From 2 August 2026, the EU treats recruitment AI the way it treats medical devices. Here is what employers, agencies and staffing platforms must now do — and the fines waiting for those that do nothing.
If your company uses software that screens CVs, ranks applicants, scores video interviews or targets job advertisements, European law now places that software in the same regulatory category as medical devices and critical infrastructure. That is not a metaphor. Under the EU Artificial Intelligence Act (Regulation 2024/1689), AI systems used for recruitment and selection are explicitly listed as high-risk — and the obligations that come with that classification became enforceable on 2 August 2026.
For most companies, the uncomfortable truth is this: the deadline has arrived, and many HR and talent acquisition teams still cannot say with confidence which of their tools are in scope, what their obligations are, or who inside the business owns them. This article sets out, in plain English, what the Act requires of any organisation that uses AI in hiring — and what to do about it now.
What the law actually says
The AI Act takes a tiered approach: the heavier the potential impact on people’s lives, the stricter the rules. Annex III of the Regulation lists the use cases the EU deems high-risk, and employment sits squarely on that list. Point 4 captures two categories of system: AI intended to be used for the recruitment or selection of natural persons — including targeted job advertising, analysing and filtering applications, and evaluating candidates — and AI used to make decisions affecting work-related relationships, such as promotion, termination, task allocation and performance monitoring.
Note the breadth of that language. This is not a law about exotic, futuristic hiring robots. The European Commission’s own worked example of a high-risk system is CV-sorting software. If your applicant tracking system scores candidates, if your sourcing tool ranks profiles, if your video interview platform produces an automated assessment, you are operating a high-risk AI system the moment it is used to hire in the EU.
Some practices are not merely high-risk but prohibited outright — and have been since February 2025. Emotion recognition in the workplace and biometric categorisation are the most relevant examples for hiring teams: a tool that claims to infer a candidate’s emotional state from their face or voice during an interview is, with narrow exceptions, banned in the EU.
The dates that matter
The Act entered into force on 1 August 2024 and has been phasing in since. The prohibitions and AI literacy obligations took effect in February 2025; obligations on general-purpose AI models followed in August 2025. The date that defines 2026 for hiring teams is 2 August 2026, when the full suite of high-risk obligations for Annex III systems — including all employment-related AI — became enforceable.
A word of caution about the widely reported “delay”. The European Commission’s Digital Omnibus package, proposed in November 2025, suggested pushing certain high-risk deadlines towards late 2027. At the time of writing, that extension has not been enacted into law. Compliance advisers are near-unanimous: treat August 2026 as the operative deadline, and treat any eventual extension as breathing space for refinement, not a reason to postpone the work. Conformity and documentation exercises take months; planning around an unenacted proposal is a material business risk.
Provider or deployer? Why the distinction decides your workload
The Act splits obligations between two roles. Providers are the vendors who build and place AI systems on the market. Deployers are the organisations that use them. Most employers, recruitment agencies and staffing businesses are deployers: the vendor of your ATS or assessment platform is the provider.
Providers carry the heavier load — risk management systems across the AI’s lifecycle, data governance and bias testing on training data, technical documentation, built-in logging, conformity assessment, CE marking and post-market monitoring. Deployers’ obligations are lighter but very real, and this is where a dangerous misconception has taken hold: buying a “compliant” tool does not discharge your responsibility. Under Article 3, a deployer is anyone using an AI system under its own authority. If your firm selects, configures or relies on an AI tool to inform hiring decisions, the deployer obligations are yours — even if you did not build the technology, and even if the vendor assures you compliance is handled.
What deployers must actually do
- Use the system in accordance with the provider’s instructions, and assign human oversight to people with the competence, training and authority to exercise it — genuine review of consequential decisions, not rubber-stamping an algorithm’s shortlist.
- Be transparent with candidates: individuals must be informed when a high-risk AI system is used to make or support decisions about them, and employers have a separate duty to inform workers before deploying high-risk AI in the workplace.
- Retain the logs generated by the system for at least six months, and monitor its operation on an ongoing basis — an operational infrastructure requirement many HR teams have not yet scoped.
- Where required — notably for public bodies and certain other deployers — conduct a Fundamental Rights Impact Assessment before putting the system into use.
The reach of these rules is extraterritorial. A US or Swiss company using AI to screen candidates for a role in Germany is in scope, because what matters is where the system’s output is used, not where the company is headquartered. And liability does not evaporate up the supply chain: an employer can be responsible for algorithmic discrimination even when the biased model belongs to a third-party vendor.
The price of getting it wrong
The penalty regime is deliberately pitched at GDPR level and beyond. Deploying prohibited AI practices carries fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher. Breaching the high-risk obligations that directly concern hiring teams can cost up to €15 million or 3% of global turnover. Supplying incorrect or misleading information to authorities attracts fines of up to €7.5 million or 1%. National authorities can also order systems withdrawn from use altogether.
The reputational exposure may bite sooner than the regulatory kind. Survey after survey in 2026 shows candidates deeply sceptical of opaque AI hiring — in Greenhouse’s research, only 8% of job seekers consider AI-based hiring processes fair. A publicised compliance failure lands on precisely that nerve. Conversely, companies that can explain clearly and honestly how AI is used in their process are converting a legal obligation into an employer-brand advantage.
A practical readiness checklist
For organisations starting late, the work is unglamorous but bounded. Six steps cover the essentials:
- List every AI tool and feature used in sourcing, screening, scoring, scheduling and decision support — including AI features embedded in your ATS that nobody procured deliberately. Over half of organisations lack a systematic AI inventory; most teams discover in-scope tools they did not know they had.
- Map each tool against Annex III. A system that filters, evaluates, ranks or targets is high-risk. Where classification is uncertain, presume high-risk and document the reasoning.
- Interrogate vendors. For every in-scope tool, obtain the provider’s written position on its Annex III classification, its conformity assessment status and what it expects deployers to do. Keep the answers — they are your evidence of due diligence.
- Design oversight. Define, in writing, who reviews AI-influenced decisions, at which stage, and with what authority to override. Train those people; the human oversight obligation fails if the human cannot meaningfully intervene.
- Tell candidates. Update privacy notices and application journeys to disclose, in plain language, which steps involve AI and what rights candidates have. Doing this well is free trust-building.
- Log and monitor. Ensure system logs are captured and retained for six months minimum, and put a review cadence in place so degradation or bias drift is caught, documented and escalated.
What this means in practice
The EU AI Act does not ban AI in recruitment — used properly, AI remains a powerful way to reduce administrative burden and widen talent pools. What the Act does is end the era of unaccountable automation in hiring. From August 2026, every algorithmic judgement about a candidate in Europe must be documented, overseen by a competent human, and explainable to the person it affects.
For specialist hiring — senior AI, ML and data roles where each shortlist is small and each decision consequential — that human layer was never optional anyway. At Acquism, every search is run by consultants who understand the technology they recruit for, with AI used to accelerate research rather than to make decisions about people. If you are reviewing your hiring process for AI Act readiness, or simply want a compliant, expert-led route to scarce AI and data talent across Europe, our team is ready to help.
This article is for general information and does not constitute legal advice. Obligations depend on your specific circumstances; seek specialised counsel to validate your compliance approach.