The EU AI Act is now in force. For anyone working in recruitment — whether you are a boutique specialist agency, an in-house TA team, or a global staffing operation placing candidates into European markets — this is not a future concern. Parts of it already apply. The deadline that matters most for hiring AI has been formally set at 2 December 2027.
This article explains what the Act actually requires of recruiters, what has already changed, what the recent AI Omnibus deferral means in practice, and how to use the additional runway intelligently rather than waste it.
1. What the EU AI Act Actually Is — and Why Recruitment Is Squarely in Scope
Regulation (EU) 2024/1689 — the EU AI Act — is the world’s first comprehensive horizontal law governing artificial intelligence. It entered into force on 1 August 2024. It follows a risk-based architecture: the more potential an AI system has to affect people’s fundamental rights, the heavier the obligations placed on those who build and deploy it.
Recruitment is explicitly identified as a high-risk domain. Under Annex III of the Act, AI systems used for employment-related decisions include, but are not limited to:
- CV screening, parsing, and automated candidate ranking
- Targeted job advertising (including algorithmic audience selection)
- Interview analysis tools — including video interview assessment, tone analysis, and facial expression scoring
- Skills and competency testing driven by AI
- Performance prediction and candidate scoring
- Decisions affecting promotion, task allocation, monitoring of workers, or termination
This covers a wide range of tools that are already in active use across European hiring workflows. If you use an ATS with AI-powered matching, a video interview platform with automated scoring, or a sourcing tool that ranks candidates algorithmically, it is almost certainly in scope.
| Key point: The Act applies not only to companies based in the EU. If your AI system outputs decisions affecting individuals in EU member states, the obligations apply regardless of where your agency or your technology vendor is headquartered. |
2. The Timeline: What Has Changed, and When the Clock Runs Out
The EU AI Act has a phased implementation structure. Here is where things stand as of June 2026, including the most recent development — the political agreement on the AI Omnibus reached on 7 May 2026.
| Date | Milestone |
| 1 August 2024 | EU AI Act enters into force (Regulation 2024/1689 published). |
| 2 February 2025 | Prohibited AI practices banned. AI literacy obligations for providers and deployers take effect. |
| 2 August 2025 | Governance rules and obligations for General-Purpose AI (GPAI) models become applicable. |
| 7 May 2026 | Political agreement reached on the AI Omnibus — high-risk employment AI deadline deferred. |
| 2 December 2027 | NEW DEADLINE: High-risk AI in employment, recruitment, and HR must meet full obligations (post-Omnibus). |
| 2 August 2028 | Extended transition period for high-risk AI systems embedded in regulated products. |
The Omnibus is significant. The European Commission published it on 19 November 2025 to simplify compliance requirements and defer the high-risk deadline to allow time for harmonised technical standards to be established. On 7 May 2026, the European Parliament, the Council of the EU, and the Commission reached political agreement. The formal result: the deadline for high-risk AI in employment moves from 2 August 2026 to 2 December 2027.
| What this means for you: You have additional runway. Use it to build compliant processes properly, not to delay. The prohibited practices ban is already in effect. Agencies that wait until Q3 2027 to begin compliance work will not finish in time. |
3. What Is Already Banned — Right Now
The deferral of high-risk obligations does not touch the prohibited practices category. Those rules have applied since 2 February 2025 with no grace period and no transitional arrangements. For recruiters, the most immediately relevant prohibitions are:
Emotion recognition in professional contexts
AI systems that infer emotions, mental states, or psychological characteristics from facial expressions, voice patterns, tone, or physiological signals are banned when used in employment or education contexts. Several commercial video interview platforms have included this capability. If your current tooling includes emotion scoring or personality inference, that capability must be disabled or the tool must be replaced. This is not a compliance deadline — it is an existing ban.
Social scoring and biometric categorisation
AI systems that classify individuals based on inferred sensitive characteristics — including political opinions, sexual orientation, race, or religious beliefs — are prohibited. AI-driven candidate profiling that draws inferences beyond explicit application data falls into this category.
Subliminal manipulation
AI systems designed to influence candidate behaviour in ways that bypass rational decision-making — for example, tools that use psychological profiling to manipulate how a job offer is framed for a specific individual — are prohibited outright.
| Practical check: If any tool in your hiring stack claims to score candidates on ‘cultural fit’, ‘personality’, or ’emotional intelligence’ using AI inference from video or audio, review it immediately. If the capability is based on inferred characteristics rather than explicit competency testing, it likely falls within the prohibited category. |
4. The Nine High-Risk Obligations — What Compliance Actually Requires
Once the 2 December 2027 deadline applies, organisations deploying high-risk AI in recruitment must meet a demanding set of requirements. These obligations apply to both providers (the vendors who build the tools) and deployers (the agencies and employers who use them). As a deployer, you cannot outsource your compliance obligations to your vendor.
