On March 13, 2026, the EU Council formally postponed high-risk AI Act obligations from August 2, 2026 to December 2, 2027 (and August 2, 2028 for embedded AI systems). Most CTOs we talk to read that announcement and quietly exhaled. They shouldn't have.
Compliance for high-risk AI systems takes 12–18 months to build properly. Bias testing protocols alone take 6 months of data to validate. The companies that wait until Q3 2027 will be the ones panicking. The companies that move now will be the ones quietly winning enterprise contracts in 2027 because their compliance posture is already in place.
This is the 12-point checklist we'd want if we were starting today.
Why the delay is a trap, not relief
The official rationale for the postponement (EU Digital Omnibus, March 2026): the technical infrastructure to support compliance — specifically, the harmonized standards from CEN/CENELEC — isn't ready. Companies couldn't comply even if they wanted to, because the standards they need to comply against don't exist yet.
What the delay does NOT change:
What the delay DOES change:
The smart move is to build a compliant foundation now and refine it as standards crystallize. Not to wait.
The 12-point compliance checklist
1. Inventory all AI tools used in hiring
Most companies underestimate this. Beyond the obvious (ATS, video interview platforms), check:
If it processes candidate data and produces a score, ranking, or recommendation, it's in scope.
2. Classify each tool against Article 6 (high-risk criteria)
Article 6 + Annex III defines AI in employment as high-risk when used for:
Most hiring AI is high-risk. Some peripheral tools (purely administrative chatbots, basic resume formatting) may not be. Document the classification reasoning for each tool.
3. Risk management process (Article 9)
A documented process showing you've:
For each AI tool, write a 1-page risk register. It should not be your only documentation — but it's a starting point.
4. Data governance and quality (Article 10)
The AI you use must be trained on data that is "relevant, representative, free of errors, and complete." For most buyers, this means:
If your vendor can't answer these questions, that's a red flag.
5. Technical documentation (Article 11)
Annex IV lists 9 categories of required documentation. The condensed version:
Vendor should provide this. You should keep a copy for your records.
6. Record-keeping / logging (Article 12)
The AI system must automatically log events. For hiring:
Retention period: minimum 6 months, ideally 5+ years for hiring decisions (matches GDPR statute of limitations for discrimination claims).
7. Transparency and information to candidates (Article 13)
Candidates must be informed before AI evaluation begins:
This needs to be clear, not buried in a privacy policy. A simple consent screen at the start of the interview meets the bar.
8. Human oversight design (Article 14) — the real one
This is where most vendors fake compliance. "Human in the loop" is not enough if the human is rubber-stamping AI decisions without context.
Real human oversight requires:
Recruo's model: every shortlist is reviewed and signed off by a human recruiter before delivery to the client. AI is a recommendation engine, not a decision-maker.
9. Accuracy, robustness, cybersecurity (Article 15)
Documented metrics on:
10. Conformity assessment + CE marking
For high-risk AI, you (or the vendor on your behalf) must complete a conformity assessment. Two routes:
Once passed, the system gets a CE marking and is registered in the EU AI database.
Standards aren't fully ready yet (which is why the delay happened). Track CEN/CENELEC progress quarterly.
11. Post-market monitoring
Once deployed, ongoing monitoring of:
12. Vendor due diligence
The 5 questions to ask any AI hiring vendor:
If the vendor can't answer 4 of 5 confidently, you have a vendor risk problem.
Common gotchas we see on calls with CTOs
"Our vendor said they're compliant."
Most don't yet have CE marking — because the conformity assessment standards aren't ready. "Compliant" is currently a marketing claim, not a regulatory one. Ask for the documentation, not the claim.
"We're using a US tool, so EU AI Act doesn't apply."
Wrong. The Act applies based on where the AI is used and where its outputs are used, not where the vendor is incorporated. If your candidates are in the EU or your hiring decisions affect EU candidates, you're in scope.
"GDPR compliance covers us."
GDPR and the AI Act are complementary but separate. GDPR is about data; AI Act is about the AI system itself. You need both.
"We'll deal with it closer to December 2027."
By then, every enterprise procurement RFP will require AI Act compliance documentation. You don't want to be assembling it under deadline pressure while losing deals.
Practical next steps for the next 30, 60, 90 days
Days 1–30: Audit and inventory
Days 31–60: Documentation and vendor contracts
Days 61–90: Bias testing + human oversight SOPs
By day 90, you'll have a compliance foundation that can absorb whatever the final standards look like — without a fire drill.
How Recruo handles this
Our model is human-in-the-loop by design. Every shortlist is reviewed and signed off by a human recruiter before delivery. We document AI outputs, retain audit logs for 5+ years, run quarterly bias audits, and publish a compliance checklist with each engagement.
We are not a vendor selling a black-box AI tool. We're an agency where AI is a screening tool and humans own every shortlist decision. That maps directly onto what the EU AI Act requires — not something we added after the fact.
If your team is building or auditing AI hiring compliance, book a 30-min compliance review — we'll share what we've built and the templates we use. No sales pitch required.