EU AI Act Employment Law: What Changes for Your HR Team

If you’ve read a law firm’s summary of the EU AI Act, you were probably told that the rules for AI in hiring and people management start on 2 August 2026. That date has passed, and the rules didn’t start. In July the EU changed the timetable. The high-risk rules that cover employment now apply from 2 December 2027.

Almost every page that ranks for this topic still gives the old date or no date at all. So this guide starts with the dates as they stand on 30 October 2026. It then goes through the tools an HR team actually uses and says which ones the Act probably covers. After that come the duties that sit with you and the ones that sit with your vendor. It ends with the questions to take to a lawyer.

There’s one thing you should know before you read on. Culturro builds HR agents. We aren’t a law firm, and nothing here is legal advice. Where we give a view that isn’t backed by a source, we say so.

EU AI Act employment law: where the dates stand now

The Act came into force on 1 August 2024. It doesn’t apply all at once. Different parts switch on at different dates, and in July 2026 the EU moved some of them. The change came through a package the EU calls the AI Omnibus. It entered into force on 27 July 2026, according to the European Commission’s own page.

Date	What applies	Source
1 Aug 2024	The Act enters into force	William Fry, 8 Sep 2025
2 Feb 2025	Prohibited practices and the AI literacy duty apply	William Fry, 8 Sep 2025
27 Jul 2026	The AI Omnibus enters into force and changes the timetable	European Commission, read 30 Oct 2026
2 Dec 2027	Rules for high-risk systems in Annex III apply. Employment is one of the Annex III areas.	European Commission, read 30 Oct 2026
2 Aug 2028	Rules for high-risk AI built into regulated products (Annex I) apply	European Commission, read 30 Oct 2026

What already applies today

Two parts of the Act have applied since February 2025. The first is the list of prohibited practices in Article 5. These are uses of AI the EU has banned outright, whatever your reason for wanting them. One of them matters directly to HR. The Act bans AI that infers how people feel at work, unless it’s there for medical or safety reasons.

The definition is narrower than it sounds, as Lewis Silkin explains. The ban is aimed at emotion recognition, which the Act ties to biometric data such as a face or a voice. So a tool that reads frustration from someone’s expression on a video call is the target. A tool that scores the mood of written survey comments works on text, not biometric data. That kind of tool is probably outside the ban.

The ban also reaches job candidates, at least in the Commission’s reading. Its guidelines on prohibited AI practices say “workplace” should also cover candidates during selection and hiring. Those guidelines aren’t binding, because only the EU Court of Justice can settle what the Act means. But they are the Commission’s own view of the ban, so it would be unwise to plan against them.

The Omnibus didn’t soften this. The Commission’s summary lists one new ban, on AI that generates non-consensual sexual images or child sexual abuse material. It lists no change to the emotion ban. That new ban is unlikely to touch an HR tool. So treat the prohibitions as live today, and check how they apply to your tools with your counsel.

The second part that already applies is AI literacy. AI literacy is the duty to make sure the people who use AI at your company understand enough about it to use it sensibly. The Omnibus simplified this duty for companies. It also gave the Commission and national governments a bigger part in promoting AI literacy. The duty hasn’t gone away, but the burden on you is lighter than the early guidance suggested.

What moved to December 2027 and August 2028

The big change for HR is the high-risk date. The Act lists certain areas where AI can do real harm to people, and it calls systems used in those areas high-risk. The list is in a part of the Act called Annex III, and employment is point 4 on it. The rules for those systems now apply from 2 December 2027 instead of 2 August 2026.

The second date is 2 August 2028 and it is for AI built into products that are already regulated, like machinery or toys. Most HR teams won’t deal with that one.

The Omnibus made two other changes an HR leader should know about. Small mid-cap companies now get some of the simpler rules that used to be limited to small and medium businesses. Companies may also now process special-category personal data to detect and correct bias. Ethnicity and health data are examples. That second point matters if you want to test a screening tool for unfair results, because that kind of testing often needs exactly the data you’d normally keep away from it.

Which of your HR tools the Act probably covers

Annex III point 4 covers AI used in two broad ways. One is recruitment and selection. The Act names placing targeted job ads, filtering applications and evaluating candidates. The other is decisions that affect people once they work for you. That means decisions about the terms of someone’s work, and about promotion and termination. It also means allocating work based on someone’s behaviour or personal traits. The last category is monitoring or evaluating performance and behaviour.

