Does ISO 42001 cover HR and recruiting AI, and what does it cost to meet it?
A customer, tender or regulator asking about AI governance over recruiting or workforce tools is usually asking two things at once: whether your management system covers those tools, and what it will take to show it. ISO/IEC 42001:2023 is a management system standard with 38 Annex A controls. The organization owns its controls and decides which apply through a statement of applicability, and only an independent certification body issues a certificate. ISO 42001 does not itself regulate recruiting AI, but it gives you a structure for the governance, impact assessment and responsible use controls that the EU AI Act later requires. Under Annex III point 4, AI used to recruit or select people, including targeted job adverts and filtering applications, and AI used for promotion, termination, task allocation or monitoring of worker performance, is high-risk. Under the supplied Article 113 fact, the high-risk obligations for Annex III systems apply from 2 December 2027.
Cost and effort depend on scope rather than on the standard itself. The main drivers are the number of AI systems in HR use, whether each is built in-house or bought from a vendor, how many teams configure or rely on them, and how mature your existing ISO 27001 management system is, since shared document control, internal audit and management review can often be reused. Each recurring cost is tied to a different party: internal staff time for owning policies, impact assessments and oversight training; vendor effort for supplying technical documentation and logs; and external fees for certification audits and surveillance. Before accepting a quote, ask the implementation partner to list the systems in scope, the Annex A controls it expects to address, which evidence it will produce, and which tasks remain with your HR and legal teams. Confirm current fee schedules directly with any certification body you are considering, and confirm the AI Act application dates against the consolidated EUR-Lex text before you set internal deadlines.
What employers must do under Article 26 and how ISO 42001 evidences it
Employers that deploy high-risk recruiting or workforce AI take on deployer duties under Article 26 of the EU AI Act. ISO/IEC 42001 does not replace those duties, but its Annex A controls give the organization a documented way to show how each duty is met.
Inform workers and representatives first
Article 26(7) requires employers to inform workers' representatives and affected workers before a high-risk system is put to use at the workplace. Treat this as a gate in the rollout plan, not a notice sent after go-live. ISO 42001 control A.5.4 supports the evidence: the impact assessment records which groups are affected and how. An assessor will ask for the dated notice, the list of recipients, and the minutes or acknowledgments showing the consultation happened before deployment.
Inform people subject to AI decisions
Article 26(11) requires deployers of Annex III systems that make or assist decisions about people to inform those people. This applies to candidates screened by AI and to workers whose tasks, promotion or monitoring are assisted by the system. Map every decision point where the system touches a person, then write a notice that describes the role of the AI in that decision. Under A.8.2 (documentation for users), the organization keeps the notice template, version history and distribution records that an assessor can sample against real candidate or employee cases.
Keep deployer logs for six months
Article 26(6) requires deployers to keep the logs the system generates, under their control, for at least six months unless other Union or national law provides otherwise. Confirm which logs the vendor produces, where they are stored, who can access them, and whether the employer can export them before the vendor's default retention expires. ISO 42001 control A.6.2.8 (event logs) supports this evidence. Ask for a retention schedule, a sample export, and access records showing the logs were not altered or deleted early.
Assign competent human oversight
Article 26(2) requires deployers of high-risk systems to assign human oversight to people with the necessary competence, training and authority. The person named must be able to question, override or stop the system, and that authority must be real in practice. ISO 42001 control A.3.2 (roles and responsibilities) and A.4.6 (human resources) give the organization a place to record who holds the role, what training they completed, and what they may do. An assessor will ask for the role description, training records and an example of an override decision.
How the duties differ for employers and HR tech vendors
An employer that buys a screening, ranking or monitoring tool and runs it on its own workforce usually acts as a deployer under the EU AI Act. The deployer duties in Article 26 focus on using the system as the provider instructs, assigning human oversight to competent people, keeping logs under the deployer's control, and informing the people affected. Employers that deploy Annex III employment systems should expect to show who oversees each decision, how those people were trained, and where the logs are kept.
- Use as instructed: Keep the vendor's instructions for use, and record any deviation, such as using a tool for a job family it was not designed for.
- Named oversight: Assign human oversight to specific people with the competence, training and authority to override outputs.
- Log retention: Keep logs under the deployer's control for at least six months, unless other Union or national law sets a longer period.
