frequently asked questions

Our client employers say the EU AI Act is their responsibility. Is that right?

Partially. The client employer who makes the final hiring decision using your shortlist is also a deployer of sorts — if they use AI in their own process. But your agency's use of Bullhorn AI to generate that shortlist is a separate deployment, with separate obligations that belong to you. Both parties can be deployers at different stages of the same hiring process. Contractual attempts to transfer your obligations to the client are not effective under the regulation.

We place workers across many EU countries. Do obligations vary by country?

The EU AI Act is a directly applicable regulation — it applies uniformly across all EU member states without national transposition. Your obligations are the same whether you place workers in Germany, France, Poland, or any other EU member state. National supervisory authorities (the market surveillance bodies each country must designate) may differ in enforcement approach and priorities, but the legal obligations are identical.