EU AI Act and cross-border internship compliance 2026: A1 certificates, posted workers and data protection

From August 2, 2026, organisations using AI in internship selection face binding obligations under the EU AI Act. Separately, cross-border interns remain subject to A1 social security certificates, the Posted Workers Directive, and GDPR. This guide maps the compliance obligations for host organisations, universities, and placement networks managing international internships in Europe in 2026.

The EU AI Act and internship selection: what changed in 2026

The EU Artificial Intelligence Act Reg. 2024/1689 is the world's first comprehensive regulatory framework for AI systems. It classifies AI systems by risk level and imposes proportionate obligations on providers (those who develop or place AI on the market) and deployers (those who use AI in their operations).

For internship-related use cases, the key classification is high-risk AI in employment contexts, defined in Annex III, Category 4 of the regulation. High-risk employment AI includes systems used for:

• Advertising and targeting job vacancies at specific groups of candidates
• Screening or filtering applications
• Evaluating candidates in the course of interviews or tests
• Evaluating or prioritising candidates
• Making or influencing decisions on promotion, dismissal, or contract management

This classification applies regardless of whether the role is full-time employment or an internship. An AI tool that scores internship applications, ranks candidates, or conducts AI-mediated screening interviews is a high-risk AI system subject to the full compliance obligations from August 2, 2026.

What the high-risk AI obligations require from deployers

Organisations deploying high-risk AI systems in internship selection must meet the following requirements under Chapter III, Section 3 and Chapter IV of the AI Act:

Universities and placement networks acting as intermediaries (selecting and presenting candidates to host organisations) who use AI in this intermediary selection function are also deployers subject to these obligations, even if the final hiring decision rests with the host organisation.

What the AI Act does NOT prohibit in internship contexts

The AI Act does not prohibit the use of AI in recruitment. It regulates it. Organisations can continue to use AI-based applicant tracking systems, CV parsing tools, and AI-assisted shortlisting provided they meet the transparency, human oversight, and documentation requirements. The practical compliance steps are:

1. Identify every AI tool used in your internship selection process (including tools embedded in ATS platforms you already use)
2. Request the technical documentation and conformity assessment evidence from each AI tool provider
3. Ensure each tool's provider has completed the required conformity assessment for high-risk AI
4. Implement a human review step that can override AI-generated recommendations
5. Update your internship application data privacy notice to disclose AI use
6. Document the Fundamental Rights Impact Assessment

A1 social security certificates for cross-border interns

The A1 certificate Reg. 883/2004 + 987/2009 is the document that certifies which EU member state's social security system applies to a person working in multiple EU countries. It is issued by the social security authority of the person's country of residence (in most cases).

When does an A1 certificate apply to interns?

Whether an intern needs an A1 certificate depends on their legal status and the remuneration structure:

For Erasmus+ traineeship students: the official guidance from the European Commission confirms that students participating in Erasmus+ traineeships are not in an employment relationship with the host organisation and are therefore generally not subject to the social security coordination rules that require A1 certificates. However, national implementation varies. Germany and the Netherlands both have enforcement practices that can sweep in highly remunerated "interns" regardless of formal classification. Organisations paying interns EUR 600/month or more in these countries should seek local legal advice on A1 applicability.

How to obtain an A1 certificate

A1 certificates are obtained from the social security authority of the employee's home country:

• Netherlands: Sociale Verzekeringsbank (SVB)
• Germany: Deutsche Rentenversicherung or the relevant Krankenkasse (health insurer)
• France: CPAM (Caisse Primaire d'Assurance Maladie)
• Spain: Tesoreria General de la Seguridad Social (TGSS)
• Belgium: NSSO / RSZ

Processing times vary from 2 weeks (Sweden, Netherlands) to 6-8 weeks (some southern EU member states). Applications should be submitted before the placement begins. Working cross-border without an A1 certificate when one is required exposes the host organisation to retroactive social security contribution demands in the host country.

The Posted Workers Directive and internships

The Posted Workers Directive (PWD) Dir. 96/71/EC as revised by Dir. 2018/957/EU applies to workers employed in one EU member state who are temporarily sent to work in another. Its core purpose is to ensure that posted workers receive the minimum labour conditions of the host country.

