HR Tech MVP Development: Recruiting, GDPR and the AI Act

An HR tech MVP is a workflow product with unusually sensitive data: candidates and employees whose information is personal data under the GDPR, and, if AI helps decide who gets hired, promoted or monitored, a high-risk system under the EU AI Act. The way to test the idea in version one is usually to build the workflow, integrate with one system the customer already uses, and keep a person making every decision about a candidate or employee. With Easify an HR tech MVP typically costs €8,000 to €25,000 over 6 to 12 weeks.

Below: the workflows worth testing, whether to build at all, a step-by-step route from idea to pilot, candidate and employee data under the GDPR, what the AI Act says about AI in hiring and where its dates now stand, two other EU laws that shape HR products, integrations, a minimum feature set, what to leave out, cost drivers, a worked example scope, a brief template, common mistakes, questions for a development partner, a pre-launch checklist, and when not to hire us. The regulatory points are orientation from official summaries and texts, not legal advice.

At a glance

Workflows worth testing

Most HR software ideas improve one workflow that is still run on email and spreadsheets. Pick one.

• Recruiting. Job posting, applications, a pipeline of stages, interview scheduling, feedback and offers. The buyer is usually a hiring manager or recruiter at a company that has outgrown email but not yet bought an applicant tracking system, or a niche the big systems serve badly.
• Onboarding. Contracts, documents, equipment, accounts and first-week tasks for a new starter.
• Compliance and documents. Certificates, right-to-work checks and training that expire, with reminders before they do.
• Scheduling and time. Shifts, availability, absence and timesheets for hourly staff.
• Feedback and performance. Reviews, goals and one-to-ones. Note that AI used to monitor and evaluate performance is in the AI Act's high-risk list.

If the product connects independent workers to clients, it is also a marketplace; the marketplace MVP guide covers the two-sided problem. If you sell it per seat to companies, the SaaS MVP guide covers multi-tenancy and billing.

Build, configure or buy

Not every HR idea needs custom software. HR buyers already pay for applicant tracking systems, HR information systems and payroll, and many problems can be solved inside them. Decide this before you spend on a build.

From idea to pilot, step by step

1. Watch the workflow. Sit with three to five recruiters, HR managers or agency coordinators while they do the job. Note every spreadsheet, copy-paste and email they use. The steps they actually take are the scope; what they say they want is a hint.
2. Find a design partner. One company that agrees to pilot the product, ideally with a letter of intent or a paid pilot. Asking for money before you build is the cleanest test of the problem.
3. Choose one measure of success. Time from application to first interview, hours a recruiter spends on scheduling, documents expired without notice, or a similar number the design partner already cares about. Record the starting value before you build.
4. Map the decisions. Mark every point where someone decides about a candidate or employee, and what, if anything, software or AI contributes. This is the map your lawyer needs for the GDPR and the AI Act, and it is cheap to change on paper.
5. Scope and price. Write down the feature set, what is out, the integration and the hosting plan, and get a fixed price. Our €900 MVP Scoping Sprint produces exactly this in about two weeks and is credited in full against the build if you build with Easify.
6. Build in short cycles. Show working software to the design partner every week or two. Use synthetic candidates until the data processing agreement is signed.
7. Pilot with real users. One customer, one team, a fixed period. Measure the number from step 3 again at the end.
8. Decide. Keep, change or stop, based on the measure and on whether the customer will pay to continue.

For timelines across MVP types, see how long it takes to build an MVP.

Candidate and employee data under the GDPR

Everything about a candidate or employee is personal data under the GDPR, and an employer-candidate relationship is unequal, which affects what consent means.

• Who is the controller. When a company uses your tool to hire, the company is usually the controller and you are its processor, under a contract that meets Article 28. Build for the customer to configure retention, deletion and access.
• Employment rules. Article 88 lets Member States set more specific rules for employee data, so expect national differences.
• No solely automated decisions. Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Rejecting an application is one. The exceptions are narrow and still require the right to human intervention, to express a view and to contest the decision.
• Special categories. Diversity monitoring, health information for adjustments and trade union membership are special category data under Article 9. Keep them separate from hiring decisions and restricted to the people who need them.
• Retention. Set a period for unsuccessful candidates and a separate one, with consent, for a talent pool. Delete automatically when it ends, including from exports and email.
• EU hosting. We deploy client products to EU data-centre regions, so the product is hosted in the EU. Our engineers work from India, so any access they have to production candidate data is a transfer that needs a valid mechanism under GDPR Chapter V. We use synthetic candidates during the build and keep production access minimal.