- Worker and candidate notice: Inform worker representatives and affected workers before deployment, and inform the people the system makes or assists decisions about.
- Impact records: Document the impact assessment under A.5.4 and the responsible use processes under A.9.2 for each deployment.
Confirm with counsel whether your use is in scope of Annex III point 4 and which national employment rules also apply.
A vendor that develops a recruiting or workforce AI system, or places it on the EU market under its own name, usually carries provider duties. These are heavier than deployer duties because they cover the system's design, testing, documentation and conformity before the product reaches customers. ISO/IEC 42001 does not satisfy those obligations by itself, but it gives vendors a management system that can organize much of the required evidence.
- Technical documentation: Maintain documentation that describes the system, its data, its intended purpose and its limits, and keep it current across releases.
- Lifecycle controls: Use A.6 controls for requirements, design records, verification and validation, and event logs.
- Instructions for deployers: Give customers the information they need to meet their own deployer duties, including oversight and logging.
- Quality management: Note that the harmonized standard for the AI Act quality management system is EN 18286, which the Commission cited in the Official Journal on 14 October 2026. Confirm which controls it covers before you map your program to it.
- Customer questionnaires: Prepare evidence packs for ISO 42001 questions, such as the AI policy, the impact assessment and supplier controls under A.10.
Confirm your provider or deployer status, and the timing of obligations, with counsel before you make compliance statements to customers.
Many HR AI products sit in both roles. A vendor may deploy its own tool internally, and an employer may customize a purchased model in a way that changes its purpose. Each change can move duties from one party to the other, so the contract should state who owns each obligation. ISO/IEC 42001 supports this through the A.10 controls, which allocate responsibilities across the life cycle and set expectations for suppliers and customers.
- Responsibility allocation: Record in the contract which party performs each life cycle task, including monitoring, logging and incident communication.
- Information flow: Agree on what the vendor provides about training data, performance limits and known bias risks, and how often it is updated.
- Change notices: Require notice before a model update, retraining or new feature changes the intended purpose.
- Evidence exchange: Agree on which documents each party can request, such as a summary of the impact assessment or logging design.
- Dates: Track the Act's application dates for Annex III systems, which Article 113 sets as 2 December 2027 under the Digital Omnibus on AI.
Check each contract against your confirmed role, and ask counsel whether any change you plan would make you a provider.
How an ISO 42001 readiness project for recruiting AI runs
The sequence moves from a clear inventory of recruiting and workforce AI to a statement of applicability, tested evidence and an accredited certification decision, so each phase hands a defined output to the next. Ask your certification body and implementation partner for a written schedule before work starts.
Scope the recruiting and workforce AI systems and vendors
Start by listing every AI system used in hiring and people management: applicant screening, targeted job advertising, interview scoring, promotion support, task allocation and performance or behavior monitoring. Record which systems you build, which you buy from HR tech vendors, and which vendors' products you configure yourself. The organization owns this decision, and the implementation partner can run the inventory workshops and draft the scope statement. The step is done when a signed scope statement names each system, its vendor, its business owner and the affected groups of workers and candidates.
Run a gap analysis against clauses 4 to 10
Compare your current practice with the management system requirements in clauses 4 to 10 and with the Annex A controls, using the scope from the previous step. Look for missing items such as a documented AI policy, named roles for recruiting AI, a process for raising concerns, an impact assessment method and supplier oversight of HR tech vendors. The output is a gap register that rates each finding and assigns an owner. Keep the register as evidence that the organization assessed its own starting point.
Build the statement of applicability
Under clause 6.1.3, prepare the statement of applicability that lists the Annex A controls the organization needs for recruiting and workforce AI and records a justification for including or excluding each one. Controls on impact assessment (A.5), use of AI systems (A.9) and third-party relationships (A.10) usually carry the most weight in this context, but the decision belongs to the organization. The document is complete when every Annex A control has a recorded decision, an owner and a pointer to the policy or procedure that implements it.
Implement controls and collect evidence
Put the included controls into operation. Typical work includes writing the responsible use procedure, documenting the impact assessment for each system, setting up the notice to candidates and workers, defining who oversees automated outputs and what competence they need, and keeping logs of system activity. Store records in a controlled location with dates, approvals and version history. The step closes when each included control has a documented procedure and at least one record that shows it operates. Ask the partner to confirm which evidence the auditor will sample.
