EU AI Act Annex III point 4 (employment, workers management, recruitment) applies to SMB AI hiring use even at four-employee scale; the threshold does not scale with company size, and the 2 August 2026 enforcement window covers AI-screened CVs in ChatGPT/Claude/Gemini the same way it covers dedicated platforms (Workable, Greenhouse, Lever, BrightHire). The defensible posture is AI-assisted decisions with a documented human decision-maker plus retained AI-output records — not AI-decided hiring. Solely-automated candidate scoring also conflicts with GDPR Article 22; ICO, AP, and Garante guidance from 2024-2025 is consistent on the human-in-the-loop requirement.

Cross-domain: EU AI Act Annex III point 4 hiring categories intersected with SMB tooling reality. Statutory anchors: EU AI Act Regulation 2024/1689 Annex III + Article 99 penalties; GDPR Article 22 right not to be subject to solely automated decisions. Regulatory guidance: ICO AI in recruitment 2024, Dutch AP 2025 framework, Italian Garante 2024 ruling against AI scoring without disclosure. The deployer-side documentation (named human decision-maker + retained AI-output records + AI-disclosure in job advertisements) is what survives the audit at SMB scale. Pairs with AM-120 at the multinational works-council surface and OPS-038 at the SMB collective-agreement surface.