The EU AI Act and AI in hiring

The AI Act, Regulation (EU) 2024/1689, is the part of HR tech founders most often get wrong in both directions: assuming it bans AI in hiring (it does not) or assuming a chatbot wrapper is outside it (it may not be).

What is high-risk. Annex III point 4 lists two kinds of system in employment, workers' management and access to self-employment:

• (a) AI systems intended for the recruitment or selection of people, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
• (b) AI systems intended to make decisions affecting the terms of work relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate the performance and behaviour of people in those relationships.

The exception, and its limit. Article 6(3) says an Annex III system is not high-risk where it does not pose a significant risk of harm, including by not materially influencing the outcome of decision-making, for example where it performs a narrow procedural task, improves the result of a completed human activity, or performs a preparatory task. But an Annex III system is always high-risk where it performs profiling of natural persons. A provider relying on the exception must document its assessment before placing the system on the market and register it (Article 6(4)). Ranking candidates by predicted fit is profiling; extracting dates from a CV into fields may be a narrow procedural task. Your lawyer should decide which side of the line your feature sits.

The Commission's draft guidance points the same way. The European Commission published draft guidelines on high-risk classification on 19 May 2026. As Mayer Brown summarises them, the preparatory-task exception does not cover a specific recommendation or evaluation that plays a decisive role, and the drafts give two HR examples: a job-matching tool whose scores are the primary input to the decision is high-risk, while a tool that flags discriminatory wording in job adverts is not. They are drafts, so check the final text before relying on them.

What a provider of a high-risk system must do. Article 16 lists the obligations, among them a quality management system (Article 17), technical documentation, logging, a conformity assessment (for employment systems, based on internal control under Article 43(2), without a notified body), an EU declaration of conformity, CE marking and registration in the EU database. Employers using the system have their own duties as deployers, including informing workers' representatives and affected workers before it is used at the workplace (Article 26(7)).

When it applies. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the application of the high-risk rules for Annex III systems to 2 December 2027 (amending Article 113). Other parts did not move:

• Prohibited practices have applied since 2 February 2025, including AI that infers people's emotions in the workplace, except for medical or safety reasons (Article 5(1)(f)). Emotion analysis of video interviews is out.
• Transparency duties in Article 50, such as telling people they are interacting with an AI system, have applied since 2 August 2026 for systems placed on the market after that date, per Mayer Brown. A candidate-facing chatbot must say it is one.
• AI literacy (Article 4, as amended) requires providers and deployers to take measures to support their staff's AI literacy.

What this means for an MVP. Build so that a person decides and the AI assists in ways you can explain: summarising, drafting, scheduling, extracting. Log what the AI produced and what the person decided. If the business depends on AI ranking or filtering candidates, plan and budget for high-risk compliance before 2 December 2027, because your customers will ask about it in their procurement now. Our AI MVP guide covers model providers, evaluation and the GDPR.

Two more EU laws that shape HR products

The GDPR and the AI Act get the attention, but two employment directives change what recruiting and workforce software must do. Directives work through national law, so the detail depends on each Member State's transposition. The summaries below come from the European Parliament's Legislative Observatory, because the EUR-Lex texts would not load for us.

The Pay Transparency Directive, (EU) 2023/970. According to the Parliament's summary of the final act, employers must tell job seekers the starting salary or pay range of advertised positions, in the vacancy notice or ahead of the interview, and may not ask candidates about their pay history. Workers can ask for average pay levels broken down by sex, and employers with 250 or more employees must report pay gap information by 7 June 2027 and annually after that. Member States had to transpose it by 7 June 2026. For a recruiting MVP this means:

• a pay range field on every job, shown in the advert or sent to the candidate before the interview;
• no current or previous salary field on application forms, including in custom questions customers add;
• for workforce or HR products aimed at larger employers, pay data structured so that a gap report by sex is possible later.

