If you saw a headline this summer saying the EU AI Act is now in force and it applies to hiring, you read something that is half true and slightly backwards. Here's what actually happened. On 27 July 2026, six days before the Act's high-risk rules were due to bite, Regulation (EU) 2026/1744 — the Digital Omnibus on AI — entered into force and pushed the Annex III deadline back sixteen months, from 2 August 2026 to 2 December 2027. Annex III is the bucket that covers recruitment, candidate selection, promotion, termination, task allocation and performance monitoring. In other words, the single part of the AI Act written specifically about hiring is the part that just got delayed.
What did not move: the Article 5 prohibitions, the Article 4 AI literacy duty, Article 50 transparency (live since 2 August 2026), the full penalty framework, and GDPR Article 22, which has restricted solely automated decisions with significant effects since 2018 and was never part of this conversation.
So the honest summary is: the paperwork slipped, the principles didn't.
Discussed live: X Spaces broadcast on the AI Act and hiring.
Three things that are already live #
Emotion recognition in hiring is banned outright. Not high-risk, not "document it carefully" — prohibited since February 2025, no reprieve, no grandfathering. If a tool scores a candidate's tone of voice, facial expression or "enthusiasm" from a video interview, that is an unacceptable-risk practice carrying the top fine band. A surprising number of interview platforms still market something adjacent to this.
You are a deployer, not a bystander. Most recruiters have quietly filed this under "vendor problem." The Act doesn't work that way. If you run the tool on real candidates, you carry deployer obligations of your own, including the AI literacy requirement that your people actually understand what the system does.
It reaches you even if you're not in the EU. I'm in Switzerland, which is not in the EU, and this still lands on my desk. A UK agency ranking candidates for a Berlin role, or a US platform whose output is used in the EU, is in scope. Geography of the office is not the test.
Now the criticism #
The delay happened because the regulator wasn't ready, and industry gets to look like the problem. The Commission's own reasoning was that the harmonised standards weren't finished and the conformity-assessment machinery didn't exist yet. CEN-CENELEC's key standards weren't expected until late 2026. Member states were meant to designate their national competent authorities by August 2025; more than a year past that date, readiness estimates still range from "24 of 27 have designated something" to "8 or 10 have anything you could call an implementation." When the sources tracking a law can't agree on how many of its enforcers exist, the compliance date was never the binding constraint.
Sixteen months of relief for vendors is sixteen months of nothing for candidates. The delay was sold as breathing room for business, and for large ATS vendors with legal teams it genuinely is. But the substantive protections — the right to know a machine ranked you, meaningful human oversight, documented bias testing — are what got postponed. The people those clauses were written for are the ones with no lobbying budget, and they're the ones who waited.
Grandfathering creates a perverse incentive. Systems already on the market escape the full high-risk regime until they're "substantially modified." Read that as a builder and it says: freeze your model, ship no meaningful improvements, and you stay in the cheap lane. Retrain on better data to reduce bias and you may have just triggered the obligations. That is exactly backwards.
And the delay is being heard as a cancellation. This is the practical risk for anyone in hiring. "Postponed to 2027" gets shortened to "not a thing yet," the Article 5 prohibitions get skipped, and the December 2027 deadline arrives with the same scramble, sixteen months later. Deferred is not repealed. The conformity assessments, risk management, technical documentation and human-oversight architecture are all still coming, unchanged.
What I'd actually do this quarter #
Three things that cost nothing:
- Inventory. List every tool that touches a candidate and ranks, scores, filters or infers anything. Most teams cannot produce this list, which is itself the finding.
- Ask one question of each vendor: does this system infer emotional state at any point? Get the answer in writing. That one's not on the 2027 clock.
- Write down the human step. Who overrules the machine, on what basis, and where is it recorded? You'll need it for the AI Act, and you already need it for GDPR Article 22.
None of that requires waiting for December 2027, and none of it requires a compliance budget. It mostly requires being willing to find out what your stack actually does.
Not legal advice — I build software, I don't practise law. If you're making decisions on this, talk to someone who does.