Perform internal audit and management review
Before the external audit, the organization tests its own system. An internal auditor, who should be independent of the people who built the controls, samples the evidence and checks it against the statement of applicability and the requirements in clauses 4 to 10. Findings go to a management review meeting where leaders decide on corrective actions, resources and any changes to scope or policy. The output is an internal audit report, a corrective action log and minutes of the management review.
Complete the stage 1 documentation review
Select an accredited certification body and agree the audit plan in writing. In stage 1, the certification body reviews your documented management system, scope, statement of applicability and readiness, and identifies areas that need attention before the full assessment. The output is the stage 1 report from the certification body, which lists any findings you must address. Ask the body to explain how it will verify its accreditation status for ISO/IEC 42001 certification, because accreditation for this standard is voluntary and the scope of accreditation should be confirmed.
Pass the stage 2 certification audit
Stage 2 is the main assessment, in which the certification body tests whether the management system operates as documented. Auditors interview recruiters, hiring managers, HR staff and the people who oversee AI outputs, and they sample records such as impact assessments, notices, oversight decisions and vendor reviews. Close any nonconformities raised before the decision. The outcome is a certification decision made by the certification body, not by the organization or the partner. Only the certification body issues the certificate.
Which Annex A controls matter most for recruiting AI
Recruiting and workforce AI touches people's livelihoods, so a small set of Annex A controls carries most of the weight. The cards below cover the controls that shape impact assessment, responsible use, accountability, competence, worker communication and supplier management. The statement of applicability under clause 6.1.3 must justify including or excluding each Annex A control, so record the reasoning for every one of these, not only the ones you adopt.
Impact on individuals across the life cycle
Control A.5.4 asks you to assess and document the potential impacts of an AI system on individuals or groups throughout its life cycle. For a screening tool, that means looking at how candidates from different groups are scored or filtered, not only whether the model performs well overall. Check that the assessment is refreshed when the model, job families or applicant pool changes, and that it names who reviewed it and what they decided.
Documented processes for responsible use
Control A.9.2 asks you to define and document the processes you follow for responsible use of AI systems. In recruiting, this is the written procedure recruiters follow when a tool ranks candidates, including when they may override a score, how they record the reason, and when they must stop using the tool. Confirm that the procedure exists in writing and that hiring teams have actually been trained on it.
Keeping use within intended purpose
Control A.9.3 concerns keeping use of an AI system within its intended purpose. A tool built to rank applications for one role can drift into performance monitoring or promotion decisions without anyone deciding that it should. Define the permitted uses in the system documentation, restrict access by use case, and review requests to extend the tool before they go live. Scope creep of this kind often moves a system into a higher-risk category.
Accountability and concern-raising
The internal organization controls in A.3 require defined AI roles and responsibilities and a process for raising concerns about AI systems. For recruiting AI, name who owns each tool, who signs off on changes to screening criteria, and who receives complaints from candidates or recruiters. Make the concern route reachable by applicants who have no internal account, and confirm that concerns are logged and answered.
Competence of human reviewers
The resource controls in A.4 include human resources, which covers the people who operate, oversee and review the AI system. A recruiter who acts on a ranking needs enough knowledge of how the tool works to challenge it. Document the training each reviewer completes, the authority they hold to override outputs, and the refresher cycle. Under the EU AI Act, deployers of high-risk systems must assign oversight to people with the necessary competence, training and authority.
Supplier controls for the screening vendor
Control A.10.2 covers managing suppliers of AI products and services, and A.10.3 covers meeting customer expectations. Most employers buy screening AI from a vendor, so the vendor's model documentation, data sources and change notices become part of your evidence. Ask the vendor for its ISO 42001 status or equivalent documentation, the notice it gives before material changes, and how it supports your logging and worker-information duties. Record the answers in the statement of applicability.
What must be in place before a recruiting AI audit
A recruiting AI audit tests whether the organization can show what its AI does, who answers for it, and what people were told. The six items below are the records an assessor will ask for first, and each one links to a specific ISO 42001 control or EU AI Act duty for employment uses.