The Platform Work Directive, (EU) 2024/2831. If your product allocates work to people through an app (shift marketplaces, staffing platforms, gig work), read the Parliament's summary. It aims at transparency, fairness, human oversight, safety and accountability in algorithmic management. Platforms must inform people working through them about automated monitoring and decision-making systems, the directive guarantees human oversight of automated decisions, and it bans using these systems to process biometric data or people's emotional or psychological state. Member States must transpose it by 2 December 2026 at the latest. In an MVP, keep task allocation explainable and give every account suspension or similar decision a named human reviewer.

Integrations

HR buyers rarely replace their core systems for a new tool. Integrate with what they have.

• Applicant tracking systems. Most expose an API for candidates, applications and stages, authorised by the customer. Greenhouse's Harvest API, for example, lets customers export their data and update candidates and applications. Greenhouse's documentation says Harvest v1 and v2 are deprecated with removal set for 31 August 2026, a date that has now passed, and points to v3, so build any new integration on v3. APIs change on the vendor's schedule, and that maintenance belongs in the budget.
• Unified APIs cover several ATS or HRIS products through one integration, for a fee. They are a sensible MVP shortcut if your customers use different systems.
• Calendars and email for interview scheduling and candidate messages. Google and Microsoft calendars cover most customers.
• Single sign-on can wait for most MVPs, unless the first customer is a large company that requires it.

Minimum feature set checklist

• The one workflow you are testing, end to end
• Company accounts with roles (admin, recruiter or manager, interviewer), enforced on the server
• Candidate or employee records with documents
• A configurable pipeline or checklist
• Email notifications and templates, with a log of what was sent
• One integration, or CSV import and export
• AI assistance, if any, labelled as AI, reviewed by a person, and logged
• Human decision recorded for every rejection, promotion or similar outcome
• Retention periods with automatic deletion, and candidate data requests handled
• Audit log of who viewed and changed records
• Privacy notice for candidates, terms and a data processing agreement for customers
• One simple report on the measure you chose for the pilot

What to leave out of version one

• AI that ranks, filters or rejects candidates. It is high-risk and drives most of the compliance cost. Test the workflow first.
• Emotion or personality analysis from video or voice. Emotion recognition at work is prohibited.
• Several integrations. One ATS or HRIS, or CSV.
• Payroll. It is a regulated, country-specific product of its own.
• Job board distribution. Post to one or two boards by hand.
• Native apps. Recruiters and managers work on laptops; a responsive web app covers candidates.

What drives the cost of an HR tech MVP

Within our band, these are the items that move a quote up or down, roughly in order of effect.

The MVP cost calculator turns choices like these into a range, and MVP development cost in Europe explains where the money goes in any MVP.

Typical scope and price

Illustrative ranges inside our €5,000 to €25,000 MVP band, not a quote.

The honest note: if AI makes or materially shapes hiring decisions, the compliance work for a high-risk system (risk management, data governance, documentation, human oversight design, testing for bias and accuracy) is a project in itself, and it usually needs legal and specialist input alongside the build.

Worked example: a hiring tool for restaurant groups

A fictional product, to show how the decisions above turn into a scope. It is an illustration, not a quote.

The idea. Restaurant groups with five to twenty sites hire kitchen and floor staff all year, mostly through job boards and walk-ins, and manage it in a shared inbox. Site managers lose candidates because nobody replies within a day.

The question the MVP must answer. Will site managers move candidates through a simple pipeline on their phones if it saves them the inbox, and does time to first contact fall?

Where it falls. A single workflow, two roles (group admin and site manager), no AI and CSV instead of an integration puts this in the workflow tool row: roughly €10,000 to €15,000 over 7 to 9 weeks. Adding AI that drafts reply messages for a manager to edit and send would move it toward the top of the band. Adding AI that scores applicants would take it above our MVP band.

Brief template you can copy

Send this to any development partner, including us. Short answers are fine.

