Roger Clements, Managing Director, Security Watchdog
You may have seen the news that the EU has given organisations more time to prepare for the EU AI Act’s rules onhiring and employment. Regulation (EU) 2026/1744, known as the Digital Omnibus, moves the high-risk obligations in Annex III point 4 from 2 August 2026 to 2 December 2027. Point 4 covers recruitment, selection and employment decisions.
It would be easy to read this as a reprieve. It is not. The EU has not changed its view of AI in hiring. The Omnibus says plainly why the date moved: the standards, guidance and national authorities that make compliance workable were not ready in time.
So, we do not see the extra time as a reason to slow down. We see it as a chance to get this right. When point 4 takes effect, we want our platforms, processes and people to be ready, and we want to help our clients be ready too.
Where the EU AI Act meets the workforce
Annex III point 4 sets out two groups of employment use. Almost every AI-enabled HR product, background screening included, falls into at least one:
- 4(a) Recruitment and selection: targeted job advertising, analysing and filtering applications, and evaluating candidates
- 4(b) Decisions in the employment relationship: promotion, termination, findings from backgroundverifications and/or rescreening activities, task allocation based on behaviour or personal traits,monitoring and performance evaluation
A listing in point 4 brings in the full high-risk regime. Providers must manage risk, meet data-governance rules,produce Annex IV technical documentation, build in logging and human oversight, and pass a conformityassessment. Employers, as deployers, must use systems as instructed, appoint trained people to overseethem, keep logs, and inform worker representatives before rollout.
Human oversight is at the centre of all this. Article 14 requires high-risk systems to be designed so that peoplecan oversee them effectively while they are in use. Those people need to understand what the system can andcannot do. They need to watch for automation bias, the tendency to over-rely on a system’s output. They need toread the output correctly and be free to disregard, override or reverse it. Article 26(2) then requires employers to give oversight to people with the competence, training and authority to do it.
The Act does not just ask for a human in the loop – it asks for the right human, with the expertise and the mandate to say no.
What has changed and what has not
| Obligation | Original date | Date under 2026/1744 |
| Annex III high-risk, including point 4 | 2 Aug 2026 | 2 Dec 2027 |
| Article 50 transparency (e.g. candidate chatbots) | 2 Aug 2026 | Unchanged, already applies |
| Ban on workplace emotion recognition | 2 Feb 2025 | Unchanged, already applies |
The classification has not changed. A tool that was high-risk under point 4 in July is still high-risk today. Onlythe date it must comply by has moved. GDPR Article 22 still governs solely automated hiring decisions. Once the high-risk rules apply, Article 86 of the AI Act also gives individuals the right to a clear explanation of the role an Annex III system played in a significant decision about them.
That means oversight cannot be a box-ticking exercise. It must be real, informed, and explainable.
Sources: ActuIA analysis of 2026/1744, ActuIA on HR tools.
Why the EU AI Act hiring deadline has moved
Recital 40 of the Omnibus is candid. Standards, common specifications, guidance and national authorities all arrived late, and each of those gaps affects point 4 tools directly.
| Missing piece | Why it matters for point 4 | Status, October 2026 |
| Harmonised standards (Art. 40) | The practical route to presumed conformity | None cited in the Official Journal. The first, on quality management, was approved in July 2026 |
| Bias and dataset standards (prEN 18283, prEN 18284) | Define how hiring data and bias controls are governed | Still in drafting |
| Risk management and logging standards (prEN 18228, prEN ISO/IEC 24970) | Specify risk processes and the logs deployers must keep | At enquiry or drafting stage |
| Common specifications (Art. 41) | The Commission’s fallback when standards lag | Not adopted |
| National competent authorities | Supervise and enforce point 4 | Only 8 of 27 designated by March 2026. Germany since July 2026; France still pending |
| Commission templates and guidance | Post-market monitoring plan, Annex I interplay | Due August–September 2027 |
The other half of the gap is what providers can deliver. HR technology vendors were asked to build audit-grade logging, oversight controls, explainable outputs and bias monitoring to specifications that did not yet exist. Employers cannot meet their deployer duties if the tools they buy do not include those functions. Industry, national authorities and consumer groups all said the original timetable could not be met.
That is why Security Watchdog has treated AI Act readiness as a platform priority, not just a legal exercise.
The timing matters. CEN-CENELEC, the European standards body, is aiming to deliver its priority standards in Q4 2026. That leaves roughly a year to put them into practice before December 2027. Organisations that wait for the standards before they start will run out of time. We’re not waiting.
Sources: EU AI Act standards landscape (reviewed 13 Sep 2026), ActuIA analysis of 2026/1744, ActuIA on HR tools.
What to expect from your HR technology partners
Point 4(a) covers the core of most hiring technology: ad targeting, CV filtering, ranking and candidate evaluation. Many of these products cannot yet show compliance, and that is a large part of why the deadline moved. Over the next 14 months, clients will rightly expect every provider in their hiring chain, including us, to show they are ready. EU AI Act clauses are already appearing in tenders and legal reviews across our client community.
