The EU AI Act and hiring: where high-risk rules stand in late 2026

For two years, every conversation about the EU AI Act and hiring pointed at one date: 2 August 2026, when the high-risk rules for recruitment AI were due to apply. Those obligations for hiring tools now apply from 2 December 2027. Most of the rest stayed where it was, and parts of the Act already bind anyone using AI in recruitment today. This update is written for recruiting teams that buy or run AI interview tools. It is a status report in plain language and is not legal advice. For the basics of why hiring AI is high-risk at all, start with AI interviews and the law.

The new date is 2 December 2027, and it is now law

The Commission proposed the Digital Omnibus on AI (the “AI Omnibus”) on 19 November 2025. Parliament and Council reached political agreement on 7 May 2026, and the amendment entered into force on 27 July 2026. Under it, obligations for the high-risk use cases in Annex III, which include employment and recruitment, apply from 2 December 2027, and high-risk AI embedded in regulated products follows on 2 August 2028 (European Commission). The amending act is Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 (Cuatrecasas).

The final deal set fixed revised dates for the high-risk regime (Stephenson Harwood). Through the first half of 2026, anyone asking when the hiring rules would apply got the same reply: it depended on a negotiation. With the dates fixed, the open question is the detail of how the Commission will draw the line between a high-risk hiring tool and a harmless one.

What did not move: the EU AI Act rules for hiring that already apply

Four parts of the Act are live today, and none of them waited for December 2027.

The prohibitions, since 2 February 2025. Emotion recognition in the workplace is on the list of banned practices (European Commission). Commentary on the Commission’s guidelines confirms that hiring processes fall within the workplace context for this ban, and that voice characteristics are in scope when used to infer emotions (Future of Privacy Forum). An interview tool that rates a candidate’s “confidence” or “enthusiasm” from their voice is already a compliance problem, with fines of up to €35 million or 7% of worldwide annual turnover (Article 99).

AI literacy, since 2 February 2025 (reworded in 2026). The Omnibus kept the duty on providers and deployers but softened it: they “shall take measures to support the development of AI literacy” of their staff, and the article “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The amendment entered into force on 27 July 2026 (Law & Technology). The Commission’s original proposal would have removed the direct obligation; Parliament kept it (Cuatrecasas). For a recruiting team, the practical reading is real, recorded measures for the people who read AI scores.

General-purpose AI model rules, since 2 August 2025, with the Commission’s enforcement powers applying from 2 August 2026 (Mayer Brown). These duties sit with the companies that build foundation models. They still matter to you because the interview tool you buy may run on one.

Transparency, since August 2026. Under Article 50(1), AI systems that interact directly with people must be designed so those people are told they are dealing with an AI, unless it is obvious (Article 50). The Commission lists the transparency rules as applying from August 2026 (European Commission). An AI voice interviewer is exactly this kind of system: candidates should know from the first second that the interviewer is an AI.

Draft guidance treats AI interview tools that score as high-risk

On 19 May 2026 the Commission published draft guidelines on high-risk classification, with feedback open until 23 June 2026 (Jones Day). Tools that source, score, rank, shortlist, assess or match candidates are treated as high-risk where they “materially influence recruitment or selection outcomes.” Named examples include CV-to-job matching, “top candidate” lists and interview answer scoring. Interview scheduling, credential verification and CV parsing into a searchable database are the kinds of tasks likely to fall outside (Debevoise & Plimpton). Keeping a human as the final decision-maker does not take a scoring tool out of scope (Faegre Drinker).

These guidelines are still a draft, expected to be finalised before the high-risk obligations apply (Jones Day). We could not find a final version as of this writing. Plan as if an AI interview that produces a score is high-risk, because every signal points that way.

What else the Omnibus changed for hiring

Beyond the date, two changes are worth knowing (Cuatrecasas):

• Bias detection. Providers of high-risk systems may process special categories of personal data to detect and correct bias where “strictly necessary,” under safeguards including deletion once the bias is corrected. The Act permits this processing without requiring it.
• Small mid-caps. Relief that used to be reserved for SMEs (simplified technical documentation, proportionate management systems, lower fine caps) now extends to “small mid-cap enterprises.” In practice it mostly helps vendors.

What deployers will owe from December 2027

If you use a high-risk hiring tool, you are its deployer, and Article 26 is your list (Article 26):

1. Use it as instructed, with technical and organisational measures to match.
2. Assign human oversight to people with “the necessary competence, training and authority.”
3. Check your input data is relevant and sufficiently representative, to the extent you control it.
4. Monitor the system and inform the provider without undue delay if something looks wrong.
5. Keep the logs it generates for at least six months.
6. Inform workers’ representatives and affected workers before using it at the workplace. This matters for internal moves and promotions.
7. Tell candidates that they are subject to a high-risk AI system when it makes or assists decisions about them.

Add Article 86: a person affected by a decision based on a high-risk system’s output can ask for an explanation of the system’s role and the main elements of the decision (Article 86). The fundamental rights impact assessment in Article 27 falls on public bodies and private entities providing public services, not on private employers as such (Article 27). Deployer breaches carry fines of up to €15 million or 3% of worldwide turnover (Article 99).

A readiness checklist for recruiting teams

Thirteen months is enough time to do this properly, provided the work starts this year.

1. Inventory every AI tool in your funnel and sort it: does it score, rank or shortlist (plan for high-risk), or only schedule and parse (likely not)?
2. Remove emotion inference now. If a tool reads tone, stress or “energy,” that is already an Article 5 problem, well before 2027.
3. Disclose the AI. Confirm candidates are told up front that they are talking to an AI. Article 50 already applies.
4. Document AI literacy measures for every recruiter and hiring manager who reads a score.
5. Name your human overseers and give them real authority to override the tool. Write down who they are and how they were trained.
6. Ask your vendor about logs: what is recorded automatically, and can you retain it for at least six months?
7. Draft the candidate notice and the explanation route now, so you have templates ready for Articles 26 and 86 before they apply.
8. Ask for the instructions for use your vendor will owe you as a high-risk provider, and when they expect to have them. You cannot “use it as instructed” without them.
9. Demand traceable scores. If a score cannot be tied to evidence, neither the oversight nor the explanation duties can be met. See evidence-based scorecards.

Where Hure lands

Most of this checklist is about evidence and control, and that is how Hure is built. Every score cites a verbatim moment in the transcript, against a sealed, versioned rubric, with the model version recorded. That gives you the raw material for logging, oversight and an explanation a candidate can actually follow. Hure uses no biometrics and no emotion inference, ever. It scores what candidates say and ignores how they sound or look, so the practice Article 5 bans is not part of the product. A human always makes the hiring decision. Hure’s Workflows have no reject action by construction; adverse outcomes go to a human review queue. On why content-only scoring is also the fairer choice, see what biases first-round interviews, and for the product itself, the interviewer page.

A caveat: architecture helps, but conformity has to be demonstrated separately. The high-risk obligations on providers and deployers do not apply until December 2027, the classification guidelines are still in draft, and your obligations as a deployer remain yours whichever tool you choose. Treat this as a status report dated October 2026, and talk to counsel when the stakes are real.