Employment AI is high-risk and the deadline just moved
The AI Act puts every system into one of four risk tiers: a short list of banned practices, a larger high-risk category that is allowed but heavily regulated, a transparency tier for things like chatbots, and everything else, which is left alone. AI used to make or support employment decisions sits, with one exception, in the high-risk tier. Annex III names the employment uses directly. Read this list as the scope of the work, then read the timeline as the part that keeps changing.
Two things follow. First, this reaches ordinary HR software, not just exotic systems; a resume screener or an interview-scoring tool is squarely in scope. Second, the duties land on whoever builds the system and, separately, on the employer that uses it. The question most people then get wrong is when.
The dates and why one of them keeps moving
The Act took effect in stages, and the stages matter, because part of it binds you now while the part most HR teams worry about has been pushed back. Here is the sequence as it stands today.
Part of the Act is already in force
The deferral does not buy a clean pause, because two duties already apply and one of them lands directly on the HR stack. Since 2 February 2025 the Act’s list of banned AI practices has been in effect. For employers the one that bites is the ban on emotion-recognition AI in the workplace: systems that infer a worker’s emotions from their face, voice, or body, sentiment scoring of staff, video-interview tools that read a candidate’s emotional state. These are banned outright, not merely regulated, with narrow exceptions for medical or safety reasons. If that capability sits anywhere in your HR or recruiting software and you have people in the EU, it is a problem today, not in 2027.
The second live duty is AI literacy. Providers and deployers have to take steps to ensure the people who deal with these systems understand, at a basic level, how they work and where they can go wrong. It is a light obligation next to the high-risk stack, but it applies now, and it is the cheapest first move toward everything else.
What high-risk status requires and who owes it
When the high-risk duties apply, they form a substantial stack: a risk management system, data governance and quality checks on the data the system learns from and runs on, technical documentation, automatic logging of what the system does, transparency and clear instructions for use, human oversight built in so a person can understand and override the system, and a level of accuracy and robustness fit for the job. The Act splits these between two roles, and an employer needs to know which one it is.
Provider Usually the vendor
The party that develops the system or puts it on the market under its own name builds the heavy package: the risk management system, the technical file, the conformity assessment, the CE marking, the quality system, and registration in the EU database. For most employers this is the software vendor, not them.
Deployer This is the employer
The employer that uses a high-risk system carries its own duties: use it according to the instructions, assign human oversight to people who are competent and have the authority to act on it, keep the logs, watch how it performs, and, before putting it to use at work, inform the affected workers and their representatives. Some deployers must also run a fundamental-rights impact assessment first.
Workers and candidates The people affected
A person subject to a decision made or supported by a high-risk system has the right to a clear explanation of the role the AI played and the main factors behind the decision. The transparency runs to the individual, not only to the regulator.
AI literacy Both roles, now
The duty to ensure a working level of AI literacy falls on providers and deployers alike, and unlike the high-risk stack it already applies. It is the one obligation that does not wait for 2027.
The short version for an HR team: even if you only buy a tool off the shelf, you are the deployer, and the deployer duties are yours. You cannot hand them to the vendor in a contract.
When this reaches an employer outside the EU
The Act does not stop at the EU border, but it does not reach every company on earth either. It applies to an employer outside the EU in two situations. The first is operating in the EU: if you have staff, a subsidiary, a branch, or remote employees based in a member state, the rules cover the AI you use on them. The second is the output test: if the result your AI system produces is used on people in the EU, you are in scope even without an EU office, which is what catches a company based elsewhere screening or scoring candidates who are located in the EU. A purely domestic employer hiring only people based at home, with a tool used only on people based at home, is outside the Act. The line is not where your headquarters sits. It is where your people, and the people your AI judges, are.
Four ways employers read this wrong
- Treating the new deadline as a reason to wait.Two duties already apply, including the ban on emotion-recognition AI at work and the literacy obligation, and they reach the HR stack now. Building governance for high-risk systems takes far longer than the runway you gain, and December 2027 arrives faster than a procurement, audit, and oversight build.
- Assuming a vendor tool is the vendor’s problem alone.The Act gives the deployer its own duties: human oversight by competent people, monitoring, logging, informing affected workers, and in some cases a fundamental-rights impact assessment. Buying off the shelf does not move those to the vendor.
- Counting only EU-headquartered companies.The Act reaches you if you have staff in the EU or your AI output is used on people in the EU. A recruiter based elsewhere who scores EU-based candidates is in scope, headquarters notwithstanding.