Inventory of hiring AI tools
Build a register of every system that sources candidates, screens applications, ranks applicants, schedules interviews or monitors staff performance, including features switched on inside an existing applicant tracking system. For each entry, record the vendor, the model or feature version, the decisions it informs and the job roles it touches. Check the register against procurement records and browser or plugin approvals, because shadow tools are the most common gap. Under Annex III point 4 of the AI Act, recruiting and workforce uses are the ones to flag first.
Documented impact assessment
Record the potential effects of each recruiting system on candidates and workers, including groups that may be treated differently, and keep the assessment current across the system's life cycle. Annex A control A.5.4 asks for this. Check that the document names the decision, the data inputs, the known limits and the review trigger, such as a model change or a new job family. Ask whether the assessment has been reviewed by someone outside the team that built the tool.
Notice template for workers and candidates
Prepare one notice for candidates and another for workers and their representatives. The AI Act requires employers to inform workers' representatives and affected workers before a high-risk system goes live at the workplace, and deployers of Annex III systems that make or assist decisions about people must inform those people. Check that each notice states that AI is used, what it does, who reviews outcomes and how a person can ask questions. Keep dated copies and proof of delivery for the audit file.
Log retention settings confirmed with the vendor
Article 26(6) requires deployers to keep logs under their control for at least six months, unless other Union or national law sets a longer period. Do not rely on the vendor's default. Ask in writing which events are logged, where the logs sit, who can export them, and whether the deployer can delete them early. Test one export before the audit and confirm that the retention setting in the tenant matches the contract. Record the setting, the date you checked it and the person who checked it.
Named human oversight roles with training records
Article 26(2) requires deployers of high-risk systems to assign human oversight to people with the necessary competence, training and authority. Name each reviewer by role, state what they may override or stop, and file their training records, including AI literacy training. Under A.3, the organization should also show who owns the AI system overall. Check that reviewers can explain a candidate's score in plain language and that the training predates their first review decision.
Vendor contracts allocating responsibilities under A.10
Annex A control A.10 covers allocating responsibilities across organizational boundaries and managing suppliers of AI products and services. For each recruiting vendor, confirm in the contract who provides the technical documentation, who handles bias testing, who keeps logs, who notifies incidents and how changes to the model are communicated before they reach your candidates. Check that the contract gives you audit or evidence rights. Where a vendor cannot describe these allocations, treat that as a finding for the supplier review.
Who owns controls, who prepares evidence and who issues the certificate
The employer or HR tech vendor owns the AI management system, the controls it selects, and every decision about whether a recruiting or workforce AI system is fit for use. Management sets the AI policy, names the people accountable for each system, approves the statement of applicability under clause 6.1.3, and signs off impact assessments and residual risk. The same organization carries the legal duties that the EU AI Act places on deployers and providers, so those duties cannot be handed to a consultant or a certifier.
- Policy and scope: approve the AI policy, the list of in-scope recruiting and workforce systems, and the justification for each excluded Annex A control.
- Legal duties: decide how worker representatives and affected candidates are informed, and who answers when a candidate asks about an automated screening decision.
- Human oversight: name the people with the competence, training and authority to oversee each high-risk system.
- Sign-off: own impact assessment conclusions, go or no-go decisions for deployment, and acceptance of residual risk.
- Log retention: decide who controls deployer logs and how long they are kept, with at least six months as the floor under Article 26(6) unless other law requires more.
Before signing any contract, ask a partner to name which of these decisions it will draft for you and which it will only record.
An implementation partner such as DeployOpen helps the organization build what the management system needs to run and to be examined. In a self-hosted deployment, that work covers configuring the platform that holds model inventories, risk registers, impact assessment records and event logs, documenting procedures, and running internal readiness reviews against the clauses and Annex A controls. The partner prepares evidence. It does not decide what the organization's risk appetite is, and it does not issue audit reports, attestations or certificates.
- Systems: set up logging, access control and record keeping in the client's own infrastructure, so logs remain under the client's control.
- Documentation: draft procedures, templates and technical documentation for the client's review and approval.
- Readiness work: run an internal gap analysis and mock evidence review before any external audit.
- Testing support: arrange AI security testing where the client needs independent technical evidence about a system.
- Handover: train named staff so the organization can operate the controls after the engagement ends.
