The algorithm runs in Bengaluru. The candidate is in Frankfurt. The liability is yours.

The lead weather, because the deployer desk lives here. RPO providers, staffing firms, Employers of Record and the HR-shared-services arms of consulting and GCC operations all run AI screening for clients, and the Act makes each of them the liable deployer, not the vendor. The same advisory firms also gain a new engagement: helping clients inventory, classify and govern their AI hiring before the August date. The liability and the opportunity sit in the same sector.

The provider side of the split, and the lighter exposure. The vendors that build applicant-tracking and screening AI carry the provider obligations -- documentation, bias testing, CE marking -- but the Act deliberately does not let provider compliance discharge the deployer's duties. So the technology sector's exposure is real but bounded: build a compliant tool, and the harder, ongoing liability still sits with whoever deploys it.

High-volume, high-scrutiny hiring and a parallel governance muscle. Banks and financial firms screen at scale and already run model-risk and control functions, so the AI-hiring obligations land on an operation that understands documented, audited decision-making -- but also on one whose offshore GCCs run much of that screening from India, inheriting the deployer exposure directly.

Volume hiring is the exposure. Retail recruits at scale and seasonally, exactly the pattern that pushes employers toward automated screening to handle application volume -- and high-volume automated screening of EU-based applicants is squarely the high-risk use the Act targets. The convenience that makes automation attractive is the same feature that makes the compliance obligation unavoidable.

Workforce-critical hiring under a stricter eye. Healthcare recruits constantly and across borders, and the sector's regulatory culture means automated screening here draws particular scrutiny on fairness and documentation. The fundamental-rights framing of the Act lands hard where the workforce decision affects access to a regulated profession.

Cross-border hiring and supplier-chain workforce exposure. Manufacturers hire across multiple jurisdictions and increasingly screen with AI, so the extraterritorial reach of the Act catches any EU-facing recruitment run from a shared-services centre, wherever that centre sits. The exposure travels with the candidate, not the company's headquarters.

High-churn, high-volume recruitment and lighter but real exposure. Hospitality's constant hiring pushes toward automated screening, and where that screening touches EU-based applicants the high-risk obligations apply, even though the sector's individual decisions are lower-stakes than in finance or healthcare. Volume, not complexity, is what draws the obligation here.

Modest direct hiring exposure, mostly through outsourced administration. Real estate firms hire less at volume than retail or hospitality, so the AI-hiring exposure is lighter and concentrated where recruitment is outsourced to a screening provider -- at which point the deployer-liability question moves to that provider, and the chain of responsibility has to be mapped.

Specialised, lower-volume hiring and the lightest exposure of the nine. Energy recruits for technical, often scarce roles where human judgement dominates and automated mass-screening is least useful, so the AI-hiring obligation bites least here. The exposure is real only where the sector adopts screening AI for its higher-volume administrative and support hiring.