Free Assessment

Table of Contents

Reach SOC 2 Compliance in 6 Weeks or Less.

Request a Demo

Home

  /

  / EU AI Act Recruitment Rules: What to Know for 2027

EU AI Act Recruitment Rules: What to Know for 2027

Picture of Pedro Dias
Copy Link

The EU AI Act names recruitment AI as high-risk. Annex III explicitly lists AI systems used for recruitment, candidate selection, and employment decisions, which pulls CV screeners, video interview platforms, and assessment tools into the most demanding compliance regime the Act contains. The original compliance date for these systems was August 2, 2026. In June 2026, the EU’s Digital Omnibus moved the deadline to December 2, 2027, a 16-month extension that has led many HR and talent teams to shelve the topic entirely.

That’s a mistake, for two reasons.

  • First, one rule that directly affects recruitment technology is already in force: the ban on emotion recognition in the workplace has applied since February 2, 2025, and it catches features still shipping in some video interview products today.
  • Second, the deferred obligations didn’t shrink. Conformity assessments, human oversight design, bias monitoring, and documentation all still arrive in full, and the practical work of auditing a recruitment stack, renegotiating vendor contracts, and training hiring teams routinely takes a year or more.

Here’s what the EU AI Act actually requires of employers and vendors using recruitment tools, on the timeline that now applies.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

Schedule a consultation

Why Recruitment Tools Are Classified as High-Risk Under the EU AI Act​

Definition of High-Risk AI Systems in Hiring​

The Act takes a list-based approach. Annex III, point 4, designates as high-risk any AI system intended for the recruitment or selection of natural persons, including placing targeted job advertisements, analyzing and filtering applications, and evaluating candidates. The same point covers AI used for decisions on promotion, termination, task allocation, and monitoring of workers, so the classification follows the tool through the entire employment lifecycle, not just the hiring funnel.

The reasoning is straightforward: hiring decisions shape access to livelihoods, and algorithmic discrimination in hiring is well documented. The European Commission’s regulatory framework for AI treats employment as one of the areas where an AI error or bias causes serious harm to fundamental rights. That’s the test for the high-risk tier.

Types of Recruitment Tools Affected

In practice, the high-risk classification captures most of the modern recruitment stack: CV and resume screeners that rank or filter applicants, video interview platforms that score responses or delivery, psychometric and skills assessment tools that produce scores feeding a hiring decision, sourcing and matching algorithms that decide which candidates a recruiter sees, and programmatic job ad targeting systems that determine who sees a vacancy at all.

If the system’s output materially influences who advances and who does not, assume high-risk until proven otherwise.

Important: Emotion recognition is not high-risk in the workplace. It is prohibited. Article 5 bans AI systems that infer emotions of people in the workplace (outside narrow medical and safety cases), and that ban has applied since February 2025 with the Act’s top penalty tier attached. If your video interview vendor markets “engagement scoring” or “sentiment analysis” of candidates, that feature needs to be switched off for EU hiring now, not in 2027.

Recruitment Tools That May Fall Outside High-Risk Classification

Not everything in the HR stack qualifies. The Act carves out systems performing narrow procedural tasks that do not materially influence decision outcomes. An applicant tracking system that stores applications, schedules interviews, and sends templated emails is a database with a workflow, not a high-risk AI system. The same goes for tools that transcribe interviews without scoring them, deduplicate candidate records, or generate first drafts of job descriptions for a human to edit.

The line is decision influence: the moment a tool ranks, scores, filters, or recommends candidates, it crosses into Annex III territory. Deployers who rely on an exemption must be able to document that assessment, so “we decided it doesn’t count” needs to exist on paper.

Extraterritorial Scope: Which Employers Are Covered

The Act applies to providers placing AI systems on the EU market and to deployers established in the EU, but it also reaches further: it covers providers and deployers located outside the EU where the output of the system is used in the EU. For recruitment, the consequence is blunt. A US or UK company with no EU entity that uses an AI screener to filter applicants for roles based in Berlin or Dublin, or that screens candidates located in the EU, is using the system’s output in the Union. Brexit doesn’t move UK employers out of scope when they hire into or from the EU.

Providers vs. Deployers of Recruitment AI Tools

The Act splits obligations between the provider (the vendor that develops the tool and places it on the market) and the deployer (the employer using it). Most employers are deployers, and deployer obligations are lighter but real. One common trap: an employer that substantially modifies a high-risk system, or puts its own name on it, can be reclassified as a provider and inherit the full provider stack. Heavy customization of a screening model, or fine-tuning it on your own hiring data, can be enough to trigger this.

