Lever and the EU AI Act: analysis for growing companies
Why "we're small" is not a defence
A common misconception among SMBs is that EU AI Act obligations only apply to large enterprises. They do not. The regulation applies to any deployer using a high-risk AI system, regardless of headcount or revenue. What the regulation does provide is proportionality in fines — penalties are capped at 3% of annual turnover rather than a fixed ceiling, which is relevant if you are fined. The obligations themselves are identical.
Lever's AI features — what actually counts as AI assessment
Lever's core ATS is not itself AI — it is a workflow and pipeline management tool. The high-risk classification applies specifically to features where a machine learning model produces a score, ranking, or recommendation about a candidate. If you use Lever purely for pipeline tracking, scheduling, and offer management without AI scoring features enabled, you are likely not deploying a high-risk system for those workflows.
The key question to answer: does any AI in your Lever configuration produce a score, rank, or yes/no recommendation about a specific candidate? If yes, that is a high-risk AI deployment.
Frequently asked questions
We use Lever Nurture to contact candidates. Is that high-risk?
Lever Nurture is an automated outreach tool. If it uses AI to select which candidates to message based on a predicted fit score, that selection process is high-risk. If it is purely a drip-email sequence sent to a manually curated list, it is likely not high-risk. Check whether the tool is deciding who to contact (high-risk potential) or simply sending messages to a list you defined (not high-risk).
Lever is a US company. Do their EU AI Act obligations fall on them or us?
Both. Lever as the provider of AI systems used on the EU market has provider obligations (Annex IV documentation, conformity assessment). You as the deployer have deployer obligations (disclosure, human oversight, log retention). The fact that Lever is US-based does not exempt them — Article 2(1)(c) applies. And their compliance does not discharge your deployment-side obligations.
We only hire a few people per year. Do we really need to worry about this?
If you use AI-assisted features to make hiring decisions about EU-based candidates, the obligations apply regardless of hiring volume. The practical risk of enforcement action against a very small employer making a few hires per year is low. However, a candidate who believes they were unlawfully processed could raise a complaint, and the disclosure obligation in particular is low-effort to implement — it's a sentence in your application process.