Regulation (EU) 2026/1744 — the Digital Omnibus on AI — moved the EU AI Act's high-risk obligations for recruitment and worker-management systems from 2 August 2026 to 2 December 2027. The delay covers Chapter III duties only. Prohibited practices, transparency rules, AI literacy and the GDPR apply to hiring assessments today, unchanged.
That distinction is where the confusion sits. "The AI Act got delayed" has been read in a lot of HR teams as "nothing applies yet." That is not what happened. Below are the questions assessment and talent teams are actually asking.
What exactly changed, and when?
The Digital Omnibus on AI entered into force on 27 July 2026 and amended Article 113 of the AI Act. The revised dates:
- 2 December 2027 — high-risk obligations for Annex III standalone systems, which is the category hiring and worker-management tools fall into.
- 2 August 2028 — high-risk obligations for AI embedded in regulated products under Annex I.
- 2 August 2027 — the member-state obligation to establish AI regulatory sandboxes.
- Unchanged — the Article 50 transparency duties for systems newly placed on the market, applicable since 2 August 2026.
The deferral was framed around the slow arrival of harmonised standards and conformity-assessment infrastructure. It postpones the compliance date; it does not narrow what will eventually be required.
Is my assessment platform actually in scope?
Read Annex III, point 4 literally. It covers AI systems intended to be used "for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates."
Point 4(b) extends to systems used to make decisions affecting terms of work-related relationships, promotion or termination, task allocation "based on individual behaviour or personal traits or characteristics," and monitoring or evaluating performance and behaviour.
An AI-scored situational judgement test used to shortlist candidates sits squarely inside 4(a). So does a résumé-ranking model, an AI-graded coding exercise or an automated English-proficiency scorer. A static multiple-choice test marked against a fixed key is not an AI system at all — classification turns on that threshold question first.
Does any of it apply to us if we are outside the EU?
Scope follows the output, not the office. The Act reaches providers placing systems on the EU market, deployers established in the EU, and providers and deployers in third countries where the system's output is used in the Union. A Bangalore or Manila assessment vendor whose scores decide EU-based hires is inside the perimeter; the same vendor screening only domestic candidates is not. Most multi-country employers build to the EU bar everywhere anyway, because running two scoring pipelines costs more than meeting one standard.
What already applies, today, delay or no delay?
Three things, and they are the ones most likely to catch an assessment team out.
Prohibited practices (applicable since 2 February 2025). Article 5 bans AI systems used "to infer emotions of a natural person in the areas of workplace and education institutions," with a narrow exception for medical or safety purposes. Video-interview tools that score enthusiasm, confidence or sincerity from facial expression or vocal tone are not a 2027 problem. They are prohibited now. Article 5 also bans biometric categorisation that infers sensitive traits such as race, political opinions or sexual orientation.
AI literacy (applicable since 2 February 2025). Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among staff operating these systems. The omnibus reworded it so that the Commission and member states support that effort, which lightens the evidentiary burden on individual employers without removing the duty.
Transparency (applicable since 2 August 2026). Article 50 requires that people interacting directly with an AI system be told so, unless it is obvious, and that generative outputs be machine-readably marked where technically feasible.
Doesn't the GDPR already cover the gap?
To a large extent, yes — and this is the part teams underestimate. Article 22 GDPR gives data subjects the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects.
In SCHUFA (C-634/21), decided 7 December 2023, the Court of Justice held that producing a probability score is itself an Article 22 "decision" where a third party draws on that value in a determining role for its own decision. Translate that to hiring: if your assessment vendor returns a score and the employer's shortlist follows it in almost every case, the vendor's scoring act — not only the employer's rejection letter — is likely to sit inside Article 22. That reasoning was available in 2023 and does not wait for December 2027.
Does putting a human at the end take us out of scope?
Not by itself. The question regulators and courts ask is whether the review is meaningful — whether the reviewer has the authority, the information and the practical capacity to reach a different conclusion. A recruiter approving the top of a ranked list at eighty candidates an hour is rubber-stamping, not overseeing.
Article 26 of the AI Act will make this explicit for deployers from December 2027: oversight must be assigned "to natural persons who have the necessary competence, training and authority," and deployers must monitor operation against the instructions for use. Build the oversight so it can be evidenced — who reviewed, what they saw, how often they overrode. On AssessAll, AI-graded scenarios surface a rationale and integrity bands rather than a bare pass/fail, precisely so a reviewer has something to disagree with.
Do we have to tell candidates and employees?
From December 2027, Article 26(7) requires deployers who are employers to inform workers' representatives and the affected workers before putting a high-risk system into service in the workplace. Separately, Article 86 gives an affected person subject to an Annex III-based decision with legal or similarly significant effects the right to obtain "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken."
National works-council and consultation law in several member states already bites earlier and harder than the AI Act will.
What are the penalties?
Article 99 sets two ceilings. Breaching the Article 5 prohibitions carries fines up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. Breaches of provider, deployer or transparency obligations carry up to €15 million or 3%. These are maxima rather than tariffs, and smaller enterprises face the lower figure.
Is a validation study the same as a conformity assessment?
No, and conflating them is the most common planning error. A conformity assessment is a regulatory procedure covering risk management, data governance, technical documentation, logging, human oversight and registration. A validation study is evidence that scores predict the criterion they claim to predict. You need both, and validation evidence is the slower of the two to acquire, because it requires outcome data you may not be collecting yet. The Standards for Educational and Psychological Testing and, for US-exposed employers, the Uniform Guidelines on Employee Selection Procedures describe what that evidence looks like. None of it is EU-specific, and none of it was delayed.
What should we do with the fourteen months?
A reasonable sequence:
- Inventory. List every AI system touching a selection or worker-management decision, including ones embedded in your ATS that you never procured separately.
- Screen for prohibitions first. Anything inferring emotion in a hiring or training context is a today problem, not a 2027 one.
- Fix the provider/deployer split in contracts. Build-versus-buy determines who owes what, and renewals signed now will still be running in December 2027.
- Start the outcome data collection. Criterion validity evidence needs linked hire-and-performance records over time; you cannot retrofit it in the last quarter.
- Make oversight auditable. Log review, override and escalation now, while changing the workflow is still cheap.
- Standardise the candidate-facing record. Portable evidence of what was measured and how — a Skill Passport, in AssessAll's terms — makes explanation requests routine rather than a research project.
The takeaway
The December 2027 date buys time to build conformity infrastructure; it buys none at all on prohibited practices, transparency, AI literacy or the GDPR. Teams that spend the extra fourteen months collecting validity evidence and making oversight real will find the deadline anticlimactic. Those reading the delay as permission to stop will meet all of it at once.