For internships, PWD application depends on whether the student is an "employee" under EU law:

• Erasmus+ traineeship students: Not employees. PWD does not apply. The student is a trainee under an educational arrangement, not a worker sent by an employer.
• Students with employment contracts at their home university or a sending company: Potentially posted workers. If a Dutch company employs a student under a Dutch employment contract and sends them to work at an affiliated company in Spain, the Posted Workers Directive may apply and Spanish minimum wage and working conditions must be met.
• Students in France under the convention de stage: French law gives stagiaires quasi-employee status. This creates a grey zone under the PWD for French students placed abroad and for foreign interns placed in France under the convention de stage framework.

The most important enforcement change in the 2018 PWD revision was the requirement for host country notification: employers posting workers to most EU member states must pre-notify the host country's labour authority via an online system before the posting begins. For interns who do qualify as posted workers, this pre-notification obligation applies. Non-compliance can result in administrative fines in the host country (EUR 500-15,000 depending on jurisdiction).

GDPR obligations for international intern data

Organisations processing personal data of international interns operating in the EU must comply with GDPR Reg. 2016/679 regardless of the intern's nationality. The key data processing activities in internship management include:

Application and selection data

CV, application materials, academic transcripts, and reference letters collected during the selection process are personal data subject to GDPR. The lawful basis for processing is typically legitimate interest (Art. 6(1)(f)) during selection, and contract performance (Art. 6(1)(b)) after an intern is selected and agreements are signed.

Unsuccessful applicants' data should be deleted within a reasonable period after selection is concluded, unless the applicant has consented to retention for future opportunities. Standard practice in the Netherlands and Germany is 6 months; some countries allow up to 2 years with clear consent.

Health and disability data

If host organisations collect any health-related information from interns (for workplace safety, accommodation adjustments, or insurance purposes), this is special category data under GDPR Art. 9. Processing requires explicit consent or another specific legal basis. Health data may not be collected speculatively or as a general practice without a clear specific purpose.

Data transfer to non-EEA countries

When intern data is shared with universities outside the EU/EEA (for example, sending a student's performance evaluation back to a university in India, South Africa, or Vietnam), that transfer must comply with GDPR Chapter V requirements. The lawful transfer mechanisms are:

• Adequacy decision: The European Commission has determined that the destination country provides adequate data protection. As of 2026, adequacy decisions cover: EU/EEA countries, UK, Japan, South Korea, New Zealand, Argentina, Israel, Switzerland, Canada (commercial organisations), and a small number of others.
• Standard Contractual Clauses (SCCs): The European Commission-approved contract clauses that provide appropriate safeguards for transfers to countries without adequacy decisions. Required for transfers to India, South Africa (no adequacy decision as of 2026), Indonesia, Vietnam, and most other partner country universities.
• Explicit consent: Obtainable but not recommended as primary transfer mechanism, as GDPR requires consent to be freely given and as easily withdrawn as given.

AI Act and GDPR interaction for automated intern scoring

When AI is used to score or rank intern applications, GDPR Art. 22 applies in addition to the AI Act. Art. 22 gives data subjects the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Being rejected from an internship is likely a "significant effect." This means:

• Fully automated rejection of internship applications (without any human review) is not permissible under GDPR Art. 22 unless the data subject has explicitly consented or the decision is necessary for contract performance (with appropriate safeguards)
• Applicants must be informed about the use of automated decision-making and have the right to request human review
• The intersection of GDPR Art. 22 and the AI Act's human oversight requirements effectively mandates a human in the loop for any AI-assisted rejection decision

Practical compliance checklist for host organisations in 2026

What this means for internship networks and placement platforms

Placement platforms and internship networks that use AI to match students to host organisations or to pre-screen applicants are subject to the AI Act as deployers of high-risk AI in recruitment contexts. This applies regardless of whether the platform is based inside or outside the EU, provided it serves EU-based employers or EU-enrolled students.

The key compliance priority for placement platforms before August 2, 2026 is to classify each AI feature in the matching or screening workflow, confirm that the underlying AI systems have been assessed by their providers as conformant with the AI Act, and update user-facing disclosures. Platforms that cannot provide evidence of AI Act conformity for their high-risk features face market access risks in the EU from that date.

For full-service internship placement organisations, the AI Act also intersects with the Bologna Process WIL requirements and the Erasmus+ programme obligations: AI-assisted matching tools used in Erasmus+ traineeship placements must be disclosed and compliant, and the human oversight requirements align with the Erasmus+ programme's emphasis on institutional accountability for student mobility outcomes.