Contents6
On 27 July 2026, the entry into force of Regulation (EU) 2026/1744 postponed to 2 December 2027 the AI Act rules on high-risk AI used to recruit, manage staff or grant credit. As of 20 October 2026, a little over thirteen months remain. That is not much when the tool in question is software you choose, configure and roll out before you use it.
This article in our Business AI section is based on the consolidated text of the regulation and on the Commission’s draft guidelines. It is not legal advice: to classify a specific use, your DPO or a lawyer has the final say. The full picture of obligations is in our AI Act and GDPR guide for small businesses.
In short
Two dates: 2 December 2027 for Annex III uses (recruitment, staff, credit, insurance), 2 August 2028 for AI built into regulated products.
The guidelines that will say precisely what is high-risk are still a draft, published on 19 May 2026.
A business that uses such a tool will have to ensure human oversight, keep the logs and inform its employees.
The GDPR already applies, and a tool chosen in 2027 will be in service when the new rules arrive: guarantees are negotiated now.
When do the high-risk rules apply?
The consolidated Article 113 sets two dates, which replace those of the original text (2 August 2026 and 2 August 2027):
- 19 May 2026
The Commission publishes its draft guidelines on classifying high-risk systems.
- 23 July 2026
The consultation on the draft closes.
- 27 July 2026
Regulation (EU) 2026/1744 enters into force and postpones the high-risk dates.
- 2 December 2027
The rules apply to Annex III uses (recruitment, staff, credit, insurance, education, biometrics).
- 2 August 2028
They apply to AI that is a safety component of a regulated product (medical device, toy, lift).
The consultation date is the one given by the law firm Osborne Clarke. The postponement itself is detailed in what the Digital Omnibus changed in the AI Act.
Which business uses are high-risk?
Annex III lists eight areas. For a private business, five uses come up most often:
- Recruiting: publishing targeted job ads, analysing and filtering applications, evaluating candidates.
- Managing staff: deciding on a promotion or dismissal, allocating tasks based on behaviour or personality, monitoring and evaluating performance.
- Granting credit: assessing a person’s creditworthiness or setting their credit score, except for detecting financial fraud.
- Insuring: assessing risk and setting the price of life or health insurance for a person.
- Training: deciding on access to vocational training or assessing what a person has learned there.
Biometrics (categorising people, emotion recognition) is also on the list. In every case, these are decisions that affect natural persons: a tool that scores business customers or sorts support tickets is not covered on that basis.
Is my use really high-risk?
Falling within an Annex III area is not always enough. Article 6 provides an exception for systems that do not materially influence the decision. The reasoning has four steps:
- The area.
Is the use listed in Annex III? If not, the high-risk rules do not apply.
- Profiling.
Does the system evaluate people from their data (profiling)? If so, it remains high-risk, with no exception possible.
- The role in the decision.
If it is limited to a narrow procedural task, improves the result of human work already done, detects deviations without replacing human assessment, or prepares an assessment, it may fall outside high risk.
- The evidence.
A provider that considers its system outside high risk must document its assessment before placing it on the market, and hand it to the authorities on request.
Step 2 carries a lot of weight: according to Osborne Clarke’s analysis, recruitment and credit tools usually perform profiling, which often closes the door to the exception. The guidelines, which Article 6 required the Commission to publish by 2 February 2026, are still presented as a draft on their page, last updated on 23 July 2026.
What a business using the system will have to do
The AI Act calls the business that uses a system under its own authority a “deployer”. Article 26 requires it in particular to:
- Use the system according to its instructions and monitor how it works.
- Assign human oversight to people who have the necessary competence, training and authority.
- Keep the logs generated by the system for at least six months.
- Inform workers’ representatives and the employees concerned before using the system in the workplace; in France, this goes through the works council (CSE).
- Report a risk or a serious incident to the provider and the authority, and suspend use if needed.