Key Obligations for Employers Using AI Recruitment Tools

Human Oversight in Automated Hiring Decisions

Deployers must assign oversight of the system to people with the competence, training, and authority to intervene. That last word matters. A recruiter who rubber-stamps whatever the ranking algorithm produces, because nobody has time to review 800 rejected CVs, doesn’t count as oversight. Regulators and courts will look at whether the human could genuinely override the system and whether they ever did. Designing review checkpoints where a person can meaningfully change the outcome, and logging when they do, is the core of compliant deployment.

Transparency Requirements Toward Candidates

Employers must inform workers and their representatives before putting a high-risk AI system into use at work, and candidates subjected to such a system must be told it is being used. In countries with works councils, such as Germany, this obligation lands on top of existing co-determination rights, so employee representatives may need to be consulted before the tool goes live rather than just told afterward. Burying an AI disclosure in a privacy policy paragraph is unlikely to survive scrutiny.

Bias Monitoring, Data Quality, and Record-Keeping

Providers carry the primary data governance duties, including training data that is relevant, representative, and examined for bias. Deployers must ensure the input data they feed the system is relevant and sufficiently representative for its purpose, keep the automatically generated logs for at least six months, and monitor performance in live use. If your candidate pool in a given market differs sharply from what the tool was built on, that is a deployer problem, not just a vendor one.

Fundamental Rights Impact Assessments (FRIA)

The FRIA obligation in Article 27 applies to deployers that are public bodies or private entities providing public services, plus certain financial use cases. A typical private employer running an AI screener isn’t legally required to produce a FRIA. Two caveats: public-sector employers are covered, and where the tool processes personal data, a Data Protection Impact Assessment under the GDPR is almost certainly required anyway. Most organizations that get this right run a single combined assessment covering both.

Obligations for Providers and Vendors of AI Recruitment Software​

Vendors face the full high-risk regime:

  • a risk management system across the product lifecycle,
  • data governance,
  • technical documentation proving compliance,
  • a third-party or internal conformity assessment before market placement, CE marking,
  • registration in the EU’s high-risk AI database,
  • and post-market monitoring with incident reporting.

For employers, this paperwork is your due diligence checklist. A vendor who cannot show you their conformity documentation by mid-2027 is telling you something about your own December 2027 exposure.

Insider Note: The vendor conversation to watch for is “we’re just an ATS, the Act doesn’t apply to us.” Sometimes that’s true. But many platforms marketed as applicant tracking systems have added AI ranking, matching, or “best fit” features over the past three years, and those features change the classification even if the core product predates them. Ask specifically which features use AI to score, rank, or filter candidates, and get the answer in writing.

Implementation Timeline for Recruitment AI Compliance

The timeline shifted materially in mid-2026. The Digital Omnibus, given final approval by the Council on June 29, 2026, replaced the original August 2, 2026 date for standalone Annex III systems. According to analysis by Gibson Dunn, high-risk obligations for Annex III systems, including recruitment tools, now apply from December 2, 2027, with AI embedded in regulated products following on August 2, 2028. The dates that matter for hiring teams:

  • February 2, 2025: prohibited practices in force, including the workplace emotion recognition ban. Already live.
  • August 2, 2025: general-purpose AI model obligations in force. Already live.
  • August 2, 2026: most Article 50 transparency obligations in force, including chatbot disclosure for candidate-facing assistants. Already live.
  • December 2, 2027: full high-risk obligations apply to standalone Annex III systems, including recruitment and employment tools.

Law firm guidance throughout the negotiation, including from DLA Piper, has been consistent on one point: the deferral moved the deadline and nothing else. No obligation was removed or softened for employment AI.

Worth Knowing: Grandfathering rule for High-risk systems

There is a grandfathering rule for high-risk systems already placed on the market before the deadline, but it resets the moment the system is substantially modified. Recruitment AI vendors ship model updates constantly, so treating grandfathering as a durable shield for a SaaS screening tool is optimistic at best.

Penalties for Non-Compliant Use of Recruitment Tools

Article 99 sets three fine tiers. Use of a prohibited practice, such as workplace emotion recognition, carries fines up to €35 million or 7% of global annual turnover, whichever is higher. Non-compliance with high-risk obligations, the tier most relevant to recruitment AI, reaches €15 million or 3% of turnover. Supplying misleading information to authorities carries up to €7.5 million or 1%. SMEs benefit from a proportionality rule where the lower of the two amounts applies, but a fine calculated on turnover is still serious money for a growth-stage company.

