AI HR Tools Rated: 185 Vendors Checked on GDPR, Pricing and the EU AI Act (2026)

How the research was done

The dataset covers 185 AI tools for HR, checked between September 23 and 25, 2026. A tool made the list if it has an AI feature for HR work that the vendor describes publicly and if it can be bought today. General-purpose assistants without an HR focus are left out on purpose, as are features that only exist as a beta or an announcement.

For each tool I collected the same fields: vendor headquarters and parent company, pricing model and starting price, free plan and free trial, data storage location and EU region, certifications, interface languages, data processing agreement, single sign-on, statements on the EU AI Act and material for works councils. Every core fact needs a source. Whatever I could not source stayed empty.

By task, 46 tools cover HR administration with personnel files and payroll, 38 recruiting, 32 learning and development, 24 employee experience, 21 candidate selection with tests and interviews, 18 HR analytics and 6 automation. By vendor headquarters, the United States leads with 69 tools, followed by Germany with 20, the Netherlands with 9 and the United Kingdom with 8.

One limit up front: I collected what vendors state publicly. I did not test the products. A missing fact only means the vendor does not publish it. It does not mean the feature is missing. For a purchase, that alone is a finding: whatever is not public, you have to ask for, and every question costs time in the selection process.

Evidence1

Finding 1: Where the data is stored

82 of the 185 tools, or 44 percent, say they store customer data in the EU or offer an EU region. For 53 tools, 29 percent, there is no public word on the storage location. The rest store data outside the EU, mostly in the United States, or name several regions without letting the customer choose.

Where a vendor is based tells you less than you might think. Of the 69 vendors based in the United States, 29 offer an EU region. Of the 20 German vendors, 18 store data in the EU, twelve of them explicitly in Germany. A US tool does not automatically mean a data transfer to the US, and a European logo does not guarantee that no subprocessor sits in a third country.

Storage location matters twice in HR, because personnel data almost always includes sensitive data: sick days, salaries, performance reviews, and for applications often photos and dates of birth. Under Article 44 GDPR, transfers to third countries are only allowed under conditions. For the United States, the EU-U.S. Data Privacy Framework has applied since July 2023, and certified vendors can rely on it. How fragile such frameworks can be, the Court of Justice of the European Union showed in 2020 with the Schrems II ruling, which struck down its predecessor, the Privacy Shield.

In practice, ask a more precise question than where the vendor is based: where your data is stored, where it is processed, including by the language model behind the AI feature, and which subprocessors have access. The answer belongs in the contract, in writing. Which data may go into an AI tool at all is covered on the page about GDPR and AI in HR.

Evidence234

Finding 2: Prices rarely appear on the website

111 of 185 vendors, 60 percent, publish no price. Only 62 state a concrete starting price with a unit, for example per employee per month or as a flat monthly fee. 74 tools, 40 percent, offer a free plan or a free trial: 22 a permanent free plan and 63 a trial.

The most common pricing statement is simply "on request": 103 tools work that way. Next come 21 tools priced per employee, 17 per user, 16 with a flat fee, 15 freemium models and 6 usage-based ones. Among the eleven tools that charge per employee and state a starting price in euros or US dollars, the entry level ranges from 2 euros to 29 US dollars per month.

The starting price is rarely the price you pay. The footnotes decide. Sesame HR lists 4.75 euros per active employee with annual billing and a minimum of 15 employees. Personio lists 7.60 euros per employee for companies with 50 or more employees, with a twelve-month minimum term and a one-time setup fee. Factorial starts at 8 euros per user, and further modules are priced by quote. Three tools, three different bases: active employees, all employees, users.

For budget planning, never calculate with the starting price alone. Ask about minimum volumes, minimum term, setup fee, the price of the AI feature itself, which is often an add-on module, and the price increase in year two. What an AI project in HR costs in total, license plus rollout, training and works council agreement, is covered on the page about the cost of AI in HR.

Evidence567

Finding 3: Security certificates are common, AI certificates are rare

142 of the 185 tools, 77 percent, name at least one security certification. The most common are SOC 2 with 110 tools and ISO/IEC 27001 with 106 tools. ISO/IEC 42001, the standard for an artificial intelligence management system, is named by only 27 vendors.

The two big ones measure information security, not the quality of the AI. SOC 2 is an audit report under the standard of the AICPA, the US association of certified public accountants. ISO/IEC 27001 certifies an information security management system. Both say something about how a vendor handles access, incidents and suppliers. Neither says whether a model rates candidates fairly or whether a summary is correct.

ISO/IEC 42001 goes one step further. It requires a management system for AI with risk assessment, clear responsibilities and monitoring across the lifecycle of a system. The 27 certified vendors include large HR suites such as Workday and SAP SuccessFactors, as well as recruiting tools such as Greenhouse and SmartRecruiters. For an HR team it is a useful signal, but it does not replace your own review of the specific AI feature.

