By the Shadow AI Policy team
The EU AI Act is no longer a future problem — its employer-facing rules are already in force, and HR teams using AI for hiring, performance management, or termination decisions are operating in regulated territory right now.
This post covers the five things every HR manager and compliance lead at a small-to-midsize business needs to understand: which AI uses the Act classifies as high-risk, what practices are outright banned, what you must disclose to employees, what AI literacy training you're now required to provide, and how the penalty structure actually works.
The EU AI Act's AI literacy training requirement — Article 4 — has already been in effect since February 2, 2025, which means if your organization operates in or sells into the EU and hasn't trained staff on AI basics yet, you're already behind. Don't wait for a formal enforcement action to treat this as real compliance work.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024. Its provisions have been rolling out in phases since then. As of today, October 13, 2026, here's where things stand:
For most HR and compliance teams at SMBs, the August 2, 2026 date is the one that matters most. That's when the full high-risk AI framework — covering employment AI — became enforceable. If you haven't reviewed your AI tools against Annex III criteria yet, that review is now overdue. Check our AI regulation compliance deadlines tracker for a full timeline of EU AI Act effective dates and what each one requires.
The Act applies to any organization that deploys an AI system affecting people in the EU — not just EU-headquartered companies. If you have employees, contractors, or job applicants based in EU member states, your HR AI tools fall within scope, regardless of where your company is incorporated.
Annex III of the EU AI Act lists the categories of AI systems considered high-risk. Employment and worker management sits explicitly in that list — specifically, AI used for:
If your organization uses AI for any of these functions — including third-party tools embedded in your ATS, HRIS, or workforce management platform — you are a deployer under the Act, and the deployer obligations apply to you even if you didn't build the tool. "We just use the vendor's default settings" is not a compliance defense.
High-risk deployer obligations include conducting a fundamental rights impact assessment before deploying the system, keeping logs of system use, designating a human with authority to override AI-driven decisions, and registering certain systems in the EU's AI database. These aren't aspirational — they're legal requirements that became enforceable on August 2, 2026.
The practical question for SMBs is whether your AI vendor has provided the documentation you need. High-risk AI providers are required to give deployers technical documentation and a conformity declaration. If your vendor can't produce those, that's a red flag — and potentially your liability if the system causes harm.
Title II of the EU AI Act bans certain AI practices outright. These prohibitions have been in force since February 2, 2025 — over a year and a half ago. The banned practices most relevant to employers include:
The emotion recognition ban is the most practically significant for HR teams. Several interview screening tools that were commonly marketed to SMBs analyze facial expressions or vocal patterns to score candidate suitability. As of February 2025, deploying those tools in EU employment contexts is prohibited. If you're still using one, stop.
The EU AI Act creates mandatory transparency obligations for deployers of high-risk AI in employment contexts. Under Article 26(6), deployers must inform workers who are subject to high-risk AI systems — before those systems are deployed — that they will be subject to AI-assisted decision-making. This isn't a checkbox buried in an employment contract; it needs to be a clear, direct notification.
The Act's transparency principle is simple: people have a right to know when a consequential decision about them is being made or influenced by an AI system. Employers who treat this as a technicality to minimize will face the most scrutiny when enforcement actions begin.
Beyond notification, Article 86 (which takes effect August 2, 2027, so still ahead) gives individuals the right to an explanation of decisions made by high-risk AI systems that significantly affect them. Practically, you should build toward that now, because you'll need internal logging and documentation to produce those explanations. For disclosure language you can adapt, see the disclosure and transparency section of our AI acceptable use policy template, which covers EU AI Act Article 50 obligations alongside US requirements.
Note that the EU AI Act's disclosure rules layer on top of — they don't replace — existing GDPR rights. Under GDPR Article 22, employees already have the right not to be subject to solely automated decisions with significant effects, and the right to request human review. The AI Act tightens this further by requiring proactive disclosure before the AI is used, not just remediation rights after the fact.
For a practical comparison of what you need to disclose under each framework, here's how the key obligations stack up:
| Requirement | GDPR (in force) | EU AI Act — Deployer (in force Aug 2026) | EU AI Act — Art. 86 (effective Aug 2027) |
|---|---|---|---|
| Tell workers AI is being used | Implied via data processing notice | Required — proactive, before deployment | Required |
| Right to human review of AI decision | Yes — Art. 22 (solely automated decisions) | Required — human oversight for high-risk AI | Required |
| Right to explanation of AI-driven decision | Limited — Art. 15 access rights | Not yet enforceable | Full right — individual explanations required |
| Fundamental rights impact assessment | DPIA required (Art. 35) | Required — separate FRIA for high-risk AI | Required |
Article 4 of the EU AI Act requires that providers and deployers of AI systems "take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf." This obligation has been in force since February 2, 2025.
