EU AI Act hiring rules: what recruiters need to know in 2026

Recruitment AI is high-risk under the EU AI Act. Here is what already applies, what moved, and what employers will owe.

The short answer

For EU AI Act hiring rules, start with one fact: the Act lists AI used to recruit or select people, including tools that filter applications and evaluate candidates, as "high-risk" (Annex III, point 4). The heaviest duties for those systems were due on August 2, 2026, but an amending regulation adopted in 2026 (often called the Digital Omnibus on AI) moved them to December 2, 2027. Some rules already apply today: the ban on emotion recognition at work and the AI literacy duty have applied since February 2, 2025, and the transparency rules in Article 50 apply from August 2, 2026. Employers using these tools are "deployers" and will owe human oversight, input data checks, log keeping and worker notice.

This is not legal advice. We summarize the text of Regulation (EU) 2024/1689 as amended, using the consolidated text and official EU sources listed at the end. Ask EU employment counsel how it applies to you.

EU AI Act hiring timeline: what is adopted and what changed in 2026

There are two layers to keep apart.

The original Act (adopted). Regulation (EU) 2024/1689 entered into force on August 1, 2024. Its Article 113 staged the rules: Chapters I and II (definitions, AI literacy and the prohibited practices) from February 2, 2025; governance and general-purpose AI rules from August 2, 2025; most of the rest, including high-risk rules for Annex III systems, from August 2, 2026.
The Digital Omnibus on AI (also adopted). The European Parliament's legislative tracker lists it as adopted: Regulation (EU) 2026/1744 of 8 July 2026, signed on July 8, 2026 and published in the Official Journal on July 24, 2026. The consolidated text on artificialintelligenceact.eu says it entered into force on July 27, 2026. It is no longer a proposal.

What the amendment changed that matters to hiring teams:

Rule	Original date	Date after the 2026 amendment
High-risk duties for Annex III systems (includes recruitment AI)	August 2, 2026	December 2, 2027
High-risk duties for AI in regulated products (Annex I)	August 2, 2027	August 2, 2028
Ban on emotion recognition in the workplace (Article 5(1)(f))	February 2, 2025	Unchanged, already applies
AI literacy (Article 4)	February 2, 2025 ("ensure" a sufficient level)	Still applies, reworded to a duty to "support" AI literacy
Transparency when people interact with AI (Article 50)	August 2, 2026	August 2, 2026 (a grace period to December 2, 2026 covers only machine-readable marking of AI-generated content, for systems already on the market)

The amendment also added an Article 4a that lets providers and deployers, as an exception and with safeguards, process special categories of personal data to detect and correct bias. And it gave small mid-cap companies some of the simpler documentation and fine caps that SMEs already had.

Why recruitment AI is high-risk under the EU AI Act

Annex III, point 4 covers "employment, workers' management and access to self-employment." Point 4(a) names AI systems intended for the recruitment or selection of people, "in particular" to place targeted job ads, to analyse and filter job applications, and to evaluate candidates. Point 4(b) covers AI used for decisions on terms of work, promotion and termination, task allocation based on behaviour or traits, and monitoring and evaluating performance.

That reaches most of the tools recruiting teams are buying: AI resume screening, AI interviews that score candidates, and assessments with automated evaluation. Article 6(3) offers a narrow way out for Annex III systems that don't pose a significant risk of harm, for example a system that only performs a narrow procedural task or preparatory work. But the same article says a system that profiles people is always high-risk. Scoring a candidate's fit for a job is hard to describe as anything other than profiling, so plan as if your screening AI is high-risk.

What employers (deployers) will owe from December 2, 2027

The Act splits duties between the provider (the vendor that builds the tool) and the deployer (the employer that uses it). Providers carry the larger load: risk management, data governance, technical documentation, conformity assessment and registration. Article 26 lists what deployers must do. In plain terms:

Use it as instructed. Take technical and organisational measures so the system runs according to the provider's instructions for use.
Assign human oversight. Give oversight to people with the "competence, training and authority" to do it, and the support they need.
Check your input data. Where you control the input (your job criteria, your screening questions), it must be relevant and sufficiently representative for the purpose.
Monitor and report. Watch how the system performs. If it may present a risk, tell the provider and the market surveillance authority and suspend use. Report serious incidents.
Keep logs. Keep the automatically generated logs under your control for at least six months, unless other law says otherwise.
Tell workers first. Before putting a high-risk system into service at the workplace, inform workers' representatives and the affected workers.
Tell the people affected. For Annex III systems that make or help make decisions about people, inform those people that the system is being used.
Run a DPIA where needed. Use the provider's information to carry out a data protection impact assessment under the GDPR where one is required.

