Article 4 Reaches the Interviewers Who Operate the Tool

Who in your loop does Article 4 reach?

Whoever operates an AI system on the employer's behalf, which is a shorter list than everyone who interviews. Article 4 of the EU AI Act binds providers and deployers of AI systems, and it runs to their staff and to other persons dealing with the operation and use of those systems on their behalf ¹. An employer running an off-the-shelf screening tool is a deployer. The recruiter clicking through it is covered.

The Commission's own guidance widens "other persons" past the payroll. The Article 4 questions and answers page names a contractor, a service provider and a client among the people who fall inside the duty when they act under the organisation's oversight ².

An agency recruiter screening your applicants on your tool can sit inside the duty, and so can a contract interviewer who runs one.

But the duty follows the tool, not the round. An interviewer who reads a candidate's AI-assisted take-home, asks about it, and touches no system your organisation put into service is outside Article 4. Nothing there is being operated on anyone's behalf.

So the useful first move is an inventory. Walk the loop and name every point where a model touches a candidate: the sourcing tool that ranks profiles, the resume screen, the transcription assistant taking notes in the room, the summariser a reviewer reads before scoring, the scheduling bot.

Article 4 is not limited to high-risk systems ¹, so the note-taker counts as much as the screen.

The summariser is the easiest to miss. Reading a model's account of a session feels like reading notes, so it can drop off the list. But an AI summary in the reviewer's hands changes the record, and the person reading it is dealing with the use of an AI system on the employer's behalf.

What did the July 2026 amendment change?

The bar, not the obligation. Article 4 used to require a sufficient level of AI literacy. The Digital Omnibus amendments entered into force in mid-July 2026 and removed that standard: the Commission now states that AI literacy remains an obligation for providers and deployers while no specific or sufficient level is mandated ². Taking measures is still owed. Hitting a level is not.

A compliance memo written before mid-July 2026 may quote a sentence the Digital Omnibus has since amended ², which is worth checking before anyone builds a programme on the word "sufficient".

Two things survived the amendment. The obligation to take measures stands.

Deployers of high-risk AI systems still have to ensure their staff are trained for human oversight, which the Commission says remains in place after the Omnibus ².

Annex III, point 4 of the Act as adopted lists recruitment and selection, naming targeted job advertising, the analysis and filtering of job applications, and the evaluation of candidates, as high-risk uses ¹.

The high-risk rules are not live yet. The Commission's implementation timeline now shows the Annex III rules applying from 2 December 2027, a date it marks as amended by the Digital Omnibus ³. An employer screening EU candidates with an AI tool in 2026 is not breaching Annex III.

Article 4 is the piece that is already running.

Run the session as calibration, not as compliance

A calibration session and a compliance session cover nearly the same ground. Article 4 wants the people operating a system to understand it; an interviewer scoring candidates consistently needs to know what the tool in their round decides, what it never sees, and when to set it aside. One ninety-minute meeting can carry both, and the agenda is the record.

Nothing in the law dictates the shape. The Commission states that Article 4 carries no obligation to measure employees' knowledge of AI, that there is no need for a certificate, and that no mandatory training is imposed ².

Five items fill the session, and every one of them is also an interviewer question:

• What the tool decides, and what it only suggests.
• The inputs it never sees, taken from your own field mapping rather than the vendor's brochure.
• The failure it produces most often, shown as a real case from your pipeline with everything that identifies the candidate removed.
• Who may override it, on what grounds, and where that override gets written down.
• What each interviewer records after using it.

Borrow vocabulary if it helps. Rick Dakan of Ringling College of Art and Design and Joseph Feller of University College Cork name four competencies in their AI Fluency Framework, among them Discernment, which they define as accurately assessing the usefulness of AI outputs ⁴.

The framework is a vocabulary: it publishes no instrument, no norms, and no evidence that people who rate well on it work better.

The curriculum question answers itself, because the room is the interview loop. The floor for everyone is small, three judgments rather than a curriculum: what may be handed to a model at all, what verification an output needs before it carries someone's name, and what data must never go into a prompt.

Interviewers need one thing more, which is what the tool in their own round gets wrong.

What should the record show?

Who was covered, what they were shown, and when. The Commission's guidance points at an internal record of trainings and other guiding initiatives rather than at any certificate or test ². A dated agenda, the attendance list, the one-page handout and a note of which systems each attendee operates meets that description, and it takes an afternoon to assemble.

Nothing bought from a vendor carries a presumption of compliance.

The Commission is explicit on the point. Its living repository of AI literacy practices collects what organisations are already doing, and at the moment replicating those practices does not automatically grant presumption of compliance with Article 4 ². A course bought to produce a certificate produces a certificate.

From August 2026, supervision and enforcement of Article 4 begin, and they sit with national market surveillance authorities rather than with the Commission's AI Office ². The Commission's own page gives two dates a day apart for that start, so August 2026 is the honest way to write it.

The fine numbers in circulation attach to other articles.

Article 99 sets the AI Act's ceilings: up to EUR 35 million or 7% of total worldwide annual turnover for the prohibited practices in Article 5, and up to EUR 15 million or 3% for the enumerated operator duties ¹.

Article 4 is absent from that list of enumerated breaches. Penalties for it are left to the Member States.

The case against reading Article 4 lightly is short. Enforcement began only in August 2026 ². So the Commission's guidance does not say what an authority will accept as measures taken, and an organisation that files an agenda and stops may find the bar sits somewhere else.

Where the duty stops, and what it does not fix

At the edge of the tool. Article 4 is about operating AI systems, so it says nothing about whether an interviewer can judge a candidate's AI skill, and nothing about whether two interviewers judge the same answer the same way. An employer can discharge the duty completely and still run an incoherent round.

The harder problem sits one step over. A manager who does not use AI can still score AI-assisted work.

But the scoring holds only when the questions their own domain judgment already scores are written down before the round rather than improvised inside it.

Scope is set by the Act.

Article 4 binds providers and deployers whose systems fall inside the AI Act's reach, so a company headquartered outside the European Union may still owe it on a screen it runs for a Dublin req, which is a scope question to put to counsel.

A US team should read that reach as additional to the AI hiring laws that apply to it right now, never as a substitute.

The inventory does both jobs. A list of who in the loop touches a deployed system is the compliance artifact and the seating chart for the session that discharges the duty.

Read the evidence >