| Obligation | What It Means in Practice |
| Risk Management System | Ongoing documentation of risks throughout the AI system’s lifecycle. Must be updated continuously. |
| Data Governance | Training data must be relevant, representative, and checked for biases. Sensitive data handling must be documented. |
| Technical Documentation | Detailed records describing system purpose, architecture, data used, performance metrics, and known limitations. |
| Transparency to Candidates | Affected individuals must be informed when a high-risk AI system is used in decisions that significantly affect them. |
| Human Oversight | A qualified person must be able to monitor, understand, and override the AI system’s outputs. Rubber-stamping is insufficient. |
| Accuracy & Robustness | Systems must meet declared accuracy thresholds and be resilient against errors, inconsistencies, and adversarial inputs. |
| Logging & Audit Trail | Automatic logging sufficient to enable post-hoc accountability and regulatory audit. |
| Worker Consultation | Article 26(7) requires employers to inform and consult employee representatives before deploying high-risk AI at the workplace. |
| EU Database Registration | Providers must register high-risk systems in the EU AI database before deployment. Some public-sector deployers also register their use. |
The obligations are interconnected. Human oversight is only meaningful if you have technical documentation that allows the overseer to understand what the system is doing. Bias monitoring is only defensible if you have data governance that ensures the training data was appropriate in the first place. The paperwork and the processes have to work together.
5. Penalties: The Numbers That Should Focus the Conversation
The EU AI Act’s enforcement penalties are calibrated to match GDPR in severity. They are structured in three tiers:
| Breach Type | Max Fine (€) | As % of Turnover | Recruitment Example |
| Prohibited AI practices | Up to €35 million | 7% of global annual turnover | Using emotion-recognition AI in interviews; psychographic candidate scoring. |
| High-risk AI obligations | Up to €15 million | 3% of global annual turnover | Deploying a CV-screening tool without bias testing, documentation, or human oversight. |
| Providing incorrect information to authorities | Up to €7.5 million | 1% of global annual turnover | Misrepresenting the scope or capability of an AI hiring tool to a national regulator. |
Beyond financial penalties, national regulators have additional enforcement powers including the ability to withdraw or recall non-compliant AI systems from the EU market. For a recruitment agency whose competitive advantage depends on AI-driven sourcing or matching, a market suspension is a business-critical risk, not just a fine.
Each EU member state designates a national supervisory authority. The French CNIL, Germany’s Federal Data Protection Authority, and equivalent bodies in other member states will enforce the Act domestically. A European AI Office coordinates cross-border investigation and enforcement. There is no single enforcement bottleneck — agencies with multi-country operations face oversight from multiple authorities simultaneously.
6. The Extraterritorial Dimension — Relevant for Swiss and UK Agencies
Acquism operates from Switzerland. Many agencies placing candidates into European roles are headquartered outside the EU. The EU AI Act’s extraterritorial scope is explicit and broad.
The Act applies when:
- The output of an AI system is used in the EU — even if the AI system is operated from outside the EU.
- A provider places an AI system on the EU market or puts it into service in the EU.
- The affected individual (the candidate) is located in an EU member state.
In practice, this means that a Swiss agency using an AI sourcing tool to place candidates into roles in Germany, France, or the Netherlands is operating within the scope of the Act. The physical location of the agency’s servers or staff is irrelevant if EU candidates are affected by the AI’s outputs.
| Switzerland note: Switzerland is not an EU member state and is not bound by the Act as a matter of domestic law. However, Swiss agencies placing candidates into EU roles, or using AI tools whose outputs affect EU candidates, are caught by the extraterritorial provisions. Swiss agencies with significant EU placement activity should treat EU AI Act compliance as directly applicable to their operations. |
7. The Recruiter’s Compliance Roadmap: A Practical Timeline
The 2 December 2027 deadline is 18 months away. That sounds comfortable. It is not, once you account for the actual work involved: tool audits, vendor assessments, documentation, bias testing, process redesign, staff training, and ongoing monitoring. Agencies that manage complex AI stacks across multiple client relationships have more to do, not less.
The table below is a working roadmap. It is not exhaustive, but it covers the actions that create the most compliance risk if deferred too long.