Confirm in the written scope which deliverables are documents, which are configured systems, and which remain the client's responsibility to maintain.
An accredited certification body performs the independent audit and decides whether the AI management system conforms. ISO does not certify organizations, and accreditation of certification bodies is voluntary, so the accreditation status of any body should be checked before engagement. ISO/IEC 42006:2025 adds requirements on top of ISO/IEC 17021-1 for bodies that certify AI management systems, which is a useful reference when comparing bodies.
- Independence: the certification body must not design, implement or write the controls it audits.
- Audit stages: it plans and runs the stage 1 and stage 2 audits and reports its findings.
- Certificate decision: only the certification body issues the certificate, and it sets surveillance and recertification.
- Accreditation: confirm the body is accredited for ISO/IEC 42001 by the relevant accreditation body, not only for other management system standards.
- Scope: check the certificate scope names the recruiting and workforce systems the organization actually runs.
Ask the certification body to state in writing what its auditors will test and which evidence it expects to see.
Questions buyers ask about ISO 42001 for recruiting AI
Is recruiting AI high-risk under the EU AI Act, and when do the obligations apply?
Yes, when the AI is used to recruit or select people. Annex III point 4 of the EU AI Act covers AI that places targeted job adverts, filters applications or evaluates candidates, and AI used for decisions on promotion, termination, task allocation and monitoring of workers' performance and behavior. As amended by the Digital Omnibus on AI, the high-risk obligations for Annex III systems apply from 2 December 2027. Confirm the classification of your specific tool against the draft Commission guidelines on high-risk classification and with counsel, because the use case, not the vendor's label, decides the answer. Employers that only buy a tool are usually deployers, and the deployer duties in Article 26 apply to them.
What does a recruiting AI governance project need from HR and legal?
It needs named decision owners on both sides. HR owns the hiring process, the job criteria, the candidate notices and the human reviewers who make final decisions. Legal or privacy counsel owns the classification question, employee and works council consultation, GDPR obligations for candidate data, and the wording of notices. Procurement should bring vendor contracts, log access and model change notices into scope. Ask HR and legal to agree the intended purpose of each tool in writing before any technical work starts, because the impact assessment and the Annex A.9.2 use processes depend on that statement.
Can our implementation partner also be the auditor for ISO 42001?
No. An implementation partner prepares your AI management system, controls and evidence, and your organization owns the controls. Only an independent certification body issues an ISO/IEC 42001 certificate, and ISO itself does not certify organizations. A firm that designed the controls and then audited them would not be independent, so keep the implementation partner and the certification body separate. DeployOpen prepares systems, controls and evidence for assessments and does not issue audit reports, attestations or certifications. Check ISO's certification guidance for how certification works, and ask any certification body to confirm its accreditation status and its own independence rules.
Does the AI Act require ISO/IEC 42001 certification for recruiting AI?
No, the EU AI Act does not require ISO/IEC 42001 certification. The European Commission says ISO/IEC 42001 helps set up an AI management system but does not match the quality management system the AI Act requires for high-risk systems. CEN and CENELEC approved EN 18286 for that purpose in June 2026, and the Commission cited EN 18286:2026 in the Official Journal on 14 October 2026 under Implementing Decision (EU) 2026/2274. Treat ISO/IEC 42001 as a governance framework that can support AI Act duties, including the Article 26 deployer obligations, and confirm with counsel which standard, if any, your quality management system should follow.
What drives the effort and cost of a recruiting AI governance program?
The main drivers are the number of AI tools in hiring, how much each one decides or influences outcomes, and how much of the evidence already exists. Effort rises with vendors that cannot provide logs, documentation or model change notices, with multiple jurisdictions and works council requirements, and with the number of human reviewers who need documented competence. Costs fall into one-time work (inventory, classification, impact assessment, procedures and training) and recurring work (log retention, monitoring, internal audit and review). Ask any partner for a fixed-scope quote that lists the tools, the business units, the deliverables and the evidence set, since a written scope is what makes a comparison possible.
Can we run ISO 42001 for recruiting AI in house?
