The EU AI Act treats AI used to recruit or evaluate candidates as high-risk. The main obligations for employers, such as human oversight, logging and informing candidates, were due in August 2026 but now apply from 2 December 2027 after the Digital Omnibus. Bans on practices like workplace emotion recognition already apply.
This post was first published just before the original 2 August 2026 deadline. It was updated in October 2026 to reflect the delay.
What changed with the Digital Omnibus?
In November 2025 the European Commission proposed the Digital Omnibus on AI. The Council gave final approval on 29 June 2026, and it was published as Regulation (EU) 2026/1744, entering into force in late July 2026.
For hiring, the key change is timing. Obligations for stand-alone high-risk systems listed in Annex III, which includes recruitment, now apply from 2 December 2027. High-risk AI embedded in regulated products under Annex I moves to 2 August 2028. The substance of the high-risk obligations did not change.
The Omnibus also softened the AI literacy duty in Article 4, from ensuring a sufficient level of AI literacy to taking measures that support it.
Why are hiring tools classed as high-risk?
Annex III, point 4 of the AI Act lists AI systems intended for the recruitment or selection of people, in particular to place targeted job ads, to analyse and filter applications, and to evaluate candidates. Resume screening, candidate scoring and AI-led interviews fall within that description.
The reasoning is that employment decisions affect people's livelihoods, so systems that help decide who gets an interview should be accountable.
What applies already?
Prohibited practices have applied since 2 February 2025. The one most relevant to hiring is the ban on AI that infers emotions in the workplace, except for medical or safety reasons. A tool that claims to read a candidate's emotions from video or voice is a serious risk.
The AI literacy duty also applies, in its softened form: providers and deployers should take measures to help their staff understand the AI they use.
What will employers have to do from December 2027?
As a deployer, Article 26 requires you to:
Use the system according to the provider's instructions for use.
Assign human oversight to people with the competence, training and authority to do it.
Make sure input data you control is relevant and sufficiently representative.
Monitor the system and keep the logs it generates for at least six months.
Inform workers' representatives and affected workers before using a high-risk system in the workplace.
Inform candidates when a high-risk system is used to make or assist decisions about them.
Providers, meaning the vendors, carry the heavier duties: risk management, technical documentation, conformity assessment and registration in the EU database. Ask your vendor how they are preparing.
Does it apply to companies outside the EU?
It can. The Act applies to deployers established in the EU, and also to providers and deployers outside the EU where the system's output is used in the EU. If you are an Indian or US company hiring for roles in Europe, assume it may apply, and remember GDPR already covers EU candidates' personal data. Check your situation with counsel.
What should you ask your vendor?
Is the system classed as high-risk, and what is your plan for conformity assessment and registration before December 2027?
Can you provide technical documentation and instructions for use: intended purpose, performance testing, bias evaluation and known limits?
Are the outputs explainable? If a candidate asks why they were not shortlisted, can a person point to the transcript and criteria?
For a comparison of approaches, see GetHirePlus vs HireVue.
How GetHirePlus supports oversight
Every GetHirePlus AI phone interview produces a full transcript and scorecard, so reviewers see the reasoning, not just a number. Scoring is based on a structured question bank with defined criteria, and decisions are made by people in the ATS.
The delay gives teams time, not a reason to wait. Disclosure, human review and record-keeping are good practice now. For the US and India picture, see Is It Legal to Use AI to Interview Candidates in 2026? This is a summary, not legal advice.
Sources
Regulation (EU) 2024/1689 (AI Act), EUR-Lex
Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal