The EU AI Act and recruitment after the AI Omnibus

Since it was adopted, the EU AI Act has been the central piece of regulation for employers that use algorithms to sort applications or evaluate candidates. This summer the timeline changed. On 27 July 2026 the so-called AI Omnibus entered into force, moving the deadline for high-risk AI systems in areas such as recruitment to 2 December 2027, according to a news item published by the European Commission on digital-strategy.ec.europa.eu. This article looks at what the delay means, which rules already apply, and how HR teams can make sensible use of the extra time.

The Act sorts AI systems into four levels of risk. There are prohibited practices, high-risk systems, systems subject to transparency obligations, and systems with minimal risk. The Commission explicitly lists tools used for employment, management of workers and access to self-employment as a high-risk area, and gives CV-sorting software for recruitment as its example. The Commission's questions and answers on the Act add further detail, naming systems used to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. That covers a substantial share of the digital screening and testing tools used in modern hiring. The Omnibus does not touch this classification. It only changes the date.

The general date of application for the Act was 2 August 2026. Under the Omnibus, the requirements for high-risk systems now apply from 2 December 2027 for the use cases listed in Annex III of the Act, which includes employment. For AI embedded in physical products such as machinery and toys, the date is 2 August 2028. Other parts of the Act are already in force. The prohibitions, including the ban on emotion recognition in the workplace, have applied since 2 February 2025, as has the obligation to ensure AI literacy among the people who work with these systems. The rules on general-purpose AI models became applicable on 2 August 2025. The delay applies only to the high-risk chapter.

The Commission describes the Omnibus as a targeted simplification of the AI rulebook that preserves safeguards for safety and fundamental rights. The proposal was tabled on 19 November 2025. Beyond the new dates, the lighter compliance regime for small and medium-sized enterprises is extended to small mid-cap companies. Access to regulatory sandboxes is widened, and a sandbox at EU level is created. The AI literacy requirement is simplified, with a stronger supporting role for the Commission and the Member States. Registration in the EU database is simplified. One point stands out for recruitment. The Omnibus permits the processing of special categories of personal data for the purpose of detecting bias. Until now this has been a practical dilemma for employers wanting to test their tools for skewed outcomes without a clear basis for using sensitive data.

For providers of high-risk systems, the Act requires adequate risk assessment and mitigation, high-quality datasets to minimise discriminatory outcomes, logging of activity so results can be traced, detailed documentation, clear information for deployers, appropriate human oversight measures, and a high level of robustness, cybersecurity and accuracy. Before a system is placed on the market, the provider must complete a conformity assessment, run a quality management system, register the system in the public EU database and report serious incidents.

Employers that deploy such systems have obligations of their own. They must use the system in accordance with the instructions of use and monitor its operation, assign a designated person to exercise human oversight, and ensure that input data is relevant and sufficiently representative for the intended purpose. Employees and their representatives must be informed beforehand when a high-risk system is deployed at the workplace, and affected individuals are entitled to an explanation when an AI decision produces legal effects for them. Public authorities and organisations providing public services must also carry out a fundamental rights impact assessment.

On 19 May 2026 the Commission published draft guidelines on how to determine whether a system is high-risk. The draft includes examples from each area, employment among them, and a targeted consultation ran until 23 July 2026. The guidelines are not legally binding, but they reflect the Commission's interpretation and will guide enforcement.

The delay adds a little over a year, but the list of obligations is unchanged. For HR teams that buy or already use tests and screening tools, the practical task is to establish which systems fall under Annex III, what documentation the vendor can provide on data, validity and oversight, and who internally will take on the human oversight role. The AI literacy requirement already applies, and the duty to inform employees presupposes that an organisation knows what it is using before it can explain it. The extra time is best spent mapping and documenting rather than waiting.

Source: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force and https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai