The Com'mon People
Guides Dispatches Loudspeaker About
Explore Resources
← the dispatches
Law & Governance202621 sources

The EU AI Act.
What UK Recruiters Need To Know.

The world’s first comprehensive AI law is live. Brexit does not put UK firms out of reach. Most modern hiring tech is classified as high-risk. Here is what it means, who it catches and what to do about it right now.

The EU AI Act - the weight of regulation

The audit begins whether you are ready or not. August 2026 is not a soft deadline.

01 · Plain English, first.

What the EU AI Act actually is.

Formally Regulation (EU) 2024/1689. In force 1 August 2024. The world’s first comprehensive cross-sector AI law. Rather than regulating a specific technology, it sorts AI systems into four risk bands and applies stricter rules as the risk goes up.[1, 2]

Band 01 · Unacceptable risk

Banned outright. Government social scoring. Certain emotion-recognition uses in workplaces. Real-time biometric surveillance in public spaces. In force since Feb 2025.

Band 02 · High risk

Heavily regulated. This is the band that catches most recruitment AI: CV screening, candidate ranking, scoring, video interview analysis. Rules apply Aug 2026.

Band 03 · Limited risk

Lighter obligations, mainly transparency. If users are interacting with a chatbot, they must be told they are talking to a machine. Rules apply Aug 2026.

Band 04 · Minimal risk

No specific obligations. Most AI in everyday use falls here: spam filters, music recommendation, content moderation tools.[1] No obligations.

Origin

The European Commission first proposed an AI law in April 2021 as part of its wider digital strategy.[3] After three years of negotiation it was adopted in 2024. The European Parliament describes it as the world’s first set of comprehensive rules on artificial intelligence.

02 · When each rule takes effect.

The roll-out is phased.
Some of it has already started.

1
2 February 2025 · Bans and AI literacy duties · in force
The “unacceptable risk” bans came into effect. Emotion-recognition AI in workplaces prohibited. AI literacy training obligations begin for all deployers.[1, 4]
2
2 August 2025 · General-purpose AI model rules · in force
Rules for large foundation models (the kind underlying most AI products) begin. Providers of these models must comply with new transparency and safety requirements.[1]
3
2 August 2026 · Main high-risk rules and transparency obligations · 10 weeks away
The full set of rules for high-risk AI systems applies. This is the deadline that catches most hiring tech. Deployers must have human oversight, logging, bias monitoring and candidate transparency in place.[1, 4]
4
December 2027 (proposed) · Possible extension under Digital Omnibus · not finalised
A “Digital Omnibus” package published by the European Commission in November 2025 could push some high-risk obligations back to December 2027. This has not yet been finalised. Do not plan around it.[5, 6]
03 · The question everyone asks.

Does Brexit protect UK firms? No.

The Act has extraterritorial scope. Like GDPR, it applies based on where the AI’s output lands, not where the company is based.[7, 8]

The border is not a firewall

The border is not a firewall. If the output affects someone in the EU, the Act applies.

Who is in scope · if any of these apply to you, you are caught
  • You place AI on the EU market
  • You distribute AI in the EU
  • You use AI whose outputs affect people in the EU[8]
  • Your AI model outputs are intended for use in the EU[9]
The penalties · they match GDPR for seriousness
  • Up to €35 million or 7% of global annual turnover for the worst breaches, whichever is higher[8, 10]
  • For SMEs: the lower of the two figures applies
  • The UK itself has no single domestic AI law; existing regulators apply current rules[11]
UK firms with any EU exposure should treat the EU Act as the binding standard. Waiting for a domestic UK law is not a compliance strategy. The Com'mon People’s read
04 · The bit that matters most to you.

This is where the Act bites hardest: recruitment.

Annex III, Point 4 of the Act explicitly classifies AI used in employment as high-risk. It is not ambiguous.[12, 13]

Classified as high-risk no exceptions

Placing targeted job advertisements · Analysing and filtering job applications (CV screening) · Evaluating and scoring candidates · Shortlisting and ranking · Decisions on promotion, termination, task allocation · Performance monitoring

Practically, this means AI-assisted CV parsing in an ATS, automated candidate ranking, AI-scored video interviews and AI sourcing tools are all captured.[14, 15]

A lone figure climbs a monumental concrete staircase toward white-purple light - five deliberate steps upward

Every ATS with an AI layer. Every ranking algorithm. Every video-interview scoring tool. High risk by default.

Already banned since February 2025 stop using these now

Emotion-recognition AI in the workplace including in interviews falls under the prohibited category. Tools that claim to read a candidate’s personality, sentiment or emotional state from a video are banned. If you are using one, the ban is not August 2026. It was February 2025.[16]

05 · Two roles. Two sets of obligations.

Your vendor being compliant does not make you compliant.

