EU AI Act and Recruitment: High-Risk Rules from Dec 2027

Under the original timetable, this article would be warning about a deadline already in the past. Obligations for high-risk AI, including most AI that sorts applications or rates employees, were due to apply from 2 August 2026. Then came the Digital Omnibus. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and took effect three days later. It moves the obligations for high-risk systems listed in Annex III to 2 December 2027.

That is a 16-month reprieve. For an HR software project, it is not a long time.

What counts as high-risk in HR

The AI Act, Regulation (EU) 2024/1689, lists two groups of employment uses in point 4 of Annex III:

• AI intended for recruiting or selecting people, in particular for placing targeted job ads, analysing and filtering applications, and evaluating candidates.
• AI intended to make decisions affecting terms of work relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour.

That is broad. It covers the ranking feature in an applicant tracking system, but also software that allocates warehouse picks based on each worker’s past speed, a call-centre tool that scores agents’ conversations, and a sales dashboard whose activity scores feed into bonuses.

There is an exception. Under Article 6(3), an Annex III system is not high-risk if it poses no significant risk, for example because it performs only a narrow procedural task or merely improves the result of a human activity. The exception never applies when the system profiles natural persons. Most candidate-scoring features do exactly that. I would rely on the exception only if the vendor documents its reasoning in writing.

Who is covered, including outside the EU

The Act distinguishes between providers, who develop an AI system and place it on the market, and deployers, who use it under their own authority. An employer buying an ATS with AI ranking is a deployer. Heavy duties such as risk management, technical documentation and conformity assessment fall on the provider.

Geography is wider than many expect. The Act covers providers placing systems on the EU market wherever they are based, and providers and deployers in third countries where the system’s output is used in the EU. A New York headquarters screening applicants for a Berlin office with an AI tool should assume it is in scope.

Roles can also flip. Under Article 25, a deployer becomes a provider if it puts its own name on a high-risk system, substantially modifies it, or uses a general-purpose system in a way that makes it high-risk. Prompting a general language model to score and rank applicants can trigger provider obligations. That catches more in-house experiments than people realise.

The timeline after the Digital Omnibus

1. 1 Aug 2024AI Act enters into force.
2. 2 Feb 2025Prohibitions apply, including emotion recognition in the workplace. AI literacy duty under Article 4.
3. 27 July 2026Digital Omnibus takes effect, deferring high-risk deadlines and rewording Article 4.
4. 2 Aug 2026Transparency duties under Article 50, such as disclosing that a chatbot is an AI.
5. 2 Dec 2027High-risk obligations for Annex III systems, including recruitment and HR.
6. 2 Aug 2028High-risk obligations for AI in regulated products under Annex I.

Source: Regulation (EU) 2024/1689; Regulation (EU) 2026/1744 (Digital Omnibus)

Some rules already apply. The ban on emotion recognition at work, except for medical or safety reasons, hits video interview tools that read faces or voices. Article 4 on AI literacy has applied since February 2025. The Digital Omnibus rewrote it: since 27 July 2026, providers and deployers must take measures to support the AI literacy of their staff, without having to guarantee any particular level for any individual. Short training for the HR team that uses AI features is still the obvious way to meet it.

Since August 2026, Article 50 adds a transparency duty. A careers-page chatbot must tell candidates they are talking to an AI unless that is obvious.

Criterion	Provider	Deployer (employer)
Risk management and technical documentation
Conformity assessment, CE marking, EU database
Use according to instructions
Human oversight by competent people	enable	assign
Relevant, representative input data	training data	where under its control
Keep logs		at least 6 months
Inform workers' representatives and staff first
Tell people a high-risk system is used in decisions

Employer duties in detail

Article 26 sets out what deployers must do. Use the system in line with the provider’s instructions; using it for other purposes forfeits the comfort of the deployer role. Assign human oversight to people with the necessary competence, training and authority. A recruiter who just rubber-stamps the AI’s ranking does not meet that standard.

Where you control the input data, make sure it is relevant and sufficiently representative for the purpose. If you upload your own job profiles or scoring criteria, they are your responsibility. Keep automatically generated logs for at least six months, unless other law requires otherwise.

Before putting a high-risk system into service at the workplace, inform workers’ representatives and affected workers (Article 26(7)). In Germany this sits alongside works council co-determination rather than replacing it, see works councils and IT systems. Tell people subject to decisions made with the system’s help that a high-risk system is involved (Article 26(11)). Under Article 86, a rejected candidate can also ask for an explanation of the role the system played.

Private employers usually don’t need a fundamental rights impact assessment under Article 27. A data protection impact assessment under GDPR is still normally required.

What non-compliance costs

Fines are tiered under Article 99. Breaching a prohibition, such as using emotion recognition, can cost up to €35 million or 7% of worldwide turnover. Breaching high-risk obligations can cost up to €15 million or 3%. For SMEs, the lower figure applies. Fines are not the only exposure. A flawed AI-driven rejection is a problem in any discrimination claim, AI Act or not, as AI in recruitment explains.

What to do before December 2027

• Inventory: which HR tools have AI features, and which of those assess people?
• Switch off emotion or personality analysis from video or voice now
• AI literacy training for everyone working with these features (Article 4)
• Label careers-page chatbots as AI (Article 50)
• Ask vendors in writing how they will meet high-risk duties by 2 December 2027
• Name the people responsible for human oversight and define their authority
• Set up log retention of at least six months
• Involve works councils or employee representatives where they exist
• Update candidate and employee privacy notices

Vendor answers are only useful if the questions are precise. Ask whether the product is classed as high-risk and, if not, why. Ask when the conformity assessment will be complete, what the instructions for use will say about human oversight, how long logs are kept and whether you can export them, and which features can be switched off per country. A vague “we are fully compliant” is not an answer.

Start with the inventory. Many companies don’t know which AI features in their existing HR software are switched on, because they arrived with updates. When buying new tools, put AI Act compliance in the requirements, as suggested in our guide to an applicant tracking system. The full text of the regulation is on EUR-Lex.

If you are building your own HR AI, plan logging and human oversight into the design from day one. Studios such as OnlineBuilders build systems like that and can help clarify the provider-deployer question early.

Your next step: list every HR tool with an AI feature and mark those that rate or sort people, or monitor them. For each marked line, you need an answer from the vendor before December 2027. More legal topics are collected in the law and works councils section.

Questions people ask

Does the AI Act apply to companies outside the EU?

Yes, in many cases. It covers providers placing AI systems on the EU market and providers or deployers outside the EU where the system's output is used in the EU. A US employer screening candidates for roles in Germany with an AI tool is likely in scope.

Is using ChatGPT in HR high-risk?

Not automatically. The use case decides. Drafting job ads is not high-risk. Using a general model to rate or rank applicants turns it into a high-risk use, and can make you responsible as a provider.

Do employers need a fundamental rights impact assessment?

Usually not. Article 27 applies to public bodies, private entities providing public services and deployers of certain credit and insurance systems. A data protection impact assessment under GDPR is still typically required for AI-based candidate scoring.

What are the fines?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices such as workplace emotion recognition, and up to €15 million or 3% for breaches of high-risk obligations. For SMEs, the lower of the two amounts applies.