← HR software guides
HIGH RISK — Annex III Category 4 (AI features)
Deadline: 2 August 2026. Deployer obligations for high-risk AI apply. Lever as provider handles certification; you handle disclosure, oversight, and logs.
SMB guide. Lever is popular with growing companies and startups. The EU AI Act applies equally to small employers — fines are proportional to turnover, but the obligations are the same.

Lever ATS EU AI Act Compliance: What SMBs Must Do

Lever is a widely used ATS with AI-powered sourcing and candidate recommendations. If you use these features to hire EU-based candidates, you are a deployer of high-risk AI. Here is what you need in place before 2 August 2026.

Lever features and EU AI Act risk classification

FeatureClassificationReason
Smart Recommendations — AI candidate sourcingHIGH RISKAI recommends which candidates to engage — influences who gets considered
Candidate scoring / rankingHIGH RISKAnnex III Cat.4 — AI used in employment screening
Interview scheduling automationNOT HIGH RISKLogistics tool, no assessment of persons
Job posting / pipeline managementNOT HIGH RISKWorkflow tool, no AI-based candidate assessment
Offer managementNOT HIGH RISKRules-based process, not AI assessment

What you need to do — 5 steps for SMBs

  1. Add a disclosure to your application form or confirmation email informing candidates that AI may assist in reviewing their application
  2. Configure your Lever hiring workflow so that a recruiter reviews every AI recommendation before a decision is made — never auto-reject based on AI score alone
  3. Enable and retain Lever's audit/activity logs for at least 6 months — check your Lever plan includes log export
  4. Create a one-page internal AI use policy documenting which Lever features use AI and what your human oversight process is
  5. Request confirmation from Lever that they will provide EU AI Act technical documentation for their AI features

Candidate disclosure — copy this into your application flow

Our hiring process uses AI-assisted tools to help manage applications. A member of our team reviews all decisions personally. If you have questions about how your application is processed, contact us at [email].

Get the full compliance document pack for SMBs

The HR AI Compliance Kit includes: candidate disclosure templates, a one-page AI use policy, human oversight checklist, log retention policy, and a DPIA template — designed for small HR teams with no legal department.

Get the HR Compliance Kit — €99 →

Lever and the EU AI Act: analysis for growing companies

Why "we're small" is not a defence

A common misconception among SMBs is that EU AI Act obligations only apply to large enterprises. They do not. The regulation applies to any deployer using a high-risk AI system, regardless of headcount or revenue. What the regulation does provide is proportionality in fines — penalties are capped at 3% of annual turnover rather than a fixed ceiling, which is relevant if you are fined. The obligations themselves are identical.

Lever's AI features — what actually counts as AI assessment

Lever's core ATS is not itself AI — it is a workflow and pipeline management tool. The high-risk classification applies specifically to features where a machine learning model produces a score, ranking, or recommendation about a candidate. If you use Lever purely for pipeline tracking, scheduling, and offer management without AI scoring features enabled, you are likely not deploying a high-risk system for those workflows.

The key question to answer: does any AI in your Lever configuration produce a score, rank, or yes/no recommendation about a specific candidate? If yes, that is a high-risk AI deployment.

Frequently asked questions

We use Lever Nurture to contact candidates. Is that high-risk?
Lever Nurture is an automated outreach tool. If it uses AI to select which candidates to message based on a predicted fit score, that selection process is high-risk. If it is purely a drip-email sequence sent to a manually curated list, it is likely not high-risk. Check whether the tool is deciding who to contact (high-risk potential) or simply sending messages to a list you defined (not high-risk).
Lever is a US company. Do their EU AI Act obligations fall on them or us?
Both. Lever as the provider of AI systems used on the EU market has provider obligations (Annex IV documentation, conformity assessment). You as the deployer have deployer obligations (disclosure, human oversight, log retention). The fact that Lever is US-based does not exempt them — Article 2(1)(c) applies. And their compliance does not discharge your deployment-side obligations.
We only hire a few people per year. Do we really need to worry about this?
If you use AI-assisted features to make hiring decisions about EU-based candidates, the obligations apply regardless of hiring volume. The practical risk of enforcement action against a very small employer making a few hires per year is low. However, a candidate who believes they were unlawfully processed could raise a complaint, and the disclosure obligation in particular is low-effort to implement — it's a sentence in your application process.