What is the EU AI Act? Employer compliance guide for hiring and HR

The world’s first comprehensive AI law is here, and it affects more companies than you might think.

The EU AI Act entered into force on August 1, 2024, and it’s already changing how businesses worldwide use AI.

Here’s what matters:

• It applies globally: Not just EU companies. If your AI outputs are used in the EU, you’re affected
• It uses a risk-based approach: Four risk categories: prohibited, high-risk, limited risk, and minimal risk
• First deadlines have passed: Prohibited AI practices are banned as of February 2, 2025
• Major deadlines ahead: High-risk AI requirements kick in August 2, 2026
• Penalties are serious: Up to €35M or 7% of global revenue
• Compliance takes time: Start now if you haven’t already

On August 1, 2024, history was made. The European Union’s Artificial Intelligence Act officially entered into force, making it the world’s first comprehensive legal framework specifically designed to regulate AI systems.

But this isn’t just another EU regulation that only affects European companies. This is a game-changer that’s reshaping how organisations worldwide develop, deploy, and use artificial intelligence.

The EU AI Act has extraterritorial reach. It applies to two main groups:

The EU AI Act doesn’t treat all AI the same way. Instead, it takes a risk-based approach, categorising systems into four tiers based on their potential to cause harm.

Some AI applications are considered so dangerous to fundamental rights that they’re completely prohibited.

As of February 2, 2025, these practices are now illegal in the EU:

• Social scoring systems: Government or corporate systems that rank people based on behaviour or characteristics
• Subliminal manipulation: AI that influences behaviour without people’s awareness or consent
• Exploiting vulnerabilities: Systems targeting people based on age, disability, or economic situation
• Biometric categorisation: Using biometrics to infer race, political opinions, religious beliefs, or sexual orientation
• Untargeted scraping: Building facial recognition databases from the internet or CCTV without consent
• Real-time biometric surveillance: Live facial recognition in public spaces (narrow law enforcement exceptions exist)
• Emotion recognition in workplaces or schools: Using AI to judge how workers or students “feel”
• Predictive policing: Profiling individuals to predict criminal behaviour without evidence

The penalty: Up to €35 million or 7% of global annual turnover, whichever is higher.

These systems can potentially cause significant harm if they fail or are misused. They’re legal but come with extensive compliance requirements.

Common high-risk AI systems include:

• Critical infrastructure: Managing electricity, water, gas, or transportation systems
• Employment & HR: Recruitment screening, performance evaluation, promotion decisions, work allocation
• Education: Automated exam scoring, assessment of learning progress, admission decisions
• Essential services: Credit scoring, insurance risk assessment, eligibility for public assistance
• Law enforcement: Evidence analysis, case prioritisation, polygraph tools
• Border control & migration: Visa processing, asylum evaluation, risk assessment
• Healthcare: Diagnostic systems, treatment recommendations, triage and patient prioritisation
• Biometric systems: Identification and categorisation with proper safeguards

Example: An AI recruitment tool that screens CVs and ranks candidates is high-risk. It requires robust documentation, bias testing, human oversight, and ongoing monitoring.

Users must know they’re interacting with AI (unless it’s obvious).

Covered systems:

• Chatbots and conversational AI
• Deepfakes and AI-generated content
• Emotion recognition (outside prohibited contexts)
• Content recommendation systems

Requirements:

• Clear disclosure of AI interaction
• Marking AI-generated content as such
• Machine-readable watermarks for synthetic media

Most AI falls into this category. These systems face no specific obligations beyond making sure that employees understand AI basics.

Examples:

• Spam filters
• AI-powered video games
• Inventory management systems
• AI-assisted design tool

If your AI system falls under the high-risk category, the EU AI Act sets out strict compliance steps before deployment. Think of it as a due diligence checklist for trustworthy AI.

Key obligations for high-risk AI:

• Risk management system: Identify, assess, and mitigate risks throughout the AI lifecycle.
• Data governance: Use high-quality, representative, and bias-tested datasets.
• Technical documentation: Maintain detailed records of how the system works, its purpose, and its limitations.
• Transparency and user information: Clearly describe system capabilities and limitations to users.
• Human oversight: Ensure trained personnel can intervene or override AI decisions.
• Accuracy, robustness, and cybersecurity: Regular testing and monitoring to prove reliability.
• Registration in the EU database: All high-risk systems must be listed publicly.

Most of these requirements mirror existing compliance processes under GDPR, product-safety, or medical-device regimes, but they now explicitly extend to AI.

The EU AI Act’s penalties are deliberately severe (similar to GDPR) to ensure companies take it seriously:

Regulators can also suspend or recall non-compliant systems from the EU market.

If you use AI for anything touching people’s decisions, from hiring to performance evaluation, you’re directly affected. Recruitment platforms, CV screeners, and internal analytics tools all fall under the high-risk AI category.

Employers must:

• Audit existing HR tools to confirm whether AI is involved.
• Ask vendors for AI Act compliance documentation (technical files, bias tests, human-oversight procedures).
• Train HR teams to understand AI limitations and avoid over-reliance on automated outputs.
• Establish accountability: Designate who is responsible for AI compliance in your organisation.

The best rule of thumb is to use AI to help people, not to replace or judge them. The systems that will stand the test of time are those built and used responsibly.