The fine is rarely the whole cost, though. A finding of non-compliant AI hiring invites discrimination claims from rejected candidates, works council disputes, orders to withdraw the system (mid-hiring-cycle, with a pipeline built on it), and the kind of press coverage that makes the next thousand candidates think twice. GDPR enforcement history suggests regulators reserve the harshest penalties for organizations with no documentation and no good-faith effort, and that pattern should factor into any plan that starts the work in late 2027.

Interaction with GDPR and Other EU Employment Laws

The AI Act does not replace the GDPR; the two apply in parallel, and for recruitment the GDPR has been the binding constraint since 2018. Article 22 GDPR gives candidates the right not to be subject to a decision based solely on automated processing that significantly affects them. A fully automated rejection fits that description. Candidates also hold access, rectification, and erasure rights over their application data, and the right to meaningful information about the logic involved in automated decisions.

EU anti-discrimination law adds a third layer. The equal treatment directives prohibit indirect discrimination, and an algorithm that disadvantages a protected group produces liability regardless of intent. The AI Act’s bias testing and logging obligations effectively create the evidence trail that discrimination claims will be argued from, in both directions: good records are a defense, and missing records are an admission.

How to Audit Your Recruitment Tool Stack for EU AI Act Compliance​

Start with an inventory, because most organizations do not have one. In our compliance work, the most common gap isn’t a defiant vendor or a rogue algorithm. It’s that HR bought the tool two years ago, nobody mapped which features use AI, and nobody can produce the vendor’s documentation when asked.

A workable audit runs in three passes:

  • Inventory and classify. List every tool touching candidates or employees, flag every feature that scores, ranks, filters, or recommends people, and classify each against Annex III.
  • Vendor due diligence. Request each vendor’s AI Act readiness statement, conformity assessment plans, technical documentation summary, training data governance description, and confirmation that no prohibited features (emotion inference, biometric categorization) are active for EU use.
  • Contracts and governance. Add AI Act warranties, documentation delivery obligations, notification of substantial modifications, and audit rights to vendor contracts at the next renewal. Internally, assign oversight owners, train them, and stand up the DPIA/FRIA process.

For budgeting purposes, a focused audit of a typical mid-size recruitment stack (an ATS plus two to four AI-enabled tools) is a matter of weeks, not months, but remediation is where the calendar burns: vendor responses, contract renegotiation, and works council consultation each add months of elapsed time.

Organizations already running structured AI governance, for example under ISO 42001, have most of the inventory and oversight machinery in place already and mainly need to map it to the Act’s specific articles.

Pro Tip: Substantial Modification Clause

Put a substantial modification clause in every recruitment AI contract renewed from now on. If the vendor makes a substantial change to the model, you need to know, because it can reset grandfathering and change your risk classification. Vendors won't volunteer this; the contract has to make them.

Practical Steps to Prepare Your Recruitment Process

Sequence the work backward from December 2027.

  • Quarter one: inventory, classification, and killing any prohibited features immediately.
  • Quarters two and three: vendor due diligence and contract updates, candidate-facing transparency language, and a combined DPIA covering AI-specific risks.
  • Quarters four onward: human-in-the-loop process design, training for recruiters and hiring managers, log retention setup, and a dry-run review of one live hiring campaign end to end.

Teams that treat the first half of 2027 as the deadline, rather than December, leave room for the vendor who answers slowly and the works council that meets quarterly.

The talent market makes early movement more valuable. Axipro’s 2026 study of AI governance hiring across Europe found companies hiring roughly seven AI builders for every governance professional, which means the people who can run this compliance work are scarce and getting scarcer. Employers who need external EU AI Act compliance support should scope it before the 2027 crunch pushes prices up.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

Schedule a consultation

Conclusion: Turning Compliance Into a Competitive Recruitment Advantage

The EU AI Act treats recruitment tools as high-risk because hiring decisions change lives, and the December 2027 deadline is a reprieve on paperwork, not on principle. The emotion recognition ban already applies, transparency duties began in August 2026, and the full high-risk regime arrives with no obligations removed.

Employers who inventory their stack, pressure-test their vendors, and build genuine human oversight now will spend 2027 refining a working system instead of triaging one.