That is still abstract, so here is how it lands on the tools an HR team actually runs. The status column is our judgment from reading the categories. It isn’t a legal finding, and a lawyer may place a specific tool differently once they see how you use it.

Tool	Likely in scope?	Why (Annex III point 4 category)	Status
ATS screening and CV ranking	Yes	It filters and ranks applications, which is recruitment and selection	Likely in scope
Interview scheduling bots	Hard to say	It handles the admin of recruitment and doesn’t judge the candidate	Unclear
AI interview agents	Yes	It evaluates candidates, which is recruitment and selection. The Commission also applies the emotion ban to candidates, so reading emotion from voice or video is out.	Likely in scope
HR chatbot and employee service agent	Usually no	It answers policy questions and doesn’t decide anything about a person	Probably not
Skills inference	Depends on use	It’s in scope if its output feeds promotion or task allocation, and probably not if it only suggests learning	Unclear
Engagement analytics and sentiment tools	Depends on design	Survey analysis is probably outside. A tool that reads an individual’s emotions from their face or voice falls under the ban.	Unclear
Performance and productivity monitoring	Yes	It monitors and evaluates performance and behaviour	Likely in scope
Shift scheduling and task allocation	Hard to say	It allocates work, but it may not be based on individual behaviour or traits	Unclear
AI coaching tools	Usually no	It supports the employee and doesn’t evaluate them, unless managers use its output to judge people	Probably not

Three tools are the most likely to be in scope: screening, interview agents and performance monitoring. If you run any of them, they’re where your preparation should start. The HR Agent Map’s Talent Acquisition section lists the recruiting agents in more detail. Its HR Operations & Shared Services section covers the chatbot side, which mostly sits outside the high-risk rules.

The “probably not” rows come with a warning. A tool’s status follows how you use it, not what it’s called. A coaching tool that only the employee sees is one thing. The same tool that sends summaries to managers who then rate people is starting to look like performance evaluation.

Where the law is unclear

The Act has an exception that matters here. Article 6(3) says a system on the Annex III list isn’t high-risk if it doesn’t pose a significant risk of harm to people’s health, safety or rights. The Act gives four ways to qualify, and two matter most in HR. One is a system that only does a narrow procedural task. The other is a system that only does a preparatory task before a person makes the assessment. But there’s a hard limit. A system that profiles people is always high-risk. Profiling means using personal data to analyse or predict things like someone’s work performance or reliability.

Some tools still sit in a grey area, and the law firms say so. Lewis Silkin flags two that many HR teams use. The first is shift scheduling. It allocates tasks, which is on the list. But the Act’s wording ties task allocation to individual behaviour or personal traits. A rota tool that only looks at availability and contracted hours may not meet that test. One that weighs past performance or reliability probably does, because that starts to look like profiling.

The second is the administrative side of recruitment, like scheduling interviews or sending reminders. These tools touch the hiring process but don’t judge anyone. Our view is that pure scheduling is unlikely to be the target, because it looks like the narrow procedural task the exception describes. But the line moves fast once a tool starts ranking candidates or deciding who gets an interview first.

Skills inference and sentiment tools are unclear for a different reason. Their status depends on what you do with the output. That is something you control. So write down the intended use now, before someone in the business finds a new one.

The duties HR owns as deployer

The Act splits responsibility between two parties. The provider is the company that builds the system and puts it on the market. The deployer is the company that uses it. If you buy an AI screening tool, the vendor is the provider and you are the deployer.

Deployer duties sit in Article 26 of the Act, and Matheson’s summary for employers sets them out in plain terms. We’ve matched each one to the person in an HR team who would most likely handle it. The Act names no roles, so who owns what is our suggestion, not the Act’s.

