The EU AI Act's employment deadline is 30 days away — and most staffing firms aren't ready
The News
On 2 August 2026 — exactly 30 days from today — the EU AI Act's full suite of high-risk system obligations becomes enforceable for all Annex III systems. That includes every AI system used in employment decisions: recruitment, selection, targeted job advertising, candidate evaluation, performance monitoring, and termination-related decisions.
The classification is broad. If your ATS ranks candidates, your chatbot pre-qualifies applicants, or your VMS matches contingent workers to roles using an algorithm, you are deploying a high-risk AI system. According to analysis by Nazareth & Partners published on ArtificialIntelligenceAct.eu, liability falls on both providers (the vendors who build the tools) and deployers (the staffing firms, RPO providers, and in-house TA teams using them). You cannot contractually offload compliance obligations to your technology partner — any more than you can under GDPR.
The penalties are substantial. High-risk non-compliance carries fines of up to €15 million or 3% of global turnover. Prohibited practices — such as using emotion recognition or biometric categorisation in the workplace — reach €35 million or 7%. The Act also has extraterritorial scope: if your AI system's output affects anyone in the EU, the regulation applies, regardless of where your company is headquartered or where the technology is hosted. A Digital Omnibus proposal was floated in November 2025 to potentially simplify some requirements, but it remains just that — a proposal. The 2 August deadline stands.
Why It Matters
For TA leaders operating in or hiring into the EU, this is not a vendor problem you can delegate to procurement. Every AI tool in your recruitment stack — ATS, CRM, chatbot, video interview platform, skills assessment engine, matching algorithm — must be assessed for high-risk classification. You need to know, for each one, who the deployer is under Article 3, whether meaningful human oversight exists in the workflow, and whether candidates are being informed about AI-driven decisions as required by Article 26(7).
Most staffing supply chains multiply the problem: a typical contingent hiring process might involve a VMS platform doing algorithmic matching, an RPO provider running AI-powered screening, and an agency using chatbot pre-qualification. Each entity in that chain is a deployer with independent obligations. The firms that treat this as a compliance exercise rather than an operational redesign will be the ones caught out — and the 30-day clock is now impossible to ignore.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your legal counsel (employment + data protection). Specifically: have they mapped every AI tool in your recruitment stack against Annex III high-risk categories? Have they confirmed that your vendor DPAs address AI Act deployer obligations, not just GDPR?
Your HRIS and procurement leads. They need to produce — this month — an inventory of all AI-powered recruitment tools, with contract review dates and a clear owner for each compliance obligation. If your ATS provider hasn't sent you AI Act readiness documentation by now, ask why not.
Inspect
What to take a closer look at
Run an inventory this week. List every AI-powered tool in your recruitment workflow. For each one, answer three questions: (1) Does it make or influence decisions about candidates — ranking, screening, matching, evaluating? (2) Is there a qualified human with the authority to override its output before a final decision? (3) Are candidates explicitly told the tool is being used, what it does, and how to contest its output? If you answer "no" or "I'm not sure" to any of these, you have a compliance gap with a 30-day fuse.
Reflect
What to think about more deeply
If the EU AI Act forces you to document and justify every algorithmic decision in your hiring process — what will you discover about your own stack that you'd rather not know?