AI in HR Given Reprieve Until December 2027

The specific obligations for deployers, meaning companies that use high-risk AI in HR, will apply from 2 December 2027 rather than 2 August 2026. According to Regulation (EU) 2026/1744, this gives SMEs a further 16 months to review their HR software, responsibilities and contracts. However, the existing requirement for AI literacy has not been postponed.

What has been postponed for AI in HR?

The specific rules for stand-alone high-risk AI will now apply from 2 December 2027. The original deadline was 2 August 2026.

Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force directly throughout the European Union on 27 July 2026. It is often referred to as the AI Omnibus and changes the timetable of the European AI Act.

The postponement does not mean that companies can set the issue aside until the end of 2027. They must first establish which software they use involves artificial intelligence and which decisions it affects. This requires information from software providers, a review of internal processes and often practical testing.

For example, a care provider should not review only its applicant portal. Staff scheduling, route allocation, time recording and performance reports may also contain functions that assess employees or allocate tasks to individuals.

Which HR systems are considered high-risk?

High-risk systems include, in particular, AI systems that select applicants, influence promotions or dismissals, allocate tasks to individuals, or monitor and assess employees. The system’s actual function is what matters, not the product name.

Annex III of the European AI Act lists systems used to select applicants and make decisions about employment relationships, task allocation and performance monitoring. One example might be software that automatically sorts 80 applications and presents only the ten highest-rated candidates.

Other examples include shift planning software that assigns employees based on absence or speed, or cleaning management software that continuously rates individual workers according to the area they cover. An overview of practical staff scheduling with AI and its possible uses can help distinguish between automated suggestions and decisions about individuals.

Not every HR tool is automatically classified as high-risk AI. A narrowly defined preparatory task may be exempt if it does not materially influence the outcome of a decision. However, if the system carries out profiling, meaning the automated assessment of personal characteristics or work behaviour, it is generally considered high-risk.

Each function must be assessed separately. HR software can include both low-risk functions, such as appointment confirmations, and potentially high-risk applicant assessments.

What should SMEs prepare by December 2027?

Companies should document their systems, clarify their risk classification and appoint someone responsible for human oversight. They should also prepare logging arrangements, internal instructions and robust agreements with providers.

1. Document your software: List applicant portals, staff scheduling, time recording, route planning, performance reporting and monitoring systems. Record the provider, version, responsible department and specific purpose.
2. Assess the influence on decisions: Record whether the software merely organises data, makes a recommendation or effectively makes the decision. Also check whether employees can reject or correct a recommendation without suffering any disadvantage.
3. Define human oversight: Under the European AI Act, deployers must take appropriate technical and organisational measures and appoint a qualified person to oversee the system. This person must be able to understand outputs, identify errors, and stop or override decisions.
4. Retain logs: Under the European AI Act, deployers must generally retain automatically generated logs for at least six months where those logs are under their control. The provider should therefore explain which logs are generated, how they can be exported and when they are deleted.
5. Inform employees: Employers must inform employee representatives and affected employees before using a high-risk AI system in the workplace. This information should explain the purpose, how the system works, the data used and the relevant contact people in clear terms.

The provider contract should also specify which party assumes each role under the European AI Act. Important provisions include commitments concerning documentation, updates, incident reports, log exports and support during audits. General marketing claims such as “fully compliant” are not sufficient.

Which obligations already apply before December 2027?

The requirement to ensure that the employees involved have sufficient AI literacy has applied since 2 February 2025. Regulation (EU) 2026/1744 did not postpone it until December 2027.

AI literacy means that employees understand the systems they use to a level appropriate for their role and can assess the risks. An HR officer needs different knowledge from a manager who approves automated performance reports.

Training should cover at least the system’s purpose, typical errors, prohibited uses, the handling of personal data and the process for raising questions. Document the date, participants, content and person responsible. A single general presentation may not be sufficient if functions change or new risks arise.

The postponement also does not remove data protection requirements, employment law information obligations or employee participation rights. According to the European Commission, breaches of other obligations under the European AI Act can generally result in fines of up to 15 million euros or 3 per cent of worldwide annual turnover. For SMEs, the lower threshold applies in each case.

How can the software review be organised in 90 days?

A clearly defined 90-day plan can provide an initial reliable overview. The aim is not yet to reach a final legal assessment, but to produce a complete inventory with prioritised gaps.

• Days 1 to 30: Record systems, functions, providers, types of data and responsible people.
• Days 31 to 60: Review the influence on decisions, profiling, human oversight and existing logs. Request any missing provider documentation in writing.
• Days 61 to 90: Assign responsibilities, plan employee training, prepare information materials and prioritise unresolved contractual questions.

Start with applications that have direct consequences for people. An automated applicant ranking or performance-based shift allocation is more urgent than a tool that merely edits the wording of job advertisements.

ibx company advises small and medium-sized businesses in Hannover and the surrounding region on the structured review and implementation of digitalisation projects. If you would like help assessing your software inventory and next steps, you can arrange a no-obligation initial consultation.