The EU AI Act Reaches US Employers, and the Hiring Deadline Moved to 2027

When does the Act reach a US employer?

When the output of the AI system is used in the European Union. Article 2(1)(c) is the hook, and it asks for no EU entity, no EU office and no EU payroll: screening candidates based in the EU, or evaluating workers there, is enough on its own ¹. Annex III point 4 then classifies AI used for the recruitment or selection of people as high-risk, naming targeted job advertising, analysing and filtering job applications, and evaluating candidates ¹.

The same Annex entry reaches further into the employment relationship than most readiness notes mention. It covers AI used to decide promotion or termination, to allocate tasks, and to monitor and evaluate performance ¹. So a workforce analytics tool pointed at an EU team is inside the same category as a resume screener pointed at EU applicants, and a company that scoped its review to hiring has scoped it too narrowly.

Two limits are worth holding onto. The label attaches to the AI system's intended purpose rather than to anyone's job title, and Article 6(3) takes a system out of high-risk where it performs only a narrow procedural task or improves the result of a previous human activity without posing significant risk ¹. A scheduler and a formatter do not do what a filter does. That distinction is the same one US law turns on, which is why which AI hiring laws actually apply now reaches the same conclusion from a completely different statute.

What moved to 2027, and what did not

The compliance date moved, and the classification behind it did not. Regulation (EU) 2026/1744, the Digital Omnibus on AI adopted 8 July 2026 and published in the Official Journal on 24 July 2026, amended Article 113 so the high-risk obligations in Chapter III apply from 2 December 2027 for Annex III systems and 2 August 2028 for those embedded in regulated products ³. The Commission's implementation timeline now carries those dates ².

The recital gives the reason plainly: standards, common specifications and guidance were late, and national competent authorities were slow to stand up ³. That is a statement about readiness on the regulator's side, not a judgment that the rules were wrong.

What the Omnibus did not do matters more for planning. It did not touch Annex III point 4, so recruitment AI is still classified as high-risk. It left the Chapter III requirements themselves in place, so the programme due in December 2027 is the programme that was due in August 2026. And it did not defer the Article 5 prohibitions, the Article 4 literacy duty or the Article 50 transparency obligations ³. It did rewrite other parts of the Act around them, Article 4 among them ⁴.

In practice, that leaves a citation problem. Every law-firm note, vendor explainer and internal readiness deck written before mid-2026 says the high-risk hiring rules start 2 August 2026 ². That sentence is now wrong, it is the single most repeated error in this area, and it is probably sitting in a slide somebody is about to present.

Which duties are live right now

Two, both in force since 2 February 2025. Article 5(1)(f) prohibits using AI to infer the emotions of a person in the workplace or in an education institution, outside medical and safety purposes ¹. Article 4 asks providers and deployers alike to take measures supporting AI literacy among their staff and anyone operating AI on their behalf, and it is not limited to high-risk systems ¹⁴.

Read the emotion ban for what it says. The Act defines an emotion recognition system as one inferring emotions or intentions from biometric data, so the prohibition aims at face, voice and physiological inference rather than at every claim a tool makes about a candidate ¹. Whether a pre-hire video interview with an external candidate counts as "the workplace" is contested, and the statute does not settle it. What is settled is the exposure: Article 5 breaches sit in the top fine tier, up to EUR 35 000 000 or 7% of total worldwide annual turnover, whichever is higher ¹.

The literacy duty is the opposite shape, easy to satisfy and easy to ignore. Most summaries still quote the original wording, which asked for a "sufficient level" of AI literacy. The Digital Omnibus amendment took effect in mid-July 2026: literacy remains an obligation for providers and deployers, and no specific level is mandated ⁴. The Commission is equally plain that nobody has to be tested or certified, so any figure for required training hours has been invented somewhere else ⁴. Note also that Article 4 is absent from the enumerated fine tiers, so the widely repeated claim that AI illiteracy attracts fines up to EUR 15 000 000 or 3% does not follow from the text ¹. An employer running an off-the-shelf tool is a deployer, which puts ordinary recruiters inside the duty.

Decide the scope before you build the programme

One question comes before every other: whether EU-based candidates and workers are in scope at all. If the answer is no and you intend to keep it that way, scope the postings and the sourcing so it stays true, and write the decision down with a date. If the answer is yes, the deployer obligations arriving on 2 December 2027 need a programme, and the runway is about fifteen months.

What a deployer owes under Article 26 is worth reading now, because most of it is organisational and slow to build ¹:

• Use the system according to the provider's instructions for use, which means somebody has to read them and keep them.
• Assign human oversight to named people who are competent, trained and have the authority to act on what they see. An oversight role with no authority is a title.
• Keep the input data relevant and sufficiently representative for the intended purpose, to the extent the input data is under your control.
• Keep the logs the system generates automatically, for at least six months where they are under your control.
• Inform workers and their representatives before a high-risk system goes into service at the workplace ¹.

That last duty names workers. An external applicant's route runs through the Article 86 right to obtain from the deployer a clear explanation of the system's role in a decision that adversely affects them ¹. A candidate asking that question is asking the employer, not the vendor, which is the same asymmetry behind a candidate's right to human review of a rejection.

If a mandate arrived from the top and the calendar is already moving, what HR has to build in the first 90 days is the smaller version of this list. Confirm the final Omnibus text and your own scope with counsel before rescheduling any commitment: the deferral was recent, and the reporting on it moved faster than the drafting.

Read the evidence >