| Action | Target | Notes |
| Inventory all AI tools in the hiring process | Immediate | CV parsers, ATS scoring, interview tools, chatbots, sourcing platforms. |
| Classify each tool: prohibited, high-risk, or lower-risk | Immediate | Most hiring AI falls into high-risk under Annex III. Prohibited uses must stop now. |
| Eliminate emotion-recognition and psychographic scoring tools | Immediate | Banned since 2 February 2025. No grace period applies. |
| Request vendor documentation (bias audits, technical docs) | Q3 2026 | If vendors cannot provide this, reconsider the contract. |
| Design and implement human oversight mechanisms | Q3–Q4 2026 | The override must be real and accessible to candidates. |
| Build candidate transparency disclosures | Q4 2026 | Candidates must be informed when high-risk AI affects decisions about them. |
| Consult employee representatives (Article 26(7)) | Before deployment | Applies regardless of Omnibus deferral. |
| Register systems in EU AI database (providers) | Before deployment | Required for providers; some public-sector deployers also register. |
| Establish ongoing bias monitoring and audit schedule | Continuous | Document results. This is the evidence regulators will request first. |
| Full high-risk compliance achieved | By 2 December 2027 | Post-Omnibus deadline for employment-related high-risk AI systems. |
8. Vendor Due Diligence: The Conversation You Need to Have
A deployer’s obligations under the EU AI Act do not diminish because their AI vendor is non-compliant. The Act places independent duties on deployers. However, meeting those duties is functionally impossible without a co-operative, transparent vendor.
Every AI tool in your hiring stack needs to answer the following questions in writing:
- Is this system designed for use in employment-related decisions? If so, has it been classified as high-risk by the provider?
- What bias testing has been conducted on the training data and on the system’s outputs? How often is this repeated?
- Does the provider maintain the technical documentation required under Article 11 of the EU AI Act?
- What human oversight mechanisms are built into the system, and what override capability does the deployer (your agency) have?
- Has the system been or will it be registered in the EU AI database?
- What is the provider’s roadmap for meeting the 2 December 2027 compliance deadline?
A vendor that cannot or will not answer these questions is signalling that compliance is not on their roadmap. That is material information for your own compliance position. It is also a contract negotiation point — consider including AI Act compliance warranties and audit rights in any new vendor agreements signed from this point forward.
9. What This Means for AI-Specialist Recruiters
There is an additional dimension for agencies like Acquism that specialise in AI, data, and engineering talent. The candidates you place are often the people building, training, and deploying the AI systems that the EU AI Act regulates. The compliance obligations that now apply to your clients’ hiring tools will also apply to the AI systems your clients are building.
This creates two practical considerations:
Candidate conversations about the Act
Senior AI engineers, MLOps specialists, and LLM engineers are increasingly being asked about EU AI Act compliance experience in interviews. Roles focused on AI governance, model documentation, bias auditing, and responsible AI are growing rapidly. If you are placing candidates into these roles, understanding the Act’s substantive requirements is part of your professional competence, not a peripheral regulatory concern.
Client conversations about the Act
Clients building AI-powered products that touch employment decisions — HR platforms, performance management tools, workforce analytics — are now building regulated products. The talent they need to hire has a new dimension of compliance awareness. Acquism’s expertise in this space positions it to add genuine advisory value in these conversations, not just fill vacancies.
10. Five Things to Do Before the End of 2026
The Omnibus deferral means the hard deadline is December 2027. But the foundations of compliance need to be in place well before then. Here are the five highest-priority actions to complete before the end of 2026:
- Complete a full AI inventory. Map every tool that touches a candidate’s journey from first contact to placement. Note which involve AI, what type of decision they support, and who the vendor is. This is the non-negotiable foundation of everything else.
- Confirm no prohibited tools are in active use. The emotion-recognition and psychographic scoring ban is already in effect. This is not a 2027 concern — it is a 2025 obligation that many agencies have not yet fully addressed.
- Initiate vendor compliance conversations. Do not wait for vendors to come to you. Start requesting technical documentation, bias audit results, and compliance roadmaps now. Vendors with long lead times for these conversations are already behind.
- Design your human oversight model. For each AI-assisted decision in your hiring process, identify the person responsible for oversight, the process by which they can review or override the AI’s output, and the route by which a candidate can request a human review.
- Assign internal ownership. Compliance with the EU AI Act is not a one-time project. It requires ongoing monitoring, documentation updates, and vendor management. Assign a named person (or team) responsible for AI compliance before the end of 2026.
Conclusion
The EU AI Act is the most significant piece of employment-related AI legislation ever enacted. For recruitment agencies operating in or placing into European markets, it is not optional, not peripheral, and not something that can be delegated entirely to technology vendors.
The 2 December 2027 deadline, confirmed following the AI Omnibus political agreement of 7 May 2026, gives agencies meaningful time to build compliant processes. But some obligations are already in force, and the groundwork for full compliance — tool audits, vendor assessments, oversight design, candidate transparency — takes longer than most agencies expect.
The agencies that will emerge from this regulatory shift in the strongest position are those that treat compliance as a business capability, not a box-ticking exercise. Transparent AI use builds candidate trust. Documented, auditable processes reduce legal exposure. Vendors who cannot meet the Act’s requirements are vendors who create regulatory risk for every agency that uses them.
At Acquism, we work at the intersection of AI talent and the organisations building AI-driven systems. Understanding the regulatory environment that governs those systems is part of what we bring to every client engagement. If you have questions about how the EU AI Act affects your hiring processes or the roles you are trying to fill, we are happy to talk.