AI in hiring under the EU AI Act: what actually changes, and when

Edition 00. A reading time of about 5 minutes.

The hook

If your team uses software to screen CVs, rank applicants, or score candidates, the EU AI Act puts that squarely in its high-risk tier. For most of the past year, the working assumption was that the full set of high-risk obligations would land on 2 August 2026. That date is now in question. In a political agreement reached on 7 May 2026, the EU agreed to push the deadline for high-risk systems in areas like employment to 2 December 2027, but that change is not yet law: until it is published in the Official Journal, 2 August 2026 remains the date on the books.

So the pressure eased, but the obligations did not disappear. This edition lays out what is settled, what is still in motion, and what a mid-market employer can sensibly do with the extra time.

What this means

Three facts anchor the picture.

1. AI used in hiring is high-risk by name. The AI Act is Regulation (EU) 2024/1689, which entered into force on 1 August 2024 (European Commission; EUR-Lex). Its Annex III, point 4, classifies as high-risk any AI system "intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates," as well as systems used to make decisions on promotion, termination, task allocation, or performance monitoring (AI Act, Annex III). If you buy or build a tool that does any of this, you are in scope, even if you never see its code.

2. The high-risk deadline has shifted from 2026 to 2027. When the Act was adopted, its high-risk obligations were due to apply from 2 August 2026. On 19 November 2025, the European Commission proposed the "Digital Omnibus" to simplify and re-time parts of the Act, and on 7 May 2026 the Council and Parliament reached a provisional agreement on it (Council of the EU). Under that agreement, obligations for stand-alone high-risk systems in areas including employment apply from 2 December 2027; for AI embedded in regulated products, from 2 August 2028. The European Commission's own overview now states these revised dates directly (European Commission; Gibson Dunn analysis).

3. It is not fully final law yet, and that matters. As of early June 2026, this is a political agreement, not yet text published in the Official Journal. Formal adoption is expected to be completed before the original 2 August 2026 deadline, with publication anticipated around July 2026 (Gibson Dunn). Until it is published and enters into force, the original 2 August 2026 date remains the live one on the books. The realistic read is that the delay will land, but a careful team treats 2 December 2027 as a strong signal rather than a sealed fact, and watches for the published text. We will confirm in a future edition once it is in the Official Journal.

Worth keeping straight: this re-timing applies to the high-risk obligations. Other parts of the Act are on their own clocks. The transparency duties in Article 50, for example, are reported to proceed on their existing schedule rather than being swept into this delay (Gibson Dunn). And the delay is about timing, not about whether hiring AI is covered. The classification in Annex III is unchanged.

On why any of this is worth attention: the Act sets administrative fines of up to 15 million euro, or up to 3 percent of total worldwide annual turnover, whichever is higher, for non-compliance with the obligations that apply to high-risk systems, such as risk management, technical documentation, and human oversight (AI Act, Article 99). That is the obligation tier most relevant to an employer deploying a hiring tool, and it is the reason the timeline is a planning question, not a filing-cabinet one.

What to do with this

The shift to December 2027 is breathing room, not a reason to close the file. The obligations are real, the build is slow, and the work that pays off is the work you start before you are forced to. Four steps, in order of leverage.

1. Make an inventory of where AI touches your hiring. List every tool and feature in your recruiting stack that screens, ranks, scores, matches, or monitors people, including features bundled inside an applicant tracking system you already pay for. You cannot govern what you have not named. Most teams underestimate this list, because the AI is often a feature inside a product they think of as ordinary HR software.

2. Ask each vendor, in writing, where they stand. For every tool on that list, ask the provider whether they treat it as high-risk under the AI Act, what documentation they will supply for your obligations, and how they handle the new 2027 timing. Keep the answers. Vendor responses are both a procurement signal and the start of your own evidence trail.

3. Put a human genuinely in the loop, now. Human oversight is among the core high-risk obligations, and it is something you can practice well before any deadline. Define who reviews AI-assisted hiring decisions, what they are empowered to override, and how that review is recorded. Build the habit while the stakes are still low.

4. Track the calendar, and the text. Mark 2 August 2026 as the deadline currently on the books and 2 December 2027 as the provisional new date, and set a reminder to confirm once the Digital Omnibus is published in the Official Journal. If you operate in jurisdictions with their own rules on automated hiring tools, fold those into the same review rather than running two tracks.

None of this requires an enterprise budget. It requires a list, a few emails, one named human, and a date in the calendar. That is a defensible starting position, and it is reachable this quarter.

This is educational material and a starting point, not legal advice. The EU AI Act is still being amended, and several dates here rest on an agreement that is not yet final law. For how these rules apply to your specific tools and contracts, and before relying on any deadline, consult a qualified lawyer. Signato is not a law firm and does not certify compliance.

AI that drafts at scale can also send the wrong thing at scale. See the Signato chamber block a forbidden send before it happens: run the free local trial, no card, nothing leaves your machine.