And in a market where candidates increasingly ask how they are being screened, being able to answer clearly is a recruiting asset in its own right.

Frequently Asked Questions

Are ATS (Applicant Tracking Systems) considered high-risk AI?

Not by default. An ATS that stores applications and manages workflow performs narrow procedural tasks and falls outside the high-risk category. It becomes high-risk when it includes AI features that rank, score, filter, or match candidates, which many modern ATS platforms now do. Audit the features, not the product label.

Yes, as high-risk systems with full obligations attached: human oversight, candidate disclosure, logging, and a compliant vendor. What they can’t do is infer candidates’ emotions. Emotion recognition in the workplace has been prohibited since February 2025, so any sentiment or engagement scoring feature must be disabled for EU hiring.

The AI Act itself grants disclosure rights rather than an opt-out. The stronger right comes from Article 22 GDPR: candidates cannot be subject to a solely automated decision with significant effects, which in practice forces meaningful human involvement in rejections. Combined with access and objection rights over their data, a candidate can effectively demand human review.

The vendor faces provider-tier fines of up to €15 million or 3% of turnover, but the employer isn’t insulated. Deployers have independent obligations, and using a system you knew or should have known lacked conformity documentation is your own compliance failure. This is why vendor due diligence and contractual warranties belong in every renewal between now and December 2027.

Yes. Annex III covers AI used for decisions affecting work-related relationships, including promotion, termination, task allocation, and performance monitoring. A tool that recommends internal candidates for advancement carries the same high-risk obligations as an external hiring screener.

Axipro Author

Picture of Pedro Dias

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.
Copy Link

Blog Highlights

Explore More Articles

Read More Blogs

EU AI Act Recruitment Rules: What to Know for 2027

The EU AI Act names recruitment AI as high-risk. Annex III explicitly lists AI systems used for recruitment, candidate selection, and employment decisions, which pulls CV screeners, video interview platforms, and assessment tools into the most demanding compliance regime the Act contains. The original compliance date for these systems was August 2, 2026. In June 2026, the EU’s Digital Omnibus moved the deadline to December 2, 2027, a 16-month extension that has led many HR and talent teams to shelve the topic entirely. That’s a mistake, for two reasons. First, one rule that directly affects recruitment technology is already in force: the ban on emotion recognition in the workplace has applied since February 2, 2025, and it catches features still shipping in some video interview products today. Second, the deferred obligations didn’t shrink. Conformity assessments, human oversight design, bias monitoring, and documentation all still arrive in full, and the practical work of auditing a recruitment stack, renegotiating vendor contracts, and training hiring teams routinely takes a year or more. Here’s what the EU AI Act actually requires of employers and vendors using recruitment tools, on the timeline that now applies. Why Recruitment Tools Are Classified as High-Risk Under the EU AI Act​ Definition of High-Risk AI Systems in Hiring​ The Act takes a list-based approach. Annex III, point 4, designates as high-risk any AI system intended for the recruitment or selection of natural persons, including placing targeted job advertisements, analyzing and filtering applications, and evaluating candidates. The same point covers AI used for decisions on promotion, termination, task allocation, and monitoring of workers, so the classification follows the tool through the entire employment lifecycle, not just the hiring funnel. The reasoning is straightforward: hiring decisions shape access to livelihoods, and algorithmic discrimination in hiring is well documented. The European Commission’s regulatory framework for AI treats employment as one of the areas where an AI error or bias causes serious harm to fundamental rights. That’s