What the Act asks of you	Article 26	Who in HR would most likely handle it
Use the system as the vendor’s instructions say	26(1)	The HR systems or HR operations lead who owns the tool
Assign human oversight to people who have the training and authority to do it, and give them support	26(2)	Often the head of talent acquisition for recruiting tools. For monitoring tools it is often an HR business partner.
Keep the logs the system produces for at least six months, where you control them	26(6)	HR operations, with IT
Watch how the system performs. If it may cause a risk, tell the provider and the national regulator, and suspend use.	26(5)	The tool owner, with a clear route to your legal team
Inform workers and their representatives before you put the system into use at work	26(7)	Employee relations or the HR business partner, as the next section explains
Tell people when a high-risk system makes or helps make decisions about them. Candidates are included.	26(11)	The recruiting team for candidates, and the tool owner for staff
Use the vendor’s information when you carry out a data protection impact assessment	26(9)	Your data protection officer, with HR supplying the facts

There is also a separate fundamental rights impact assessment in Article 27. It applies to public bodies and to private companies that provide public services. It also covers companies that use AI to score credit or price life and health insurance. Most private employers won’t fall under it for their HR tools. But if you’re a public body or you provide a public service, ask counsel whether it applies to you.

None of these duties needs a new department, but each one needs a named person. The most common gap we’d expect is the oversight duty. A tool goes live, and nobody is told that reviewing its output is now part of their job.

What sits with the vendor and what to ask for

Most of the heavy work sits with the provider. The vendor has to design, test and document the system. It also has to give you instructions for using it safely. Your job is to check they’ve done it and to keep the evidence. Ask each vendor of an in-scope tool these questions before 2 December 2027:

• Do you treat this product as high-risk under Annex III and why?
• Can we see the instructions for use and do they say what human oversight you expect from us?
• What logs does the system keep and how do we get them out?
• How did you test for bias and on what data?
• What is your plan to meet the high-risk rules by December 2027?

A vague answer to the first question is useful information in itself. A vendor who hasn’t decided whether their product is high-risk hasn’t started the work you’re relying on. If a vendor says a listed product isn’t high-risk, Article 6(4) requires them to document that assessment before they sell it. So ask to see it.

What changes if your team configures or builds its own agent

More HR teams now set up agents on top of the large general-purpose AI models behind tools like ChatGPT, or build their own. We build these for clients, so this is the part we get asked about most. Article 25 of the Act sets out when a deployer takes on a provider’s duties. That happens if you put your own name or trademark on a high-risk system. It also happens if you make a substantial change to one.

There’s a third case, and it matters most for HR. Say you take an AI system that isn’t high-risk, such as a general-purpose model. If you then use it for something on the Annex III list, you become the provider of a high-risk system. That means the provider’s duties of design, testing and documentation are now yours.

So the rule is fairly clear at the two ends and unsettled in the middle. Writing the instructions for a policy chatbot is a long way from building a candidate-ranking agent on your own data. The chatbot answers questions. The ranking agent puts a general model to work on recruitment and selection, which is the change of purpose Article 25 describes. Configuring a vendor’s high-risk product sits in between, and whether your changes count as substantial is a question for counsel.

My advice is to decide the purpose of any agent you build before you build it. Ask counsel next whether that purpose makes you a provider. If an agent does something on the Annex III list, plan as if you carry provider duties until a lawyer tells you otherwise.

Informing workers and works councils

Article 26(7) says an employer must inform workers’ representatives and the affected workers before putting a high-risk system into use at work. That is the Act’s whole requirement on this point. It asks you to inform people. On its own terms it doesn’t ask you to consult them or get their agreement.

But the Act isn’t the only rule that applies. Many EU countries have their own laws on works councils and employee representation. Many companies also have collective agreements. These can give representatives a right to be consulted on new monitoring or evaluation tools. Some go further and give them a right to approve those tools, often well before launch. That’s why Matheson’s preparation list tells employers to identify any consultation duties under collective or works council agreements.

The Act’s duty sits on top of those rules. It doesn’t replace them, and the Act says so itself. Article 2(11) lets EU countries keep or add laws that protect workers more than the Act does. It also lets them encourage collective agreements that go further.

So the practical answer depends on where your people work. Don’t assume one country’s rule holds everywhere. For each country where you’d use an in-scope tool, ask employment counsel what representatives are entitled to and how early. In some places the national rule will be the one that sets your timeline, not the Act.

How the 10X trust-to-earn lens sorts the triage

The triage table tells you what the law probably covers. It doesn’t tell you what to do first. We use the 10X Framework for that. It is how we score HR AI use cases before anyone builds them. It scores each use case on three lenses: impact, trust to earn and readiness. The scores then sort it into one of four tiers. They are Build now, Proof first, Build with guardrails and Not yet.

