What the survey shows
The numbers are low, but not uniform. AI is used in recruiting where risk is low: 9 percent of companies have AI draft their job postings. The closer an application sits to the actual selection decision, the less often it's used: 6 percent use AI to pre-screen applications, 5 percent for competency or potential analyses, and only 2 percent conduct conversations with applicants via AI.
At the same time, willingness is clearly greater than practice. 59 percent can imagine AI for job postings, 34 percent for potential analyses, 27 percent for initial screening, and 17 percent for AI-led conversations. There's a gap between what companies can imagine and what they do - and Bitkom explains it with the legal situation.
What Bitkom names as the brake - and what doesn't hold up on timing
Adél Holdampf-Wendel's statement that there's 'still hesitation because of regulation even among our members who are already very digitally savvy' is plausible. In substance, the classification is correct: AI systems that filter or assess applications are high-risk systems under the EU AI Act (Annex III, employment and workers management). Risk management, human oversight, and further documentation are foreseen for them.
On timing, though, the situation differs from the impression that 'the AI Act is holding us back'. The high-risk duties were postponed via the Digital Omnibus: for standalone Annex III systems, which include recruiting AI, to 2 December 2027. We covered that in detail in July and August, and it still holds. For recruiting AI, the AI Act is therefore the upcoming rule, not the one enforceable today. Anyone hesitating today with 2027 in mind is acting sensibly ahead of time. Anyone hesitating because they believe the AI Act already prohibits or blocks such use has probably mixed up the deadlines.
A correction on Article 4: the AI literacy duty has been weaker since July
While reviewing today's binding duties, we noticed that Article 4 of the AI Act has changed. Regulation (EU) 2026/1744, the AI omnibus, rewrote it. Originally, providers and deployers had to ensure, to the best of their ability, a sufficient level of AI literacy among their staff. Under the new wording, they must take measures to support the development of AI literacy - explicitly without having to guarantee that each individual reaches a particular level.
Our foundational article on the EU AI Act already mentions the softening, but described the duty in its core paragraph in the earlier, stricter form and named enforceability from August 2026, which we can't substantiate after the rewrite. We've now corrected that there. For recruiting, this means: anyone using AI in HR must continue to actively support skill development among those involved, but no longer owes a specific competence level.
What already binds in recruiting today
Regardless of the AI Act timeline, several bodies of law already apply. We list them for orientation; in individual cases, this is not legal advice.
First, the GDPR. Article 22 protects data subjects against decisions based solely on automated processing. In the SCHUFA ruling of 7 December 2023 (C-634/21), the CJEU held that even the calculation of a score can be such an automated decision when a third party bases its decision 'decisively' on it. In legal discussion, that reasoning is being carried over to AI-assisted applicant pre-screening: if recruiters effectively just confirm what the AI pre-sorted, Article 22 may be triggered. There's no settled case law on recruiting yet, so caution is warranted.
Second, German works constitution law, where a works council exists. Under Section 95(2a) of the Works Constitution Act (BetrVG), co-determination rights on selection guidelines for hiring expressly apply even when AI is used in drawing them up. Section 87(1) No. 6 BetrVG (technical devices for monitoring behavior or performance) is also relevant. Introducing a recruiting tool without involving the works council is therefore no side issue in co-determined workplaces.
Third, the anti-discrimination rules. Applicants are also protected by Germany's General Equal Treatment Act (AGG). If an AI system sets pre-screening criteria that disadvantage certain groups, the company is liable, not the tool. That's not new law, but with AI pre-screening it's practically the biggest risk.
Fourth, for AI interviews, the ban on emotion recognition in Article 5 of the AI Act, which has applied since 2 February 2025. It prohibits systems that infer emotions from biometric data such as voice or facial expression in the workplace. Some commentators also read this as covering the application process; whether the Commission's guidelines explicitly treat recruitment as 'the workplace' we couldn't confirm in the source we checked. Anyone using AI video interviews with analysis functions should therefore have this explicitly reviewed.
What the survey doesn't show
The survey says companies are hesitant and that Bitkom sees regulation as the reason. It doesn't say what the surveyed companies themselves cite as the reason, and it doesn't distinguish whether the hesitation stems from knowing the deadlines or from uncertainty about them. We therefore make no claim about how many companies confuse the deadlines. What's documented is only the gap between the named brake and the actual timing.
What this means in practice
- Separate 'applies soon' from 'applies today': the high-risk duties for recruiting AI come on 2 December 2027 - the GDPR, anti-discrimination rules, and works constitution law apply now.
- Low-threshold uses like job postings are the natural entry point, since they make no selection decision. The closer AI moves to selection, the more carefully it should be reviewed beforehand.
- For AI pre-screening, make sure humans actually decide rather than merely confirm - if only because of Article 22 GDPR.
- In workplaces with a works council, involve the body before introduction, not after.
- For AI interviews with voice or facial analysis, have the function checked for emotion recognition before the tool goes live.
- Ask vendors how the tool was tested for discrimination and what logs exist - as the deployer, you carry responsibility for its use.
The core of this analysis: the survey rightly describes a hesitation. Whether it's justified depends on what one is hesitating about. You can prepare for the AI Act in 2027. The rules that already apply today are not a matter of preparation but of compliance.