the test for the high-risk tier. Types of Recruitment Tools Affected In practice, the high-risk classification captures most of the modern recruitment stack: CV and resume screeners that rank or filter applicants, video interview platforms that score responses or delivery, psychometric and skills assessment tools that produce scores feeding a hiring decision, sourcing and matching algorithms that decide which candidates a recruiter sees, and programmatic job ad targeting systems that determine who sees a vacancy at all. If the system’s output materially influences who advances and who does not, assume high-risk until proven otherwise. Important: Emotion recognition is not high-risk in the workplace. It is prohibited. Article 5 bans AI systems that infer emotions of people in the workplace (outside narrow medical and safety cases), and that ban has applied since February 2025 with the Act’s top penalty tier attached. If your video interview vendor markets “engagement scoring” or “sentiment analysis” of candidates, that feature needs to be switched off for EU hiring now, not in 2027. Recruitment Tools That May Fall Outside High-Risk Classification Not everything in the HR stack qualifies. The Act carves out systems performing narrow procedural tasks that do not materially influence decision outcomes. An applicant tracking system that stores applications, schedules interviews, and sends templated emails is a database with a workflow, not a high-risk AI system. The same goes for tools that transcribe interviews without scoring them, deduplicate candidate records, or generate first drafts of job descriptions for a human to edit. The line is decision influence: the moment a tool ranks, scores, filters, or recommends candidates, it crosses into Annex III territory. Deployers who rely on an exemption must be able to document that assessment, so “we decided it doesn’t count” needs to exist on paper. Extraterritorial Scope: Which Employers Are Covered The Act applies to providers placing AI systems on the EU market and to deployers established in the EU, but it also reaches further: it covers providers and deployers located outside the EU where the output of the system is used in the EU. For recruitment, the consequence is blunt. A US or UK company with no EU entity that uses an AI screener to filter applicants for roles based in Berlin or Dublin, or that screens candidates located in the EU, is using the system’s output in the Union. Brexit doesn’t move UK employers out of scope when they hire into or from the EU. Providers vs. Deployers of Recruitment AI Tools The Act splits obligations between the provider (the vendor that develops the tool and places it on the market) and the deployer (the employer using it). Most employers are deployers, and deployer obligations are lighter but real. One common trap: an employer that substantially modifies a high-risk system, or puts its own name on it, can be reclassified as a provider and inherit the full provider stack. Heavy customization of a screening model, or fine-tuning it on your own hiring data, can be enough to trigger this. Key Obligations for Employers Using AI Recruitment Tools Human Oversight in Automated Hiring Decisions Deployers must assign oversight of the system to people with the competence, training, and authority to intervene. That last word matters. A recruiter who rubber-stamps whatever the ranking algorithm produces, because nobody has time to review 800 rejected CVs, doesn’t count as oversight. Regulators and courts will look at whether the human could genuinely override the system and whether they ever did. Designing review checkpoints where a person can meaningfully change the outcome, and logging when they do, is the core of compliant deployment. Transparency Requirements Toward Candidates Employers must inform workers and their representatives before putting a high-risk AI system into use at work, and candidates subjected to such a system must be told it is being used. In countries with works councils, such as Germany, this obligation lands on top of existing co-determination rights, so employee representatives may need to be consulted before the tool goes live rather than just told afterward. Burying an AI disclosure in a privacy policy paragraph is unlikely to survive scrutiny.

