If you have been tracking the EU AI Act's August 2, 2026 compliance deadline - the one that put every résumé screener, candidate ranking tool, and AI interview platform on a formal enforcement clock - here is the headline: the deadline moved. The Annex III high-risk obligations that most enterprise HR teams were preparing for will not apply until December 2, 2027.
But today was not a quiet day. Two categories of EU AI Act obligations went live regardless of the delay. Understanding the line between what changed and what did not is now the most important regulatory task on every TA leader's desk.
What the EU Digital Omnibus Did
Regulation (EU) 2026/1744 - known as the Digital Omnibus on AI - entered into force on July 27, 2026. It postponed the full high-risk compliance obligations for standalone Annex III AI systems by 16 months, from August 2, 2026 to December 2, 2027.
The EU legislative process here was methodical: the European Commission initiated the Omnibus proposal on November 19, 2025; the European Parliament endorsed it on June 16, 2026; the Council gave its final approval on June 29, 2026. It became law one week before today's original deadline.
What the Omnibus deferred is the full compliance stack for Annex III high-risk systems: conformity assessments, quality management systems, technical documentation, CE marking, and registration in the EU's AI database. These were the requirements that had enterprise HR tech vendors running gap analyses and legal teams issuing quarterly alerts. Those obligations are now on a December 2027 timeline.
What the Omnibus did not do is eliminate those requirements. The architecture is unchanged. You now have 16 months to prepare instead of having missed the original date.
What Did Not Get Delayed
Two significant obligations took effect today and are in force now.
Article 50 transparency obligations are live as of August 2, 2026. These apply to any AI system that interacts directly with people or generates synthetic content. If your company uses AI-powered chatbots to conduct initial candidate screening, those bots must disclose that they are AI. If your hiring platform generates AI-written interview feedback, candidate summaries, or job-fit assessments, those outputs must be labeled. If your careers page uses a chat widget powered by a large language model, the disclosure requirement applies.
This is not a December 2027 problem. It is a today problem. A violation of Article 50 carries a penalty ceiling of 15 million euros or 3% of total worldwide annual turnover, whichever is higher.
GPAI enforcement powers switched on today. The AI Office and national competent authorities now have active enforcement power over general-purpose AI model providers. More concretely for employers: the companies whose foundation models power many HR tech platforms are now subject to active Commission enforcement. The first questions to send to your AI hiring vendors are these: What model underpins this product? Has that model met the EU AI Act's GPAI documentation and transparency requirements? Get the answers in writing.
Which Tools Are Covered When December 2027 Arrives
The Act's definition of high-risk employment AI covers more ground than most HR teams have been briefed on. Any AI system that makes or meaningfully contributes to decisions about:
- Recruitment and candidate selection (résumé screening, applicant ranking, automated sourcing)
- Hiring decisions (score-based candidate filtering, offer recommendations, background check integration)
- Performance evaluation (automated productivity scoring, attendance monitoring, output tracking)
- Promotion or task allocation (internal mobility algorithms, shift assignment, project team selection)
- Contract termination (attrition risk flagging, dismissal recommendation engines)
...is a high-risk Annex III system under the Act. Read that list carefully. It is broader than what most HR tech vendors have communicated to their clients. If a tool influences who gets interviewed, who gets hired, or who gets managed out, it qualifies.
The Act also has extraterritorial reach. You do not need to be a European company to be covered. If you use AI hiring tools to make decisions about EU-based job candidates or EU-based employees, the Act applies to your organization.
The Provider-Deployer Divide
The EU AI Act divides responsibility between providers - the companies that build and sell AI systems - and deployers - the organizations that run them in their employment processes. Both carry obligations.
If you are using an off-the-shelf AI résumé screener, you are a deployer. By December 2, 2027, deployers must:
- Conduct a fundamental rights impact assessment before putting high-risk AI into production for hiring decisions
- Ensure genuine human oversight - a documented, auditable review process where a human can understand why the system made a recommendation and can meaningfully override it
- Maintain usage logs for at least six months
- Inform affected candidates and workers that AI is being used to make or influence decisions about them
Two things are worth noting here. First, the "we bought the tool, not our problem" defense is already dead in U.S. courts - U.S. District Judge Rita Lin's March 2026 ruling in Mobley v. Workday established that employers who deploy AI screening tools can be held jointly liable alongside vendors. EU law is equally explicit on shared responsibility. Second, "human oversight" under the Act means a real review process, not a recruiter glancing at a ranked list before clicking approve. Build the workflow, not just the policy.
How to Use the 16 Months
Audit your AI hiring stack now, not in late 2027. Run an inventory of every tool that touches hiring decisions. For each one, ask the vendor: Is this an Annex III high-risk system under the EU AI Act? What conformity documentation exists? If a vendor cannot answer those questions today, that tells you something about whether they will be compliant in 16 months.
Fix the Article 50 violations that are already live. Check whether any of your AI-powered recruiting tools interact with candidates without disclosing their AI nature. This includes career site chatbots, automated screening calls, and AI-generated feedback sent to candidates. The disclosure copy fix is low effort. A 15-million-euro penalty is not.
Ask your vendors for written GPAI compliance representations. The AI Office can now enforce GPAI obligations. Ask every AI hiring vendor what model powers their product, whether that model has met EU AI Act documentation requirements, and for a written statement of their compliance roadmap. If a vendor hedges or has no published EU AI Act readiness plan, factor that into your renewal decision.
Build the human oversight workflow now. This is the compliance requirement that takes the longest to build and the one most commonly deferred. Standing up a documented, auditable human review process for AI hiring decisions requires internal alignment across recruiting, legal, and HR ops. Organizations that wait until Q4 2027 to start will be building under deadline pressure.
Start logging AI hiring decisions today. The six-month log requirement does not formally apply until December 2027, but starting the logging practice immediately means you have a functional system and a data record when the deadline arrives - rather than building from zero.
The Direction of Travel
The 16-month delay is real. It is also not an invitation to defer serious compliance work. The EU AI Act is not the only regulatory pressure on AI hiring tools: New York City's Local Law 144, Colorado's AI employment rules, California's pending legislation, and Illinois regulations are all in play. The trend across jurisdictions is consistent - AI in employment decisions must be disclosed, audited, and subject to genuine human oversight.
Companies that use the reprieve to build compliant documentation, oversight processes, and vendor accountability structures will have a significant advantage when December 2027 arrives. Companies that treat it as another deadline to punt will find themselves in the same position they were in this week: reading a deadline extension they should have spent preparing for.
The deadline moved. The requirements did not.
BlueLine's platform is built to give recruiters a clear, auditable record of every hiring decision. Start for free at /register.