- Reading high-risk as forbidden.High-risk means allowed but regulated, not banned. The only employment AI banned outright is emotion recognition in the workplace under the prohibited-practices list. Everything else on the Annex III list is permitted once the duties are met.
An employment-AI decision under EU law can carry real legal weight, and the framework is still moving. The high-risk deferral to 2 December 2027 was formally adopted in June 2026, and several duties, including the emotion-recognition ban, already apply. National authorities are beginning to enforce, with recruitment named as a priority in more than one member state. Before you deploy an AI system on people in the EU, classify a tool, or rely on any date in this article, confirm the current enactment status and the rules in each country you operate in with qualified local counsel. This page is a map of the framework for planning. It is not a statement of any country’s law and not a guarantee of compliance.
Where these figures come from
Primary sources
- Regulation (EU) 2024/1689, the AI Act, the text in the Official Journal. The source for the framework: the risk tiers, the prohibited practices in Article 5 including emotion recognition in the workplace, the employment uses listed as high-risk in Annex III, the provider duties, the deployer duties in Article 26, and the transparency duty in Article 50. Adopted 13 June 2024, in force 1 August 2024. eur-lex.europa.eu, Regulation (EU) 2024/1689Checked 21 July 2026
- European Commission, AI Act, "Shaping Europe’s digital future". The official application timeline: the prohibited-practice and AI literacy duties from 2 February 2025, the general-purpose AI and governance rules from 2 August 2025, the high-risk regime, and confirmation that a political agreement on the AI Omnibus simplification package was reached on 7 May 2026. digital-strategy.ec.europa.eu, regulatory framework for AIChecked 21 July 2026
- European Commission, AI Act Service Desk, frequently asked questions. Sets out the original staggered dates: prohibitions and AI literacy on 2 February 2025, governance and general-purpose AI model rules on 2 August 2025, and the Annex III high-risk obligations, the Article 50 transparency requirements, and the start of enforcement on 2 August 2026. ai-act-service-desk.ec.europa.eu, FAQChecked 21 July 2026
- The Digital Omnibus deferral, Gibson Dunn analysis, May 2026. The deferral layer: the package postpones the standalone Annex III high-risk obligations to 2 December 2027 and the Annex I embedded duties to 2 August 2028. Formally adopted in June 2026 (Parliament 16 June, Council final approval 29 June), signed 8 July 2026, with publication in the Official Journal and entry into force following. gibsondunn.com, EU AI Act Omnibus agreementChecked 21 July 2026
The framework the AI Act sets is durable, but the timeline is not. The high-risk employment duties have already been postponed once, and that change is still working its way to final adoption, so the dates here are a snapshot of a moving picture. Treat this as a way to scope and document the work and prepare for legal review, confirm the current enactment status and the national rules for every country you operate in, and do not read it as a statement that you are compliant.
Tools for the AI in HR work
Inventory your HR AI, classify it, and track the duties
High-risk AI in hiring carries real EU penalties, and "the vendor handles it" is not a defense.
The free HR Operating System Readiness Scorecard profiles your hiring, compliance, and documentation, then shows where your processes carry risk before a regulator does. No sign-up to see your profile.
Common questions
It can. Two situations bring a non-EU employer into scope. One is operating in the EU, meaning staff, a subsidiary, a branch, or remote employees based in a member state. The other is the output test: if the result your AI system produces is used on people in the EU, you are covered even without an EU office. A recruiter scoring candidates located in the EU is the common example. An employer hiring only people based outside the EU, with a tool used only on them, is outside the Act.
No. The ban on emotion-recognition AI at work and the AI literacy duty have applied since February 2025, and they reach the HR stack now. The Digital Omnibus moving the high-risk duties to 2 December 2027 was formally adopted in June 2026 (Parliament 16 June, Council 29 June) and signed on 8 July 2026, so that is the operative planning date. And the work of governing high-risk systems takes far longer than the time you gain. The safe move is to scope and start now.
Yes, as the deployer. The vendor that builds and sells the system carries the provider duties, but the employer that uses it carries its own: use it according to the instructions, assign human oversight to competent people who can act on it, keep the logs, monitor it, and inform affected workers before putting it to use. Some deployers must run a fundamental-rights impact assessment as well. Those duties cannot be signed away to the vendor.
No. High-risk means allowed but regulated. The system is permitted once the duties are met. The only employment AI banned outright is emotion recognition in the workplace, which sits on the separate prohibited-practices list, not the high-risk list. A resume screener or a performance-scoring tool is high-risk, not forbidden. This is general information.