Businesses that score credit or price life and health insurance must also carry out a fundamental rights impact assessment (Article 27). And in France, the authority that will supervise all this has not yet been designated: the bill gives employment uses to the CNIL, as explained in who enforces the AI Act in France.
Why not to wait for December 2027
Thirteen months leave time to do things well, not to do everything in the last quarter. Four reasons to start now:
- The GDPR already applies. Its Article 22 governs fully automated decisions that produce legal or similarly significant effects, such as rejecting a job application or a loan. The issues are covered in AI deciding on a dismissal or a loan.
- Tools are chosen before they are used. Recruitment software selected during 2027 will be in service when the rules arrive. The contract is the moment to obtain the vendor’s instructions, logs and compliance plan, not afterwards.
- The inventory serves everything. Knowing which tools affect people, and which ones decide on their own, serves the GDPR, the AI Act and security. It is the first step of our AI governance guide, as of our guide to integrating AI in a business.
- Human oversight takes organising. Deciding who validates, with what training and what authority, takes time in a team of 20 to 500 people; it is also what makes the decision defensible, as shown in the human role in AI judgment.
Watch out
Article 111 provides that a high-risk system put into service before 2 December 2027 is only subject to the new rules if its design is significantly changed afterwards. That is no reason to wait: what this exception means for online software that is updated continuously is a question for your legal adviser, and it covers neither the GDPR nor the obligations already in force.
From the field
Human oversight is not a formality; we have seen it on a site we run. Palmora Property, a property portal, learned it the hard way: an AI model published articles there presenting three property developments that did not exist, since unpublished (internal finding, on our own work for this client, recorded in our service catalogue). Since then, nothing a model produces goes out there without a person who reads and approves it. Screening job applications deserves at least as much care as a blog post.
Date to remember: 2 December 2027. The other deadlines, from the marking of generated content on 2 December 2026 to Annex I in 2028, are in our AI regulation calendar. To take stock of your uses and spot those that come close to high risk, our AI at the right cost offer starts from the tools you actually use.
Frequently asked questions
When do the AI Act rules on high-risk AI apply?
On 2 December 2027 for Annex III uses, including recruitment, staff management, credit scoring and life and health insurance, and on 2 August 2028 for AI that serves as a safety component of a regulated product. These dates result from Regulation (EU) 2026/1744, in force since 27 July 2026.
Is CV screening software high-risk AI?
In principle, yes: analysing and filtering job applications is listed in Annex III. The Article 6 exception does not apply if the software performs profiling, which is common for this type of tool. The Commission’s final guidelines, still in draft, will clarify borderline cases.
What must a business using high-risk AI do?
From 2 December 2027: use it according to its instructions, assign human oversight to trained people, keep the logs for at least six months, inform workers’ representatives and the employees concerned, and report serious incidents. The GDPR already applies in the meantime.
Should you wait for the Commission’s guidelines before preparing?
No. The draft of 19 May 2026 already gives the method, and an inventory of the tools that affect people is useful whatever the final text says. The guidelines will clarify borderline cases; they will not change the Annex III list, which is set by the regulation.
Sources
- Consolidated Article 113 (new tab)ai-act-service-desk.ec.europa.eu
- The law firm Osborne Clarke (new tab)osborneclarke.com
- Annex III (new tab)ai-act-service-desk.ec.europa.eu
- Article 6 (new tab)ai-act-service-desk.ec.europa.eu
- Still presented as a draft (new tab)digital-strategy.ec.europa.eu
- Article 26 (new tab)ai-act-service-desk.ec.europa.eu
- Article 27 (new tab)ai-act-service-desk.ec.europa.eu
- Article 111 (new tab)ai-act-service-desk.ec.europa.eu
Jim · founder of Brain Plus AI
Also in business ai
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.
Stepping back8 min
Automated decisions: can AI decide on its own?
An algorithm may be more consistent than a manager in a hurry, but a decision that affects a person's life has to be explainable and open to challenge. The law leans clearly one way: the two positions, our view, and the rule to adopt without waiting for 2027.