Skip to content
The EU AI Act: what it is, when it applies, and what to do
The world’s first comprehensive AI law takes a risk-based approach. Most of the weight falls on high-risk uses, which include hiring, and those duties now apply from December 2027.
Last reviewed: August 2026
An independent conformity assessment for a high-risk AI system under the EU AI Act, covering documentation, risk management, data governance and testing. The final fee depends on the system’s complexity and the evidence available.
Discuss your systemIndicative range, scoped per system. Fees exclusive of VAT.
The Digital Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, pushed the high-risk obligations back from 2 August 2026 to 2 December 2027 for standalone systems, and to 2 August 2028 for AI embedded in regulated products. This buys time for the technical standards and conformity infrastructure to catch up. The bans and the general-purpose AI duties are unaffected and already apply.
A single, risk-based rulebook for AI in the EU
The AI Act (Regulation (EU) 2024/1689) sorts AI by risk and puts most obligations on the riskiest uses. It reaches beyond the EU: if your system is used in the EU, or its output is, it can apply to you wherever you are based.
The heavy duties sit with providers of high-risk systems, with a lighter but real set for the organisations that deploy them. Employment and worker management, including recruitment and candidate screening, are named high-risk, so anyone building or using hiring AI in the EU is squarely in scope.
Enforcement is national, backed by fines that scale with global turnover. The direction of travel is clear even where dates have moved: build the evidence now, because the standards, documentation and testing take time to put in place.
Four levels, very different duties
Unacceptable, prohibited
Banned since Feb 2025: social scoring, manipulative techniques, and emotion recognition in the workplace and education.
High-risk
Recruitment and worker management, credit, biometrics, critical infrastructure and more. The full obligations. Applies from Dec 2027.
Limited, transparency
Chatbots and synthetic media. Tell people they are dealing with AI or that content is AI-generated. From Aug 2026.
Minimal
The vast majority of AI. No extra obligations under the Act.
When each part applies
The Act enters into force.
Prohibited practices banned; AI literacy duties begin.
Obligations for general-purpose AI models apply (the model makers behind tools like Claude, GPT and Gemini).
Transparency duties apply, including labelling AI chat and AI-generated content.
High-risk obligations apply, including for hiring and worker management (Annex III). Deferred from August 2026 by the Digital Omnibus.
High-risk obligations for AI embedded in regulated products (Annex I).
Providers and deployers have different jobs
If you build the system (provider)
- Risk management across the lifecycle
- Data governance and representative, good-quality data
- Technical documentation and logging
- Human oversight, accuracy and robustness
- Conformity assessment and an EU declaration, then CE marking
- Post-market monitoring
If you use the system (deployer)
- Use it in line with the provider’s instructions
- Assign human oversight
- Monitor performance and keep logs
- Inform affected workers and their representatives
- For public bodies and public-service providers, a fundamental-rights impact assessment
Important nuance: for most high-risk uses, including employment, conformity is by self-assessment. There is no general requirement to use an external auditor, so the value of an independent partner is in the testing and evidence behind your own declaration, not a compelled audit.
What it means if you recruit with AI
Recruitment, candidate screening and worker management are high-risk. From December 2027 a provider of hiring AI must show its data is representative and its system is accurate, documented and overseen. A deployer must oversee it, inform workers and keep records. The parts that need real analytical work, data representativeness, accuracy and adverse-impact testing, are exactly what we do. There is time to prepare, and preparing early is the point.
Fines scale with global turnover
Turning the Act into work you can evidence
- Readiness assessment against your risk tier and role
- Data-quality and representativeness testing (Article 10)
- Bias and adverse-impact testing of models
- Accuracy and robustness evaluation (Article 15)
- Technical documentation and logging support
- Human-oversight design for deployers
- Fundamental-rights impact assessments for public bodies
- Post-market monitoring set-up
Common questions
Does it apply to us if we are not in the EU?
It can. The Act reaches providers and deployers outside the EU where the system is used in the EU or its output is used there.
When do the hiring rules actually bite?
2 December 2027 for standalone high-risk systems, after the Digital Omnibus deferral from August 2026.
Do we need an independent third-party audit?
For most high-risk uses, including employment, no. Conformity is by self-assessment. We provide the testing and evidence that stands behind your declaration.
What about tools like ChatGPT or Claude?
Duties on the model makers (general-purpose AI) have applied since August 2025. As a deployer you still carry transparency duties and, for high-risk uses, the deployer obligations.
Get ahead of the December 2027 deadline
Tell us how you build or use AI and we will map where the Act applies and what to put in place, starting with the evidence that takes longest to build.
Talk to us about readinessExplore
This page is general information, not legal advice. The EU AI Act and its timeline are still developing; confirm your position with qualified counsel. Official source: the European Commission AI Act pages at digital-strategy.ec.europa.eu.