EU AI Act: 25 Days Until Recruitment AI Faces Full High-Risk Obligations
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
On 2 August 2026 — twenty-five days from today — the EU AI Act's full high-risk system obligations become enforceable for all Annex III systems, including recruitment and employment-related AI. Any tool that screens, ranks, matches, or evaluates candidates is classified as high-risk. Nazareth & Partners, writing for artificialintelligenceact.eu, confirm that both providers (vendors) and deployers (employers and agencies using the tools) carry compliance obligations. The European Commission's own implementation timeline confirms the 2 August date as the point at which the remainder of the Act takes effect. Some industry commentary has suggested the Digital Omnibus package might push the deadline back, but as the guidance notes, 'this is a proposal, not enacted law.' National market surveillance authorities across member states are now empowered to enforce — Finland conferred enforcement powers in January 2026, and other member states are following. Regulators can withdraw or recall non-compliant AI systems from the market entirely.
Why It Matters
This isn't a compliance exercise for your legal team to handle alone. The obligations are operational: mandatory risk assessments, technical documentation, ongoing bias testing and monitoring, meaningful human oversight (Article 14), transparency disclosures to candidates (Article 26(7)), log-keeping for at least six months, and a right to explanation for individuals (Article 86). The Act also has extraterritorial reach — if your AI system's output is used in the EU or affects persons located there, you're covered regardless of where your company is based. A US company hiring a remote worker in Germany? Covered. A UK agency placing contractors in Dublin? Covered. The penalty framework is calibrated to hurt: up to €15 million or 3% of global annual turnover for high-risk violations, and up to €35 million or 7% for prohibited practices. The gap between what most TA functions have in place today and what the Act requires in 25 days is wide — and closing it isn't something you can sprint through in the final week.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your legal and compliance lead: Ask whether they've mapped every AI tool in your recruitment stack against Annex III classifications. If the answer is 'we're waiting to see what happens,' that's not a plan. Your HRIS or TA operations lead: Start the audit now. Which tools screen, rank, or score candidates? Which involve profiling? Do you have technical documentation from each vendor? Can you produce logs going back six months?
Inspect
What to take a closer look at
Run an inventory of every AI-powered tool touching your hiring process — ATS screening, chatbot pre-screening, video interview analysis, skills matching, candidate ranking, job ad targeting. For each tool, check: (1) Does the vendor classify it as high-risk under the EU AI Act? (2) Can they provide technical documentation and bias testing results? (3) Do your current processes include meaningful human oversight that could survive an audit — i.e., can the human actually overturn the machine's output? (4) Are you providing clear disclosure to EU-based candidates about AI use? If you can't answer yes to all four for every tool, you have a compliance gap that enforcement authorities can act on in 25 days.
Reflect
What to think about more deeply
If the EU AI Act had been in force for the past five years, how many of the hires your organisation made — and how many of the candidates it rejected — would have been reached through compliant, explainable, auditable processes? And if the honest answer is 'not many,' what does that say about the gap between how you've been hiring and how you ought to have been hiring all along?