Evidence89101112

Finding 4: The data processing agreement often stays invisible

For 100 of the 185 tools, 54 percent, there is no public sign of a data processing agreement. 58 vendors publish it openly on their website, 13 let customers accept it with a click in their account, and 14 send it on request.

A company that uses an HR tool to process personnel data on its behalf needs a contract under Article 28 GDPR. It governs what the vendor may use the data for, which technical measures it takes, which subprocessors it uses and what happens to the data after the contract ends. The German Data Protection Conference summarized the requirements in a dedicated short paper.

A publicly available agreement is not a quality mark in itself, but it saves weeks. Your data protection officer can read it before the first meeting instead of after the decision. For AI features, one question is often missing from older templates: is your data used to train models, by the vendor or by the provider of the language model?

Evidence1314

Finding 5: Most vendors stay silent on the EU AI Act

Only 40 of the 185 vendors say anything public about the EU AI Act. 31 of them stop at a general statement, 8 explicitly classify their product as not high-risk, and a single vendor classifies its AI solutions as a high-risk system: d.vinci, an applicant tracking system from Hamburg.

The silence is loudest where the regulation is strictest. Annex III, point 4, of the AI Act lists AI systems for recruitment and selection as high-risk, explicitly including filtering applications and evaluating candidates. In my research, 59 tools belong to recruiting and candidate selection. Only 16 of them say anything public about the AI Act at all.

This affects you directly as an HR team, because the regulation also puts duties on the deployer, the company that uses a high-risk system. Under Article 26, deployers must use the system according to the provider's instructions, assign human oversight to people with the competence and authority to exercise it, check input data for relevance, keep logs and inform employees and their representatives before use. The AI literacy duty under Article 4 has applied since February 2, 2025.

The deadlines moved in 2026. With the AI Omnibus, the obligations for high-risk systems under Annex III apply from December 2, 2027. For a purchase today that means: the tool you select now will very likely still be running when the obligations kick in. Ask the vendor now how it classifies its product and get the answer in writing. Whether the exception in Article 6(3) applies to a specific feature is a question for your lawyer.

Evidence151617181920

Finding 6: There is almost nothing for the works council

One vendor out of 185 has a dedicated public page for works councils: Flip, an employee app from Stuttgart. All others leave it to the customer to gather the information needed for co-determination.

Yet in Germany, co-determination is the longest step in rolling out almost any AI tool in HR. Under section 87(1) no. 6 of the Works Constitution Act, the works council has a say on technical systems designed to monitor employee behavior or performance. The Federal Labor Court reads this broadly: it is enough that a system is objectively capable of monitoring. A tool with user accounts, logs and reports nearly always meets that bar. On top of that, section 90 requires informing the works council when technical systems are planned.

Language is a co-determination topic that is often underestimated. Of the 180 tools whose interface languages I could source, 67 offer a German interface. That is 37 percent. If employees without strong English are supposed to use a tool, the missing German interface becomes an issue in the works council agreement and in training.

For your purchase, this means: ask the vendor for the material the works council needs before you decide. Which data does the tool record, which reports are possible, who sees what, what can be switched off? How a works council agreement on AI is structured, I describe on a separate page. My advice from practice: bring the works council into the selection, not only into the approval.

Evidence212223

What the research teaches about comparison sites and AI research

The most uncomfortable finding concerns the research itself. The first round of my research ran on AI-assisted research, the way many HR teams compare tools today. In a sample of 24 tools, 102 of 312 checked values did not match the vendor's own website. That is 33 percent.

The errors sat exactly where purchasing decisions are made. Headquarters, website and parent company were almost always right. For interface languages, 71 percent of values were wrong or incomplete, for certifications 58 percent, for the free trial 46 percent and for the data storage location 42 percent. Mostly, facts the vendor publishes were missing, or claims were stated as fact that the vendor's own site contradicted.

So I checked every fact against its source and corrected more than 1,000 of them along the way. The lesson for your team: a table from a comparison site or an AI summary is a starting point, not evidence. Every fact you base a decision on belongs checked on the vendor's own page, with a date. That applies most to storage location, certifications and contract documents. Why unchecked AI output is one of the main risks in HR is covered in the article on why AI projects in HR fail.

A checklist for your next purchase

The six findings add up to a sequence you can follow for any AI tool in HR. It adds two to three weeks to the selection and saves months later, because data protection and the works council do not join only after the decision.

The list is built on questions a vendor can answer in writing. If an answer does not come, note that in your selection record.

How I support HR teams with this

I am an HR interim manager based in Frankfurt and build AI automations together with HR teams. This research grew out of the same work: before a team rolls out a tool, someone has to answer the questions above, and the answers are rarely where you would look for them.

In concrete terms, I take on three things. I work out with your team which HR task actually needs a tool and which can be solved with existing software. I prepare the purchasing questions from this checklist and evaluate the vendors' answers. And I set up the rollout so that data protection and the works council are involved from the start, as described on the page about AI for HR teams. If employees already use AI tools without approval, a different question comes first, and the article on employees using AI without approval answers it.

Which tool fits your team depends on your task, your size and your works council, not on a ranking.