In our view, four things separate a provider that’s ready from one that’s still making promises:
- Compliance is built into the product: Employers need logging, human-review controls, explainable outputs and bias monitoring to meet their deployer duties. These features belong in the product today, not on a roadmap marked “by the deadline”
- The new bias-testing basis is already in use: Article 4a gives providers, and now deployers, a clearer legal basis to process sensitive data to detect and correct bias. The bias standard is still in draft, so this is the main tool available today. Responsible providers should already be using it
- Releases are governed: Systems already on the market before the application date come into scope only if they later undergo significant design changes. A major model upgrade after December 2027 could bring a product into scope, so release decisions now carry regulatory weight
- Deployer duties are clear: Outsourcing recruitment or screening does not outsource the employer’s obligations. A good partner helps you meet them
Practitioners estimate conformity work takes 12 to 18 months for a small team (Apply AI Alliance). Fourteen months remain.
How we are approaching background screening
For background screening providers like us, point 4(a) raises a sharper question than most: is our AI high-risk at all?
Many screening tools automate narrow steps such as document checks, record matching or data extraction. Article 6(3) can exempt a system from the high-risk category if it performs a narrow procedural or preparatory task. There is one firm condition: the system must not profile people.
That line is easy to cross. Adverse-media scoring, risk ratings, “fit” or integrity indicators, and any output that ranks or flags candidates for a hiring decision look much more like evaluating candidates under point 4(a). So, we assess every AI-assisted feature against that line, whether it runs in our own platforms or comes through our sub-suppliers and regional network, and we document our reasoning whichever side it falls on. Where the exemption applies, the Omnibus allows a shorter documentation set, which makes it practical to record that assessment properly.
Over the next 14 months, our work focuses on four areas:
- Ready for procurement before regulators ask: In our experience, the first test is rarely a regulator. It is the due-diligence questionnaire and the client’s legal review. We want every client to get clear, documented answers from us, quickly
- Data quality as the core obligation: Data-governance duties weigh most heavily on businesses built on third-party records, where matching errors and out-of-date data create both accuracy and bias risk. With the dataset and bias standards still in draft, we are setting and documenting our own benchmarks now
- GDPR compliance, today: GDPR Article 22 already covers automated adverse decisions about candidates. Screening data often includes criminal records and other sensitive categories, which carry their own national rules. Meaningful review by accredited professionals stays central to how we work
- A separate review of biometric ID checks: The Act treats identity verification differently from biometric identification. We confirm which category each feature falls into rather than assume.
Source: Apply AI Alliance practitioner commentary.
Expert human judgement is what we do
Everything above comes back to a principle that has always defined Security Watchdog: technology informs screening decisions, and accredited experts make them.
We are not adding human judgement to satisfy the AI Act. It is how we have always worked, and its is why every one of our screening professionals is an accredited expert.
That matters more now than ever, because fraud is changing fast. Generative AI has made it cheaper and easier to produce convincing forged documents, invented employment and education histories, synthetic identities and deepfake media. Fraudsters now have the same technology employers use to stop them.
Meeting that threat takes both technology and people. Our platforms use leading fraud-detection tools to check documents, verify identities and surface anomalies at a speed and scale no manual process could match. But a flag is not a finding. Our accredited screening professionals review what the technology surfaces, test it against context, sources and experience, and then make the judgement call.
That is exactly the model the EU AI Act describes: capable technology, overseen by people with the competence, training and authority to understand it, question it and overrule it when needed.
For our clients, this delivers three things:
- Faster detection of increasingly sophisticated fraud
- Fairer outcomes for genuine candidates who might otherwise be caught by a false positive
- Decisions you can defend, explained clearly to candidates, auditors and regulators
Six steps to take now
Treat December 2027 as the date you need to be audit-ready, and plan on the supporting infrastructure arriving late. We recommend six steps, and our team is ready to help with each one.
- Classify against point 4 now: Map every AI feature across recruitment, assessment, screening and workforce management against points 4(a) and 4(b) and the Article 6(3) exemption. Record your reasoning
- Track the infrastructure as well as the date: Follow the risk, data, bias and logging standards, national authority designations and Commission guidance. Each one that lands shortens the time you have left
- Build to the Regulation now and map to standards later: The obligations are already in the text. Annex IV documentation already asks which standards you applied, and what you did instead where none existed
- Close the provider-deployer gap in your contracts: Require vendors, including us, to deliver the logging, oversight and documentation functions you need, with committed dates
- Govern your release roadmap: Treat significant model changes near or after December 2027 as regulatory events
- Invest in human oversight and prepare your teams: Article 26(2) requires oversight by people with the competence, training and authority to act. Article 4 already requires measures to build AI literacy among staff. Decide who will carry out oversight, how they will be trained, and how you’ll inform works councils and employees
A final word
The Digital Omnibus admits that the EU AI Act’s machinery was not ready. It does not step back from regulating AI in hiring. Annex III point 4, the obligations behind it, and the scrutiny of regulators, unions and clients all remain.
As standards and authorities arrive over the next year, the pressure will move from regulators to providers and the employers who rely on them. In background screening, trust is the product. Our clients rely on us to make hiring safer, fairer and better informed, and that responsibility covers every piece of technology we use. We meet it with leading technology overseen by accredited experts.
We will not wait for the infrastructure to arrive. We plan to have our part of it built, tested and documented well before December 2027, and to help our clients do the same.
To talk through what the EU AI Act means for your background screening programme, speak to your account manager or contact the Security Watchdog team directly.
This article is for general information only and is not legal advice.