The Act splits responsibility between the provider (the company that builds the AI tool) and the deployer (the company that uses it). A vendor’s compliance does not discharge your own duties as a deployer.[13, 17]

Provider · your ATS vendor, your video platform, your sourcing tool
  • Must register high-risk systems in the EU database
  • Must provide technical documentation to deployers
  • Must conduct conformity assessments
  • Must implement quality management systems
  • Must enable logging capability
Deployer · you, the agency, the in-house recruiter, the hiring manager
  • Human oversight: a competent human must be able to review and override AI decisions
  • Transparency to candidates: applicants should be told when AI is used
  • Record-keeping: system logs retained as required
  • Bias monitoring: ongoing checks for discriminatory outcomes
  • AI literacy: staff using tools must understand them[13, 14, 18]
Video interview platforms are saying this directly

HeyMilo states that employers are deployers and that vendor compliance does not fulfil employer duties - both parties carry independent legal responsibility.[17] This is the consensus position across the market. Do not expect your vendor to cover you.

06 · The readiness gap is real.

Almost every company uses AI in recruitment.
Almost none are ready.

87%of companies already use AI in recruitment[14]
24%of HR-AI users have started formal compliance preparation[14]
10wksuntil the August 2026 high-risk rules apply

What vendors are doing about it

The provider-deployer split is now standard messaging across the recruitment tech market. Vendors who invested early in transparency, human oversight and bias testing will stand apart from those now retrofitting compliance.[14]

Bias-auditing and retrievable audit trails are becoming product features, not optional extras. Recruiters are being advised to ask suppliers for bias-audit results segmented by protected characteristic, complete and retrievable decision logs and the technical documentation deployers need to meet their own obligations.[14, 19]

Carv, a volume-hiring AI platform, frames it commercially: recruitment leaders need to reassess AI software providers against new compliance, transparency and risk-management standards.[20] This is the correct framing. Choosing a recruitment AI tool is now a governance decision, not a buying decision.

07 · What to do about it.

Five practical steps.
One of them is already overdue.

Solicitor Ross Saunders recommends starting with an AI inventory of the hiring process: what tools are in use, what decisions they touch and which fall under high-risk.[18] That is step one.

1
Inventory every AI tool in your hiring process.
Include AI features that have been quietly added to existing ATS, sourcing and assessment platforms since you originally signed the contract. Many tools now have AI layers that were not there 18 months ago.[21]
2
Classify each tool under the Act’s risk bands.
If it influences who gets hired, assume high-risk until proven otherwise. CV screening, ranking algorithms, video interview scoring, sourcing tools: all high-risk by default under Annex III.[12]
3
Stop using prohibited tools now. This deadline has passed.
Anything doing emotion or sentiment recognition on candidates in interviews, or in the workplace, has been banned since 2 February 2025. The August 2026 deadline does not apply here.[16]
4
Update vendor contracts.
Require the technical documentation, bias-audit evidence segmented by protected characteristic and logging access you’ll need as a deployer to evidence your own compliance. A vendor that cannot supply this is a liability.[14, 19]
5
Train your team. AI literacy is already a legal duty.
This obligation came into force on 2 February 2025, not August 2026. Staff who use AI tools in hiring decisions must have sufficient understanding of what those tools do, how they reach conclusions and where they can go wrong.[4, 18]
The Act is shifting AI in recruitment from a buying decision to a governance decision. The vendors that thrive will be the ones who make it easy for clients to evidence compliance, not just deliver features. The agencies and in-house teams that thrive will be the ones who treated August 2026 as a deadline to meet, not a line to watch from a distance. The common thread

Sources & references · 21 cited, every claim referenced

  1. European Commission, AI Act digital-strategy.ec.europa.eu
  2. European Commission, Navigating the AI Act FAQ
  3. European Parliament, EU AI Act: first regulation on artificial intelligence
  4. EU AI Act portal, Implementation timeline artificialintelligenceact.eu
  5. Orrick, EU’s Digital Omnibus on AI: 7 Key Changes (May 2026)
  6. Legal Nodes, EU AI Act 2026 Updates (April 2026)
  7. ISMS.online, Does the EU AI Act Apply to the UK? 2026 Guide
  8. Farrer & Co, The EU AI Act what does it mean for UK organisations (Feb 2026)
  9. PwC UK, EU AI Act
  10. Augment Code, The 2026 EU AI Act (citing Article 5 fines)
  11. SnapGRC, EU AI Act: What UK Businesses Need to Know (March 2026)
  12. EU AI Act portal, Annex III: High-Risk AI Systems
  13. Hunton Andrews Kurth, The Impact of the EU AI Act on Human Resources Activities
  14. IntervueBox, AI Hiring Tools at Risk: 6 Critical EU AI Act Steps (2026)
  15. Knowlee, AI Act Annex III HR & Employment (2026)
  16. Ross Saunders (solicitor), The EU AI Act and Recruitment (2026)
  17. HeyMilo, How the EU AI Act Changes Recruitment (updated April 2026)
  18. Ross Saunders, The EU AI Act is already in your hiring pipeline
  19. College Recruiter, How the EU AI Act impacts graduate hiring (April 2026)
  20. Carv, The EU AI Act and Its Impact on Recruitment
  21. Vista InfoSec, EU AI Act Compliance Checklist (2026)

Article current as of May 2026. The EU’s proposed Digital Omnibus may change some high-risk deadlines check current guidance before acting.