EU AI Act HR Compliance: 10 Actions Every HR Leader Must Take Before August 2026

The EU AI Act is not pending – it is enforced. August 2026 marked full applicability of the high-risk AI system requirements covering employment AI. Organizations that have not completed the compliance actions listed here face penalties of up to €15 million or 3% of global annual turnover.

This is a specific EU AI Act requirements action list for HR leaders, not a conceptual overview. Each item below is a deliverable your organization must produce or implement.

1. Classify Your HR AI Systems

Determine which AI systems in your organization fall under the Act’s high-risk employment category. Employment AI subject to full compliance requirements includes systems used in recruitment screening and ranking, promotion decisions, performance evaluation, task allocation, and ongoing work monitoring. Classification determines the full scope of obligations that apply to each system.

2. Register High-Risk Systems in the EU AI Database

All high-risk AI systems must be registered in the EU AI public database before deployment. Registration requires a system description, intended purpose, risk management documentation, and a designated responsible person. Non-registration is itself a violation regardless of whether the system is otherwise compliant.

3. Complete Annex IV Technical Documentation

Produce the technical documentation required by Annex IV of the Act. Required documentation includes: general system description, intended purpose, version history, system interaction documentation, training data description, validation and testing methodology, accuracy metrics by demographic group, and known risk documentation. This documentation must be maintained and updated as the system changes.

4. Implement a Risk Management System

Document a continuous risk management process covering risk identification and analysis, risk evaluation, mitigation measures, and residual risk assessment. This process must be revisited when the system is updated and at minimum annually. A risk management system is not a one-time deliverable – it is an ongoing operational function.

5. Document Data Governance Practices

For each HR AI system, produce a complete data governance record covering training data sources and collection methodology, validation and testing data sets, bias examination results, data retention and deletion practices, and cross-border data transfer mechanisms. This documentation is a distinct requirement from your organization’s general data protection records.

6. Establish Human Oversight Procedures

Designate trained oversight personnel for each high-risk HR AI system. Document their training, their authority to override system outputs, and the escalation procedures that apply when overrides occur. Maintain logs of all override events. Human oversight in AI-powered recruiting is an operational procedure with named personnel and documented authority – not a policy statement.

7. Implement Candidate Transparency Mechanisms

Build the operational workflows that honor candidate rights under the Act: disclosure that AI is being used, explanation of the AI’s role in the decision, the right to request human review, and the ability to contest automated decisions. These workflows must be operationally functional – a disclosure buried in a privacy policy does not satisfy this requirement.

8. Conduct Fundamental Rights Impact Assessment

Before deploying or continuing to operate high-risk HR AI, complete a documented assessment of potential impacts on candidates’ and employees’ fundamental rights. The assessment must address equality and non-discrimination, data protection, and access to employment. This is a deployer obligation – your AI vendor’s assessment does not satisfy your organization’s requirement.

9. Establish Incident Reporting Procedures

Implement a procedure for identifying and reporting serious incidents involving high-risk HR AI to the relevant national supervisory authority within 15 business days of discovery. A serious incident includes any malfunction causing or risking harm to fundamental rights. The reporting procedure must exist in writing before an incident occurs, not after.

10. Begin Post-Market Monitoring

Deploy continuous monitoring of deployed HR AI performance, tracking accuracy by demographic group, incident rate, human override frequency, and model drift indicators. Document monitoring results and corrective actions taken in response. OpsCare™ maintenance protocols provide the structured monitoring framework that satisfies this ongoing requirement.

Frequently Asked Questions

What is the EU AI Act’s enforcement timeline for HR AI?

The EU AI Act entered into force in August 2024. Prohibited AI practices applied from February 2025. Requirements for high-risk AI systems – including employment and HR AI – became fully applicable in August 2026. Organizations operating high-risk HR AI without compliance architecture face penalties from August 2026 onward.

Who is responsible for EU AI Act compliance for HR AI?

Both AI system providers (vendors) and deployers (the HR organizations using the AI) carry distinct compliance obligations. Providers must deliver technical documentation, conformity assessment, and transparency information. Deployers must implement human oversight, maintain records of use, report incidents, and conduct fundamental rights impact assessments. Compliance is a shared responsibility – you cannot outsource your deployer obligations to the vendor.

Does the EU AI Act apply to US-based companies hiring EU candidates?

Yes. The EU AI Act applies to organizations deploying AI systems that affect people in the EU, regardless of where the deploying organization is based. A US company using AI to screen applications from EU residents is subject to the Act’s deployer requirements for those screening activities.