Yes, if you have people with the skills and time to do it, and many organizations do. The work covers an AI inventory, a Statement of Applicability under clause 6.1.3, the impact assessment under A.5.4, documented use processes under A.9.2, competence records for human reviewers, and logs kept for at least six months under Article 26(6). An in-house team usually needs governance, HR, legal and security members, plus a technical owner who can pull logs from the hiring platform. An outside partner can help with systems and evidence, and it is also reasonable to buy only part of the work. Whichever route you choose, the organization keeps ownership of the controls.
What should we check in the hiring platform's logs before an assessment?
Check that logs record each AI-assisted decision, the model or version used, the inputs that the system relied on, the human reviewer and the outcome. Article 26(6) requires deployers to keep logs under their control for at least six months, unless other Union or national law provides a longer period, so confirm that the vendor exports logs to storage you control. Also confirm that the logs can be searched by candidate and by requisition, and that access is restricted and reviewed. Ask the vendor in writing how each of these points is met, because a vendor statement is not the same as a test you have run yourself.
What to ask a partner, auditor or vendor before you sign
Before you sign with an implementation partner, ask for a written scope that names each deliverable for the HR and recruiting AI estate: the inventory of screening, ranking, interview-analysis and workforce monitoring tools, the Annex A controls in scope, and the systems each control will cover. Ask for the evidence list in the same document, meaning the specific records you will hold at the end, such as the impact assessment for each employment use, the worker notice templates, the human oversight role descriptions and training records, and the log retention settings. A partner prepares this material, but the organization owns the controls, so the list should show who produces each item and who signs off on it. Scope and deliverables agreed in writing are the basis for judging whether the work was done, and a verbal assurance that something is covered is not enough.
Ask any certification body or auditor for its accreditation status for ISO/IEC 42001 before you engage it. ISO does not certify organizations; external certification bodies do, and accreditation of those bodies is voluntary. ISO/IEC 42006:2025, published 7 July 2025, sets additional requirements on top of ISO/IEC 17021-1 for bodies certifying AI management systems, so ask the body to confirm in writing that it works to that standard and to name the accreditation body that assessed it. Note that, as of the Global ACI-FMRA-001 version 3.3 listing, ISO/IEC 42001 is not an endorsed sub-scope of the Global ACI recognition arrangement, so do not assume that a body's accreditation covers this scope unless the accreditation certificate says so. Confirm this with the accreditation body directly.
For each AI vendor in your recruiting stack, ask in writing whether the product can keep logs under your control, how long it retains them, and whether it can export them to your own storage. Article 26(6) of the EU AI Act requires deployers to keep logs under their control for at least six months unless other Union or national law says otherwise, so a vendor that deletes logs on a shorter cycle creates a gap you must close yourself. Ask the same vendor how it supports the notices that Article 26(7) and Article 26(11) require, including whether it can provide the wording and the timing for informing worker representatives and candidates, and whether its product can flag when a decision was assisted by AI. Treat each answer as a claim to verify with a test export or a configuration review, not as a fact until you have seen it working in your environment.
How DeployOpen prepares recruiting AI evidence for an audit
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and prepares the systems, controls and evidence that an ISO 42001 assessment will examine for recruiting and workforce AI. An independent certification body issues any certificate; DeployOpen does not.
How we scope
- Engagements are fixed-scope, with the recruiting AI systems, workflows and decision points agreed in writing before work starts.
- The written scope names which Annex A controls apply to your screening, ranking and monitoring tools and which are excluded, with reasons.
- We confirm which roles own human oversight, employee notices, impact assessments and log retention before any build begins.
How we build
- We configure logging so records of AI-assisted screening decisions are kept under your control for the retention period your counsel confirms.
- We set up the documented processes for responsible use, reviewer assignments and override paths that your recruiters actually follow.
- We test the controls we built, including whether a flagged candidate can be escalated to a trained reviewer and the outcome recorded.
How we hand over
- You receive documentation covering system descriptions, impact assessment records, oversight procedures and the evidence index mapped to each in-scope control.
- We walk your compliance, HR and platform teams through where each piece of evidence lives and who maintains it.
- Your team owns the controls, the policies and the final decisions; we hand over the systems and records needed for an independent assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Retainers can cover updates to logging, oversight configuration and documentation when hiring tools or vendors change.
- Before a certification body audit, we can review the evidence set against the agreed scope, but the auditor's findings remain the auditor's.
