The EU AI Act in employment

Employment AI is high-risk and the deadline just moved

The AI Act puts every system into one of four risk tiers. The first is a short list of banned practices. The second is a larger high-risk category that is allowed but heavily regulated. Then comes a transparency tier for things like chatbots, and everything else, which is left alone. AI used to make or support employment decisions sits, with one exception, in the high-risk tier. Annex III names the employment uses directly. Read this list as the scope of the work, then read the timeline as the part that keeps changing.

1. Recruitment and selection. Tools that place targeted job ads, source or filter applications, screen resumes, or score and rank candidates. The ordinary hiring-funnel software most teams already run.
2. Performance and task allocation. Systems that evaluate performance or work behaviour, or that assign tasks and work based on a person’s traits, behaviour, or output.
3. Worker monitoring. AI that tracks and analyses how people work. Note one carve-out: emotion-recognition monitoring at work is not high-risk, it is banned outright, covered below.
4. Promotion and termination. Anything that drives a decision to promote someone, change their terms of work, or end the employment relationship.

Two things follow. First, this reaches ordinary HR software, not just exotic systems. A resume screener or an interview-scoring tool is squarely in scope. Second, the duties land on whoever builds the system and, separately, on the employer that uses it. The question most people then get wrong is when.

The dates and why one of them keeps moving

The Act took effect in stages, and the stages matter. Part of it binds you now, while the part most HR teams worry about has been pushed back. Here is the sequence as it stands today.

Milestonewhat the rule coversApplies Banned practices and AI literacyArticle 5 and Article 4, in force now2 Feb 2025 General-purpose AI models, governance, penaltiesthe supervisory machinery, in force now2 Aug 2025 Transparency and content markingArticle 50, moved from 2 Aug 20262 Dec 2026 High-risk employment AI dutiesAnnex III, was 2 Aug 20262 Dec 2027 High-risk AI built into regulated productsAnnex I2 Aug 2028 The Act entered into force on 1 August 2024. The high-risk employment duties were originally set for 2 August 2026. The Digital Omnibus, agreed in political terms on 7 May 2026 and formally adopted in June 2026 (Parliament 16 June, Council 29 June, signed 8 July 2026), moves them to 2 December 2027 and pushes the transparency duty to 2 December 2026. Treat 2 December 2027 as the compliance baseline for the high-risk employment duties, and remember what already applies: the emotion-recognition ban and the AI-literacy duty have been in force since February 2025.

Part of the Act is already in force

The deferral does not buy a clean pause, because two duties already apply and one of them lands directly on the HR stack. Since 2 February 2025 the Act’s list of banned AI practices has been in effect. For employers the one that bites is the ban on emotion-recognition AI in the workplace. It covers systems that infer a worker’s emotions from their face, voice, or body. It also covers sentiment scoring of staff and video-interview tools that read a candidate’s emotional state. These are banned outright, not merely regulated, with narrow exceptions for medical or safety reasons. Check whether that capability sits anywhere in your HR or recruiting software. If it does and you have people in the EU, it is a problem today, not in 2027.

The second live duty is AI literacy. Providers and deployers have to take steps on the people who deal with these systems. Those people must understand, at a basic level, how the systems work and where they can go wrong. It is a light obligation next to the high-risk stack, but it applies now, and it is the cheapest first move toward everything else.

What high-risk status requires and who owes it

When the high-risk duties apply, they form a substantial stack. It starts with a risk management system, plus data governance and quality checks on the data the system learns from and runs on. Next come technical documentation and automatic logging of what the system does. Then transparency and clear instructions for use. Human oversight has to be built in, so a person can understand and override the system. Last is a level of accuracy and robustness fit for the job. The Act splits these between two roles, and an employer needs to know which one it is.

Provider Usually the vendor

The party that develops the system, or puts it on the market under its own name, builds the heavy package. That is the risk management system, the technical file, the conformity assessment, the CE marking, the quality system, and registration in the EU database. For most employers this is the software vendor, not them.

Deployer This is the employer

The employer that uses a high-risk system carries its own duties. Use it according to the instructions. Assign human oversight to people who are competent and have the authority to act on it. Keep the logs and watch how it performs. Before putting it to use at work, inform the affected workers and their representatives. Some deployers must also run a fundamental-rights impact assessment first.

Workers and candidates The people affected

A person subject to a decision made or supported by a high-risk system has a right to a clear explanation. It must cover the role the AI played and the main factors behind the decision. The transparency runs to the individual, not only to the regulator.

AI literacy Both roles, now

The duty to ensure a working level of AI literacy falls on providers and deployers alike, and unlike the high-risk stack it already applies. It is the one obligation that does not wait for 2027.

Here is the short version for an HR team. Even if you only buy a tool off the shelf, you are the deployer, and the deployer duties are yours. You cannot hand them to the vendor in a contract.

When this reaches an employer outside the EU

The Act does not stop at the EU border, but it does not reach every company on earth either. It applies to an employer outside the EU in two situations. The first is operating in the EU. If you have staff, a subsidiary, a branch, or remote employees in a member state, the rules cover the AI you use on them. The second is the output test. If the result your AI system produces is used on people in the EU, you are in scope even without an EU office. That is what catches a company based elsewhere screening or scoring candidates located in the EU. A purely domestic employer hiring only people based at home, with a tool used only on people based at home, is outside the Act. The line is not where your headquarters sits. It is where your people, and the people your AI judges, are.

Four ways employers read this wrong

• Treating the new deadline as a reason to wait.Two duties already apply, including the ban on emotion-recognition AI at work and the literacy obligation, and they reach the HR stack now. Building governance for high-risk systems takes far longer than the runway you gain, and December 2027 arrives faster than a procurement, audit, and oversight build.
• Assuming a vendor tool is the vendor’s problem alone.The Act gives the deployer its own duties. Those are human oversight by competent people, monitoring, logging, informing affected workers, and in some cases a fundamental-rights impact assessment. Buying off the shelf does not move those to the vendor.
• Counting only EU-headquartered companies.The Act reaches you if you have staff in the EU or your AI output is used on people in the EU. A recruiter based elsewhere who scores EU-based candidates is in scope, headquarters notwithstanding.
• Reading high-risk as forbidden.High-risk means allowed but regulated, not banned. The only employment AI banned outright is emotion recognition in the workplace under the prohibited-practices list. Everything else on the Annex III list is permitted once the duties are met.

Six red flags to check before you fire someone

Free, and written to the same standard

A five minute screen to run before you act, sent to your inbox as a print-ready PDF. Every figure in it traces to a reference note like this one.