EU AI Act in HR and Recruitment: What Applies in 2026 and What Changes in December 2027?

Just a few months ago, HR teams were focused primarily on one date: 2 August 2026. It was expected to mark the point when AI systems used for recruitment, candidate assessment and workforce management would become fully subject to the regime for high-risk AI systems. Then a new deadline appeared – 2 December 2027 – and some companies concluded that they could postpone the issue.

 

This is an oversimplification that could prove costly. In practice, the postponement mainly affects obligations concerning high-risk AI systems listed in Annex III of the EU AI Act, while the rules already in force remain unchanged. Emotion recognition in the workplace has been prohibited since 2 February 2025, and the AI literacy obligation has applied from the same date. The key question is therefore not whether the EU AI Act already applies, but which rules companies must comply with today and which requirements they have until the end of 2027 to prepare for.

 

Why is there so much confusion around the EU AI Act timeline?

 

 

The EU AI Act does not become applicable on a single date. The Regulation entered into force on 1 August 2024, but different groups of provisions apply in stages. In 2026, the EU legislature also adopted the Digital Omnibus on AI, which changes parts of the original timeline and simplifies selected obligations.

 

The Council of the EU formally adopted the amendment on 29 June 2026, and the Presidents of the European Parliament and the Council signed it on 8 July. As of the date this article was updated, the procedure was still listed as ongoing in EUR-Lex because the act had not yet been published in the Official Journal of the European Union. The amendment will take effect after publication and entry into force in accordance with its provisions.

 

For HR teams, the most important point is the direction of the changes, which has already been formally agreed: the requirements for standalone high-risk AI systems listed in Annex III – including recruitment systems and workforce management tools – are to apply from 2 December 2027. The 2 August 2028 deadline concerns a separate category of AI systems embedded in products covered by EU product legislation, not a typical ATS used by an HR department.

 

EU AI Act timeline – four dates that matter

 

 

1 August 2024 – The EU AI Act enters into force. Regulation (EU) 2024/1689 becomes binding law throughout the European Union.

2 February 2025 – Article 5 (prohibited AI practices) and Article 4 (AI literacy obligation) become applicable. From this date, certain uses of AI in the workplace are legally prohibited.

2 August 2026 – Further EU AI Act provisions become applicable, including transparency requirements for AI systems and AI-generated content. The European Commission also gains the power to enforce obligations for general-purpose AI models, including imposing fines on their providers.

2 December 2027 – Requirements for high-risk AI systems listed in Annex III become applicable.

 

 

Which AI practices are already prohibited?

 

 

Article 5 of the EU AI Act prohibits specific AI practices with effect from 2 February 2025. In the context of HR and recruitment, the ban covers three categories.

 

Emotion recognition in the workplace and recruitment. Article 5(1)(f) prohibits the use of AI systems to infer the emotions of employees or candidates in an employment context, except for medical or safety purposes. In practice, the ban covers: video interview software that analyses a candidate’s facial expressions and tone of voice, systems that monitor employee engagement through cameras or microphones, and call-centre tools that detect an agent’s mood from their voice. The protection is not limited to existing employees.  It also covers candidates participating in a recruitment process.

 

Social scoring of employees and candidates. The prohibition applies to systems that assess people’s behaviour using data from different contexts when the resulting score leads to unjustified or disproportionate discrimination.

 

Subliminal manipulation. AI that influences people’s decisions – including those of candidates or employees – without their awareness and in a way that undermines their autonomy. Penalty for breaching Article 5: up to EUR 35 million or 7% of global annual turnover – higher than the maximum penalties under the GDPR.

 

 

AI literacy obligation – what companies must demonstrate from 3 August 2026

 

Article 4 of the EU AI Act requires every employer using AI tools to ensure an appropriate level of AI literacy among employees who use those tools. The provision has applied since 2 February 2025. Enforcement by national authorities begins on 3 August 2026.

 

There is no single checklist or template. What matters is what the company can document, for example: training attendance lists, internal guidelines and role-specific AI materials.

 

In practice, this applies to every HR department using an ATS with AI features, recruitment chatbots, AI-based compensation analysis tools, CV anonymisation systems or candidate-ranking tools.

 

Which AI systems used in HR are regulated, and from when?

 

 

 

High-risk AI systems in HR – what becomes applicable in 2027?

 

 

Annex III to the EU AI Act, Area 4 (“Employment, workers management and access to self-employment”) lists the following as high-risk AI systems: systems for recruiting and selecting candidates, systems for evaluating performance and monitoring workers, and systems that make or support decisions on promotions, task allocation and termination of employment.

 

From 2 December 2027, companies deploying such systems will be required to meet the following requirements:

 

• Risk management documentation. A continuous process for identifying and assessing risks associated with the system, updated throughout the tool’s lifecycle.
  
• Human oversight. The system must allow a person to interpret its outputs, reject them and stop its operation. Oversight must be technically built in – not merely described in a procedure.
  
• Log retention. Automatically generated logs from a high-risk AI system must be retained for at least 6 months.
  
• Informing employees. Before deploying an AI system, the employer must inform employees and their representatives that the system will be used.
• Registration in the EU AI database. High-risk AI systems must be registered in the database maintained by the European Commission.
  

The obligations apply both to the system provider (vendor) and to the company deploying it (deployer). If your ATS uses AI to assess CVs – the vendor must provide a compliant system, but your company is responsible for correct deployment and documentation.

 

Where should companies start now?

 

Moving the deadline for high-risk AI systems to 2027 creates time for careful preparation, not a reason to wait. Companies that act now will avoid a last-minute rush to close compliance gaps before inspections.

 

Audit AI tools used in HR. Create an inventory of all AI systems used by the HR department. For each one, determine: what it is used for, whether it analyses candidate or employee data, and whether it supports or makes employment decisions.

 

Check for prohibited practices. Verify that none of the tools falls within Article 5 – especially emotion analysis or behavioural monitoring. System providers should supply documentation confirming compliance.

 

Implement AI literacy. Document training or guidelines for HR employees who use AI tools. The content should be tailored to the role – different for a recruiter using an ATS and for a manager evaluating performance through a system.

 

 

Summary

 

The EU AI Act in HR does not begin to apply only in December 2027. It already prohibits specific practices, including emotion recognition in the workplace and during recruitment, and requires organisations to develop the AI literacy of people who use AI.

 

The new deadline gives companies more time to adapt recruitment systems and workforce management tools that will be classified as high risk. It does not remove the need to know which systems are being used, what data they analyse and how they influence decisions about people.

 

The most practical first step is not a complex procedure, but an accurate map of tools and processes. Only then can a company distinguish low-risk solutions, uses that require additional safeguards and practices that must not be used today.

 

If your company uses AI in recruitment or plans to implement automated CV screening, candidate scoring or employee assessment tools  – talk to HR Contact.

 

---