EU AI Act in recruiting: what applies now and what starts in December 2027

Key Points

• Under the EU AI Act, AI used in hiring is "high-risk". The main obligations start on 2 December 2027.
• The deadline moved from 2 August 2026 under the Digital Omnibus adopted in July 2026.
• Already in force: the ban on emotion recognition, the AI literacy duty and GDPR.
• Fines go up to EUR 35 million or 7% of turnover.

The EU AI Act is Europe's law on artificial intelligence. Hiring is one of the most closely watched areas.

Companies got more time. Some rules, however, already apply, and breaking them can be costly.

What changed

The obligations for hiring AI were originally due on 2 August 2026.

In July 2026, the Digital Omnibus (Regulation (EU) 2026/1744) moved them to 2 December 2027. DLA Piper covers the details.

Key EU AI Act dates relevant to hiring. | Graphic: Hiringly, source: AI Act and Digital Omnibus

Why hiring AI is "high-risk"

Annex III of the AI Act lists AI used for:

• recruitment and selection of people,
• targeting job ads,
• analysing and filtering applications,
• evaluating candidates.

The reason is simple. Decisions about work shape people's lives, and a flawed system can disadvantage whole groups.

What is already banned

Some features have been banned in hiring since 2 February 2025. They don't wait for 2027.

Prohibited practices vs. normal AI use with human oversight. | Graphic: Hiringly

Watch out: if a tool "reads" nervousness or emotions from a video interview, that is a problem today.

Beyond the bans, these also apply now:

• AI literacy. People using AI should understand how it works and where it fails.
• Transparency (from 2 Aug 2026). A chatbot must make clear the candidate isn't talking to a human.
• GDPR, Article 22. Candidates have the right not to face a purely automated decision.

What will be required from 2 December 2027

An employer using AI in hiring will mainly have to, under Article 26:

1. Use the system as instructed by the provider.
2. Ensure human oversight. A person who understands the system decides.
3. Watch the input data. The job description should be relevant and non-discriminatory.
4. Monitor operation and report serious incidents.
5. Keep logs for at least six months.
6. Inform people. Employees in advance, candidates that AI is involved.

Candidates will also get a right to an explanation of the AI's role in a decision (Article 86).

What's at stake

Maximum fines under Article 99 of the AI Act. Whichever amount is higher applies. | Graphic: Hiringly

6 steps you can take now

1. Map where you use AI in hiring. CV screening, chatbots, video interviews, ads.
2. Remove banned features. No emotion recognition.
3. Keep a human in the decision and write it into your process.
4. Choose tools that explain themselves. Without reasons there is no transparency.
5. Check your vendor. Where the data lives and whether you have a data processing agreement.
6. Train your team. A short session also covers AI literacy.

For more detail, see the GDPR and EU AI Act checklist for recruiting.

FAQ

Does the AI Act apply to small companies? Yes. What matters is what you use AI for, not company size. Most simplifications for smaller firms concern AI providers.

Do I have to tell candidates I use AI? GDPR already requires you to inform them about data processing. From December 2027 the AI Act requires it explicitly.

Can AI reject candidates automatically? We don't recommend it. It is risky under Article 22 of the GDPR and the AI Act's human oversight principle.

Where is official information? On the European Commission's AI Act page and your national data protection authority.

Summary

The extra time is a chance to set up AI-assisted hiring calmly. The core is simple: AI recommends, a person decides and can explain why.

Hiringly works exactly like that: a reason behind every score, data in the EU and no automatic rejections. More in What is an AI ATS.

Try Hiringly for free →

This article is for information only and is not legal advice.