Read more

4 SOC 2 Controls Auditors Reject Even When Your Compliance Tool Says Passing

A green dashboard is not an audit opinion. Compliance automation platforms like Vanta, Drata, Secureframe, and Hyperproof have made SOC 2 readiness faster and cheaper, but every audit cycle produces the same pattern: controls that sat at “passing” for months come back from the auditor with exceptions or requests for re-testing. The four controls below account for a disproportionate share of those rejections, and they all fail for the same underlying reason. The tool confirmed that evidence exists. The auditor tested whether the control actually operated. This article walks through each of the four: what auditors reject, why, and how to fix the evidence before fieldwork starts. Why Compliance Tools Show “Passing” But Auditors Still Reject Controls​ The Gap Between Automated Checks and Auditor Judgment Compliance platforms run continuous control monitoring: API calls that check whether a configuration exists, a document is uploaded, or a task is marked done. That’s real value. It catches drift, keeps evidence in one place, and saves weeks of screenshot collection. An audit is a different exercise. A SOC 2 examination is an attestation performed by a CPA firm under AICPA standards, and the auditor’s job is to form an independent opinion on whether your controls met the Trust Services Criteria. That opinion rests on professional judgment, not on whether an API integration returned a 200 response. What “Passing” Actually Means in Your Compliance Dashboard​ When a control shows “passing,” the platform is telling you one narrow thing: at the moment of the last scan, an automated test found the artifact or setting it was programmed to look for: MFA enforced in the identity provider, a policy document uploaded, a training campaign sitting at 100%. The test says nothing about whether the underlying process ran the way your control narrative claims it did, or whether it ran that way across the whole audit period. How Auditors Evaluate Controls Beyond the Checkbox Auditors test two dimensions. Design effectiveness asks whether the control, as described, would meet the criterion if it worked as intended. Operating effectiveness, the core of a SOC 2 Type 2 report, asks whether it actually did throughout the audit period. To answer that, the auditor pulls a population (every access review, every change, every new hire in the period), selects a sample, and inspects the evidence item by item. A dashboard status feeds into that process. It doesn’t replace it. Insider Note: Auditors increasingly ask for evidence outside the compliance platform precisely because they know what the platform auto-collects. If every artifact you produce comes from the same tool export, expect the auditor to independently pull the population from the source system and compare. Discrepancies between the two are one of the fastest routes to an exception. Control #1: Access Reviews That Automation Marks Complete but Auditors Reject Why Auditors Reject Automated Access Review Evidence​ User access reviews sit under the logical access criteria (CC6.1 through CC6.3), and they are the single most common source of audit exceptions we see. The typical failure: the platform generated a user list, someone clicked “complete,” and the dashboard turned green. The auditor then asks a simple question the evidence can’t answer: what did the reviewer actually decide? The Missing Element: Documented Reviewer Judgment​ An access review is a judgment control. Someone with knowledge of the system must look at each account and confirm the access is still appropriate for the person’s role. A timestamped task closure proves the task was closed. It doesn’t prove anyone assessed anything, and an “approve all” review completed in ninety seconds gets exactly the skepticism it deserves. What Auditors Actually Want to See in Access Review Evidence Auditors look for four things: The full population of accounts at the time of review (including service accounts and admin roles), Evidence of who reviewed it and when, explicit dispositions per account or group (retain, modify, revoke), and Proof that flagged access was actually removed. That last item, the deprovisioning ticket showing revocation within a defined window, is the piece most companies can’t produce. How to Fix Your Access Review Control Before the Audit​ Assign a named control owner per in-scope system, run reviews quarterly, and require reviewers to record a disposition for every line, not a blanket approval. When access is revoked, link the removal ticket to the review record. If a quarter was missed, don’t backfill it. Document it honestly and show the remediation, because auditors treat fabricated retroactive evidence far more severely than a disclosed gap. Control #2: Change Management Approvals That Pass Automated Scans​ Why Ticket Closure Isn’t Proof of Approval​ Change management (CC8.1) automation typically verifies that production changes link to a ticket and the ticket is closed. Auditors test something stricter: that each sampled change was approved by an authorized person before deployment. An approval added after the merge, or a ticket closed by the same engineer who wrote the code, fails that test even though every automated check came back green. The Segregation of Duties Problem Automation Misses Segregation of duties is the requirement that no single person can develop, approve, and deploy the same change. NIST’s SP 800-53 control catalog treats it as a foundational access control principle, and SOC 2 auditors apply the same logic. Small engineering teams trip on this constantly. Self-approved pull requests, admins who can bypass branch protection, direct pushes to main: a scanner sees “changes with tickets” while an auditor sees SoD violations. Emergency Changes and Retroactive Approvals: Common Rejection Triggers​ Every audit period contains hotfixes. Auditors don’t reject emergency changes. They reject emergency changes with no documented post-hoc review. If your policy says urgent changes get retroactive approval within two business days, the auditor will sample your emergency changes and check exactly that. No policy, or a policy nobody followed, produces an exception. Rebuilding Change Management Evidence Auditors Will Accept​ Enforce the control technically: branch protection requiring at least one independent reviewer, no admin bypass, and deploy pipelines that only run from protected branches. Then write the emergency change procedure down and generate the review artifact every time it fires.

