May 2026 – On 7 May 2026, the European Parliament and Council reached a political agreement to postpone the application of key obligations for high-risk AI systems under the EU AI Act. For standalone systems, including many HR and recruitment tools, the deadline is expected to move from 2 August 2026 to 2 December 2027.
The European Parliament and Council must now formally adopt the political agreement.
This is a welcome development for many organisations. It recognises that the compliance framework is still maturing, but it should not be misunderstood. The extension affects timing, not substance. The underlying legal and operational expectations remain unchanged.
Several of the AI Act’s most important provisions are already in force. Since 2 February 2025, certain AI practices have been prohibited outright, including the use of emotion recognition systems in the workplace. For most employers, no relevant exception applies. At the same time, organisations must ensure that staff and other persons dealing with the operation and use of AI systems have an appropriate level of understanding and training. While the obligation to take measures to ensure AI literacy of staff already applies, the supervision and enforcement rules apply from 2 August 2026. This date will most likely not change as a result of the current agreement.
In other words, compliance is not something that starts in 2027. It is already underway.
AI is embedded in HR today
For most large employers, AI is already part of day-to-day HR operations. Systems are used to filter applications, assess candidates, analyse performance, and support workforce planning. Many of these tools will fall within the AI Act’s definition of “high-risk” systems, particularly where they influence recruitment, employment conditions, or termination decisions.
The scope is deliberately broad and includes both standalone tools and AI driven features within existing HR systems. In practice, this is where many organisations face exposure. It is still common to see AI functionality deployed without formal classification or structured governance. The revised deadline does not change this. It simply gives more time to address it.
What high-risk status requires
Once a system is classified as high-risk, the obligations are operational and extensive. Employers acting as “deployers” must, among other things:
- ensure use in accordance with provider instructions;
- implement effective human oversight by trained personnel;
- verify data quality and relevance;
- monitor system performance and suspend use where risks arise;
- retain logs for at least six months; and
- inform employees and their representatives of deployment.
These requirements demand coordination across functions and clear internal accountability. Where organisations develop or significantly modify their own systems, they may take on the more onerous role of a provider, with additional obligations relating to risk management and documentation.
Cross-border complexity
For multinational employers, compliance is further complicated by two structural factors.
First, the AI Act has extraterritorial reach. If an AI system affects individuals in the EU, it is within the scope of the Act, regardless of where the system is developed or managed.
Second, national labour law requirements continue to apply. In Austria, for example, and across other Member States, the use of AI systems in employment contexts often triggers works council involvement and may require formal agreements before deployment.
Compliance therefore cannot be centralised entirely at the group level. A jurisdiction-specific approach is necessary.
What organisations should do now
The additional time should be used deliberately. The immediate priority is to identify where AI is used within HR functions and to assess whether those systems fall within the high-risk category. At the same time, organisations should establish governance structures, assign responsibility for oversight, and strengthen vendor due diligence.
Engagement with employee representatives should begin early where required. As the new deadline approaches, the focus will need to shift towards formal readiness, including documentation, impact assessments, and internal review processes.
Finally, if not already implemented, organisations should launch a documented AI literacy program.
A final observation
The organisations that will navigate this best are not those who comply at the last moment, but those who use this extension to build governance structures that actually work, not documentation that merely demonstrates compliance. There is a difference, and regulators, works councils, and employees will notice it.
The extension to December 2027 provides valuable runway. It does not provide cover for inaction.