Article 86 adds a right to explanation: a person affected by a deployer's decision based on a high-risk Annex III system's output, with legal or similarly significant effects, can ask for a clear explanation of the AI's role and the main elements of the decision. A rejected candidate is the obvious case.

What already applies today

No emotion recognition at work. Since February 2, 2025, Article 5(1)(f) bans AI systems that infer the emotions of a person in the workplace or in education, except for medical or safety reasons. Any interview tool that claims to read a candidate's enthusiasm, nerves or honesty from their face or voice is squarely in this zone. Ask vendors directly whether their scoring uses facial expressions or vocal emotion, and get the answer in writing.

AI literacy. Article 4 has applied since February 2, 2025. After the 2026 amendment, providers and deployers must take measures to support the AI literacy of their staff, and the text says this does not require guaranteeing any specific level for any individual. For a recruiting team, that means training the people who configure the tool and review its scores.

Telling candidates they are talking to an AI. From August 2, 2026, Article 50 requires providers to design AI systems that interact directly with people so those people are informed they are dealing with an AI, unless it is obvious. An AI interviewer, whether audio or avatar, should say so at the start.

Fines

Article 99 sets maximum fines at the higher of a fixed amount or a share of worldwide annual turnover:

prohibited practices (Article 5, including workplace emotion recognition): up to EUR 35 million or 7%;
most other operator duties, including deployer duties in Article 26 and transparency in Article 50: up to EUR 15 million or 3%;
giving incorrect or misleading information to authorities: up to EUR 7.5 million or 1%.

For SMEs and start-ups, each fine is capped at whichever of the two figures is lower.

A 2026 to 2027 plan for EU hiring teams

Now: list every AI tool that touches candidates (sourcing, resume screening, interviews, assessments). Mark which could fall under Annex III point 4.
Now: confirm none of them infer emotions. Remove any that do.
By August 2, 2026 (already passed): make sure any AI interviewer discloses that it is an AI at the start of the conversation.
During 2027: ask each high-risk vendor for its instructions for use, its plan for conformity assessment and registration, and the logs it gives you.
Before December 2, 2027: name the people who oversee each system, train them, write the worker notice, and prepare your candidate notice and explanation process.

If you also hire in New York City, the rules there are already enforced and work differently: they require an annual independent bias audit and public results. See our NYC Local Law 144 guide and our explainer on AI bias audits. For how scores should be built so a human can check them, read how AI interviews are scored. Comparing tools for hiring across European languages? See our list of multilingual interview software.

Questions

Is AI recruitment software high-risk under the EU AI Act?

Usually, yes. Annex III point 4(a) lists AI used to recruit or select people, including tools that analyse and filter applications and evaluate candidates. A narrow exception exists for tools that pose no significant risk of harm, but a system that profiles people is always treated as high-risk.

Was the August 2, 2026 deadline delayed?

Yes, for high-risk systems. Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026, moved the start of high-risk duties for Annex III systems, which include recruitment AI, to December 2, 2027. The transparency rules in Article 50 still apply from August 2, 2026.

Can an AI interview analyze a candidate's emotions in the EU?

No. Since February 2, 2025, the AI Act bans AI systems that infer the emotions of people in the workplace, except for medical or safety reasons. Job candidates are a core use case for that ban, so avoid any tool that scores emotion from face or voice.

Does the EU AI Act apply to US companies hiring in Europe?

It can. The Act covers deployers located in the EU and providers that place systems on the EU market, and it reaches some systems whose output is used in the EU. If you hire into EU roles with AI tools, check with counsel whether you or your vendor are in scope.

If you'd like to see how a live AI interviewer introduces itself and explains a score, book a 20-minute demo or run a sample interview yourself.

Sources

NTRVSTA