The Act doesn't prescribe a specific curriculum or number of training hours. What it does require is that training be proportionate to the role — staff who simply use an AI tool need baseline literacy, while the people who deploy, configure, or oversee high-risk AI systems need substantially deeper training. "We sent a link to an explainer article" is unlikely to satisfy the requirement for anyone in an operational role.
At minimum, an AI literacy program for HR and operations staff should cover:
Document the training. Keep records of who completed it, when, and what was covered. You'll need that documentation if a national supervisory authority asks how you're meeting Article 4. For a starting point on building AI use policies that anchor your training program, the AI acceptable use policy template guide covers what needs to be in writing before you train employees on it.
The EU AI Act's penalty structure is tiered, similar to GDPR's. Under Article 99:
For a 200-person company with €20 million in annual revenue, a 3% penalty is €600,000. These aren't abstract enterprise-scale numbers — they're designed to hurt at SMB scale. The "higher of the two" formulation means larger companies pay more, but the fixed-floor amounts ensure smaller companies can't treat compliance as optional.
Enforcement sits with national competent authorities in each EU member state — similar to how GDPR enforcement runs through Data Protection Authorities. The European AI Office oversees the framework overall and has authority over general-purpose AI models. Member state authorities handle deployer-level enforcement. This means the authority most likely to come after your company for an HR AI violation is the labor or data protection body in the member state where your affected employees are based, not a Brussels-level agency.
Early enforcement is predictably focused on providers of high-risk systems and large-scale deployers. But the GDPR precedent is instructive: initial enforcement against big players established the legal interpretations that were then applied to SMBs. Building compliance now is significantly cheaper than retroactive remediation after a complaint. For a broader look at how shadow AI use in your organization could be creating undisclosed compliance exposure, see our guide on what shadow AI is and why it creates compliance risk.
If you need a consolidated view of where you stand against all the AI compliance deadlines your business is subject to — not just the EU AI Act — use our AI regulation compliance deadlines tracker.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
Yes, if you have employees, contractors, or job applicants located in EU member states. The Act applies based on where the people affected by the AI system are located, not where your company is incorporated. A US-headquartered company using an AI tool to screen EU-based job applicants is a deployer under the Act and subject to the full high-risk AI obligations. The territorial scope (Article 2) is intentionally broad, following the same pattern as GDPR.
No. The EU AI Act's definition of an AI system (Article 3(1)) covers any machine-based system that generates outputs such as recommendations, decisions, or predictions that influence real-world decisions — regardless of how the vendor markets it. If the tool generates a candidate ranking, a fit score, or a flag that affects hiring decisions, it almost certainly meets the definition. Ask your vendor for their conformity documentation under the Act; if they can't produce it, treat the tool as unverified high-risk until proven otherwise.
Before deploying a high-risk AI system in an employment context (which became enforceable August 2, 2026), deployers are required to: conduct a fundamental rights impact assessment, notify workers before the AI is used to evaluate them, ensure a human with authority to override decisions is in the loop, keep logs of system use, and verify that the AI provider has supplied technical documentation and a conformity declaration. You also need to have completed baseline AI literacy training under Article 4. These aren't sequential — most need to be in place before the system goes live.
The two frameworks overlap but aren't redundant. GDPR Article 22 already restricts solely automated decisions with significant effects on individuals, and GDPR Article 35 requires Data Protection Impact Assessments for high-risk processing. The EU AI Act adds a separate layer: a Fundamental Rights Impact Assessment (FRIA) specific to the AI system, proactive disclosure obligations before deployment (not just in a privacy notice), and human oversight requirements that go beyond GDPR's right to contest. In practice, run both assessments for any employment AI tool. A DPIA alone no longer covers your obligations.
Free tool: See the AI regulation deadline tracker → Each compliance date marked as verified, or not, against the enacted text.
Tailored to your industry and the AI tools your team uses. Free preview, then $149/mo to keep it current as the rules and vendor terms change — or $79 for a one-time snapshot.
Generate my policy kit →Writing policies for several clients? MSPs, IT consultancies and fractional CISOs keep a roster of client kits that refresh monthly, under their own branding. See partner plans →