Read more
AI Tool Usage Tracking

AI Tool Usage Tracking: Why CASB & DLP Miss Shadow AI

One in five breached organizations last year traced the incident to shadow AI, and those breaches cost an average of $670,000 more than standard incidents, according to IBM’s 2025 Cost of a Data Breach Report. The worst part is that most of those organizations already ran a CASB, a DLP program, or both. The tools were on, but the traffic still got through. That’s the visibility gap this article is about. AI tool usage tracking isn’t the same problem as SaaS discovery, and the security stack built for the SaaS era misses most of what matters about AI. Below, we break down what tracking actually requires, where CASB and DLP fail, which categories of AI usage slip through, and what a stack that works looks like in 2026. What AI Tool Usage Tracking Actually Means Most teams that say they “track AI usage” mean they can see that someone visited chat.openai.com. That is app discovery, and it answers almost none of the questions a security or governance team actually needs answered. Beyond App Discovery: Tracking Prompts, Data Flows, and Model Interactions Real tracking covers three layers. First, which tools are in use: chatbots, copilots, coding assistants, embedded SaaS features, agents. Second, what data moves: the content of prompts, uploaded files, and pasted context, mapped against data classifications. Third, how models behave in your environment: which endpoints get called, which OAuth grants exist, which agents hold standing permissions. Seeing that an employee opened ChatGPT gets you nowhere. What you actually need to know is whether they pasted a customer contract into a personal account while they were there. The Difference Between Detection, Monitoring, and Continuous Tracking Detection is a point-in-time answer to “what AI is here?” Monitoring watches known tools on an ongoing basis. Continuous tracking is broader: it assumes the inventory changes weekly, correlates identity, data, and endpoint signals over time, and feeds a governance program rather than a one-off report. Frameworks such as the NIST AI Risk Management Framework and ISO 42001 assume the third mode. A discovery scan from last quarter won’t satisfy an auditor, and it certainly won’t slow down an attacker. Why Traditional SaaS Monitoring Falls Short for AI SaaS monitoring was built around a stable premise: an app is a destination with a domain, a login, and an admin console. AI breaks that premise in several ways at once. The risky activity is the content of an interaction, not the visit. The tool often isn’t a destination at all but a feature inside an app you already sanctioned. And increasingly the “user” isn’t a person but an agent acting on delegated credentials. Why CASB Misses Shadow AI Usage The Cloud Access Security Broker sits between users and cloud services to enforce policy, and for classic SaaS governance it still earns its keep. AI has structural blind spots that no amount of tuning can fix. CASBs Were Built for SaaS Apps, Not Model Endpoints A CASB catalog maps domains to applications with risk scores. AI usage doesn’t resolve neatly to a domain. The same api.openai.com endpoint serves a sanctioned enterprise deployment, a developer’s weekend experiment, and a data-leaking browser extension, and the catalog sees one “app”. Meanwhile, new model endpoints, wrappers, and niche AI tools appear faster than any vendor catalog can keep up with. Gartner research from late 2025 found 69% of organizations already suspect or have evidence that employees use prohibited public generative AI tools, catalog or no catalog. Blind Spots in Encrypted API Traffic to LLM Providers Prompt content travels over TLS. Without full TLS inspection, a CASB sees connection metadata: destination, volume, timing. It can’t see that the payload contained source code or patient records. And full TLS inspection is harder than the datasheet implies. Certificate pinning breaks it for many native apps and CLI tools, legal and works-council constraints limit it in the EU, and most organizations carve out broad exemption lists that AI traffic happily rides through. The OAuth and Embedded AI Problem CASBs Can’t See When an employee grants an AI meeting-notes tool access to their calendar and mailbox via OAuth, no proxy is involved at all. The vendor’s servers communicate directly with Microsoft’s or Google’s APIs using a persistent token. The same applies to AI features embedded inside sanctioned SaaS, think Notion AI, Slack AI, or Salesforce Einstein. The CASB sees approved traffic to an approved app, while the AI processing happening inside it, and whichever sub-processor it forwards data to, stays invisible. Personal Accounts and BYO-AI Bypass CASB Proxies Netskope’s 2026 Cloud and Threat Report found that nearly half of employees who use generative AI at work do so through personal accounts. Personal accounts on managed devices are hard enough; personal accounts on personal devices, home networks, and mobile connections never touch the corporate proxy path at all. Tenant restrictions help for a handful of major providers and do nothing for the long tail. Browser-Based and Extension-Delivered AI Escape Network Inspection AI browser extensions read page content and form inputs locally, then exfiltrate via their own backend, often to generic cloud infrastructure that categorizes as “technology” rather than “AI”. From the network’s view, it is routine HTTPS to a CDN. The riskiest interaction, an extension scraping everything an employee views, produces the most boring traffic signature. Insider Note: In AI governance readiness assessments, the OAuth grant review is where clients get the biggest surprise. We routinely find dozens of AI tools holding live mail, calendar, or drive scopes that nobody in IT ever approved, granted by employees who abandoned the tool (and sometimes the company) months earlier. The tokens keep working anyway. Why DLP Fails to Catch Shadow AI Data Exposure DLP has the opposite problem. It can sometimes see content, but it doesn’t understand it, and AI interactions defeat the pattern matching it depends on. Prompt-Based Data Loss Doesn’t Match DLP Signature Patterns DLP fires on signatures: credit card regexes, SSN formats, keyword dictionaries, file fingerprints. Sensitive prompts rarely look like that. “Summarize why we’re losing

Read more