Trust to earn is the lens that matters here. It asks what a wrong answer costs and whether a person or the AI makes the decision. It also asks how sensitive the data is. The worst of the three answers sets the score, and a low score means there’s little trust to earn. A use case can only reach Build now if its trust score is 2 or lower. A trust score of 5 always lands in Not yet, however good the other scores are. So does any idea where the AI would make a decision about a person on its own.

Here is how we’d group the triage tools on that lens. This is our judgment and not a score from the framework’s calculator, with one exception. The framework’s own worked example is an interview scheduling agent, and it scores 1 on trust and lands in Build now.

Trust to earn	Tools from the triage table	What it means for you
Little	The HR chatbot, interview scheduling bots and coaching tools that only the employee sees	These are mostly the tools the Act probably doesn’t cover
Some to real	Skills inference, shift scheduling and engagement analytics that report on groups	People will want to know what the tool sees and what it’s used for
A lot	CV screening, interview agents, and performance or productivity monitoring	These shape decisions about named people. In the framework’s terms they’re Build with guardrails at best. A person decides, and notice and consultation come first.
The most, or stopped	A tool that reads an individual’s emotions from their face or voice, or one that rejects candidates with no person in the decision	The Act bans the first. The framework stops the second on purpose.

The overlap is the useful part. The tools with the most trust to earn are mostly the ones the Act calls high-risk. That isn’t a coincidence, because both look at the same harm to people. So the Act’s timeline gives you a sensible order. Start with the tools that have little trust to earn. They can deliver value now and they carry light obligations. The tools with a lot of trust to earn come next, and they need proper preparation before December 2027. If you want a fuller method for ordering use cases, our guide to prioritising HR AI use cases walks through it.

Where a lawyer takes over

This guide can get you to a good set of questions. A lawyer has to answer them, because the answers depend on your tools, your countries and your contracts. Take these to counsel:

• Which of our tools are high-risk under Annex III point 4 given how we actually use them?
• Does anything else in the AI Omnibus change our position beyond the dates?
• Have any of our configured or in-house agents made us a provider?
• Do we need a fundamental rights impact assessment, a data protection impact assessment or both?
• What are works councils and representatives entitled to in each country where we operate, and when?
• How does the Act fit with GDPR’s rules on automated decisions and with anti-discrimination law?
• Do we qualify for the simpler rules for small mid-cap companies?

The fines are set in Article 99. Breaking a prohibition can cost up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Breaking the deployer duties in Article 26 can cost up to 15 million euros or 3 percent. Giving regulators incorrect or misleading information can cost up to 7.5 million euros or 1 percent. Some 2024 summaries, including Lewis Silkin’s, give 1.5 percent for that last tier. The Act’s text says 1 percent.

Smaller companies get a lower ceiling. Each fine for small and medium businesses is capped at the lower of the two amounts, not the higher. The Omnibus extended that lower cap to small mid-caps for the deployer-duty and information fines. Ask counsel for the figures that apply to you before you put them in a board paper.

Again, this post isn’t legal advice. It’s a builder’s view of where the law meets an HR team’s tools. If you’re also hiring in New York, our post on NYC Local Law 144 covers a rule that already applies there. Our guide to AI governance in HR gives the wider picture.

What to do before December 2027

Thirteen months sounds like a lot. But vendor answers, works council timelines and impact assessments all take longer than people expect. Here’s a short plan, with dates you can adjust.

1. By the end of 2026, list every AI tool HR uses. Include tools a manager signed up for on a company card. Put each one into the triage table above.
2. By the end of Q1 2027, send the vendor questions to every in-scope supplier. Chase anyone who can’t say whether their product is high-risk.
3. By mid-2027, name the person who oversees each in-scope tool. Give them the training and the authority to stop it. Agree who keeps the logs.
4. By mid-2027, check your informing and consultation duties in each country. Start talks with representatives early, because their timeline may be longer than yours.
5. By September 2027, finish any impact assessments and fix the gaps they find. That leaves a few months of margin before 2 December.

Two of our other guides help with the groundwork. HR data readiness covers what your data needs before an agent touches it. Why HR AI pilots stall covers the people side that regulation tends to expose. Your board may be asking where you stand, and what to tell the board about HR AI maturity gives you a way to frame it.

If you’d like to talk through your own tool list, book a 30-minute call. We’ll cover how to build HR agents on your own systems in a way that’s ready for these rules. You can also look through the HR Agent Map first to see which agents fall where, or read about how we work.