1. The workflow: what happens today, step by step, and which tools it uses.
2. Who uses it: the buyer, the daily user and the people whose data is in it (candidates, employees, contractors).
3. The question: the one thing the MVP must prove, and the number you will measure.
4. Design partner: who will pilot it, and whether they have committed.
5. Decisions: every point where someone decides about a person, and what software or AI contributes.
6. AI: none, assistive (drafting, summarising, extracting), or evaluative (scoring, ranking, filtering).
7. Integrations: the systems your first customers use, and whether CSV would do for a pilot.
8. Countries: where the first customers hire, and the languages needed.
9. Data: retention periods you expect, special category data, and who must never see what.
10. Out of scope: what you have decided not to build yet.
11. Budget and deadline: a range, and the date that matters (a pilot start, a funding round).

Common mistakes

• Building the AI first. The workflow is what customers buy; AI ranking is what drives the compliance cost. Prove the workflow, then add AI that assists.
• Treating the product as the controller. Your customer decides why candidate data is processed. Build retention, deletion and access as settings the customer controls, and sign a data processing agreement.
• Free-text fields that collect what you should not hold. Open fields such as notes on a candidate attract health details and salary history. Give them guidance text, restrict who sees them and include them in deletion.
• Rejecting candidates by rule. An automatic knockout question that ends an application is a solely automated decision. Route it to a person.
• Testing with real CVs. Use synthetic candidates in development and staging. Real CVs end up in screenshots, logs and test exports.
• Integrating with three systems before one customer. Each integration is a maintenance commitment. Start with the system your design partner uses, or CSV.
• No measure. Without a starting value for the number you want to move, a pilot ends in opinions.

Questions to ask a development partner

• Where will the product be hosted, and who on your team can access production data, from which country?
• How do you handle test data? Will real candidate data be used before the data processing agreement is signed?
• How will you enforce roles on the server, and how will we test that a recruiter cannot see another company's candidates?
• How are retention and deletion implemented, and do they reach backups, exports and email logs?
• If we use AI, which provider, where is the data processed, and how is what the AI produced logged next to what the person decided?
• What happens when the ATS vendor changes its API, and who maintains the integration after launch?
• What is fixed in the price, and how are changes priced?
• Have you built this kind of product before? Ask for a case study, and treat a claim without one as a claim.

Our guide to choosing an MVP development agency covers the general questions.

Pre-launch checklist for the pilot

• Data processing agreement signed with the design partner
• Candidate privacy notice live and linked from every application form
• Role tests passed: each role sees only what it should, across companies
• Retention job run on test data, and a deletion request handled end to end
• Every rejection or similar outcome has a recorded person and reason
• AI output, if any, labelled as AI and logged with the human decision
• No salary history question in any form, and a pay range on every job advert
• Audit log records views and changes of candidate records
• Backups running and a restore tested
• Production access limited to the people who need it
• The starting value of your pilot measure recorded

How founders fund this

Most HR tech MVPs in our band are funded by the founders, a design partner's paid pilot or an early angel round. Some countries also offer grants or vouchers for early product development. The MVP grants and funding guide for Europe covers them by country, and EU funding for startups covers the EU-wide programmes.

Case study: Rostavo

Rostavo is the closest work we have to HR software. It is a Laravel SaaS platform for in-home service agencies that brings client bookings, staff scheduling, workforce management, invoicing, payments, compliance tracking and communication into one dashboard, replacing the spreadsheets, shared calendar and group chat the agencies ran on. It is an operations platform with workforce features, not a recruiting product.

Start with the Scoping Sprint

The €900 MVP Scoping Sprint is the step we recommend before an HR tech build, and the €900 is credited in full against the build if you build with Easify. In about two weeks you get, in writing: the one question the MVP must answer, the smallest feature set that answers it, what is deliberately left out, the main user flows, the technical and hosting plan, and a fixed price and timeline for the build. For HR tech, the flows mark every point where a person decides about a candidate or employee and what, if anything, AI contributes, which is what your lawyer needs to place the product under the AI Act. The scope is yours to keep whatever you decide.

If you already have a prototype, the €99 Prototype Check gives you a written review in 48 hours, credited against the build.

When not to hire us

• The product is an AI that scores candidates, and you want it live without the compliance work. We will not build that.
• You need payroll. Use a payroll provider and integrate with it.
• Your first customer requires a full security certification before a pilot. That has to be in place before the build is useful.
• You have not watched a recruiter work. Sit with three. The workflow they actually run is the scope.
• An existing ATS already does what you need. Configure it and keep the money.