AI in candidate sourcing under the EU AI Act: passive candidates, targeted outreach and the 4(a) territory before application

Recruiters and HR leaders often think of AI in recruitment as CV screening and assessments. But most AI impact sits before that phase, in candidate sourcing. Before a candidate ever clicks "apply", AI systems have already decided which vacancies they see, which profiles recruiters get in view, and which messages are sent. For the EU AI Act this means: a large part of the 4(a) action sits in a phase HR teams traditionally don't consider "high-risk".

This post explains where AI sits in sourcing, why this reads as Annex III point 4(a), and what recruiters and compliance must arrange for the most invisible layer of the recruitment process.

Where AI sits in sourcing

The modern sourcing stack increasingly covers:

• LinkedIn Recruiter Recommended Matches — AI suggestions for passive candidates per requisition (see LinkedIn analysis)
• AI-driven sourcing tools — Eightfold, Phenom, Hiretual, SeekOut: cross-platform candidate discovery with AI matching
• Job board targeting algorithms — Indeed, Glassdoor, Stepstone: AI determines which candidates see which job ads
• Automated outreach — personalized messages generated by AI per candidate
• Talent pool nurture AI — automatic re-engagement of previously rejected or unplaced candidates
• Boolean search assistants — AI improves search queries based on result patterns
• Browser extensions with AI parsing — sourcing tools that push LinkedIn profiles or websites directly into ATS

Sourcing is for recruiters the focus of their work: finding candidates in a scarcity market. AI makes that more efficient but also shifts where decisions are made.

Why sourcing AI falls within 4(a)

Annex III point 4(a) covers AI used for "recruitment or selection of natural persons, in particular to advertise targeted job vacancies, to analyse and filter applications, or to evaluate candidates". The second part — "advertise targeted job vacancies" — is exactly where sourcing AI lives.

Arguments that do not work:

• "The candidate didn't apply so no impact" — the impact is that the candidate doesn't get a chance to apply at all. That is a more evident exclusion than a rejection.
• "LinkedIn does it, not us" — under Article 26 you as deployer are responsible for the use of the system in your recruitment.
• "It's just job board advertising" — if the targeting is algorithm-driven and has group-exclusive effects, it falls under targeted distribution.

In practice: an employer using sourcing AI (and almost every employer does via LinkedIn Recruiter alone) has a 4(a) deployment before every individual candidate assessment.

The legal layers in sourcing

Sourcing AI touches more than just Annex III. Three legal frameworks stack:

1. EU AI Act Annex III point 4(a) — targeting and pre-screening of candidates
2. GDPR — processing of personal data of passive candidates who haven't actively sought contact
3. Anti-discrimination law — if sourcing AI systematically excludes demographic groups (often indirectly via proxies), that can be indirect discrimination

The combination makes sourcing AI a specific risk category. Especially points two and three are underestimated by many employers.

When is sourcing AI within 4(a)

• AI Recommended Matches in ATS or LinkedIn — yes, 4(a). Per requisition ranking.
• AI-driven sourcing tools that suggest candidates — yes, 4(a). Pre-screening before recruiter sees them.
• Automated outreach with AI personalization — depends. Pure message generation without candidate scoring is lighter. Outreach tied to AI scoring is 4(a).
• Job board algorithms for targeted ads — usually AI-driven targeting. Falls within 4(a) if you actively set that targeting.
• Talent pool re-engagement — if AI decides who to approach based on profile match: 4(a).
• Browser extensions that only parse profiles — outside 4(a) if only parsing without scoring.

Step-by-step for sourcing AI dossier

What to do now

For talent acquisition leads with sourcing AI (and that is almost everyone): start with the tool inventory, treat LinkedIn Recruiter as priority-1, document GDPR basis for passive candidates, and build dossier via the HR AI hub and the HR AI Evidence Pack. For the application phase: see CV screening and pre-employment assessments.