The Warden Watch

Tracking AI Compliance in HR

A public monitor for regulation, litigation and incidents affecting AI in hiring, recruitment and employment decision-making.

Explore regulation View bias audit scope

Regulation intelligence node

Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended by the 2026 AI Omnibus

EU AI Act (Amended)

Partially activeBoth

Jurisdiction

European Union

Status

Partially active

Live from

2 August 2024

Compliance deadline

2 December 2027

What this regulation is

The EU AI Act establishes a harmonised, risk-based regulatory framework for artificial intelligence across the European Single Market. Following a provisional trilogue agreement reached on 7 May 2026, the application deadline for high-risk employment systems has been postponed to 2 December 2027 to ensure necessary technical standards and guidance are fully available. The law completely prohibits certain harmful AI practices, imposes strict data governance criteria on high-risk tools, and explicitly permits processing special categories of personal data exclusively where strictly necessary to detect and correct algorithmic bias.

Regulator or body

European Artificial Intelligence Office (AI Office) / European Commission

Audience impact

What different teams need to know

HR and recruitment teams

Employers (deployers) using AI tools for recruitment, screening, ranking, task allocation, performance evaluation, promotion, or termination must prepare for strict compliance by December 2027. Employers must implement documented human oversight measures using competent, trained personnel, ensure input data is relevant and representative, and inform workers and their representatives prior to deploying high-risk tools in the workplace. Furthermore, individuals hold a right to a clear, meaningful explanation of AI-assisted decisions that significantly impact their employment status.

HR technology vendors

HR tech providers (vendors) of automated employment decision-making tools must satisfy comprehensive technical and quality controls before entering the EU market. Vendors are required to establish a robust quality management system, ensure logs are automatically recorded for at least six months, maintain comprehensive technical documentation for 10 years, and supply clear digital instructions for use. Under the May 2026 updates, small mid-cap enterprises (SMCs) join small and medium-sized enterprises (SMEs) in receiving reduced reporting requirements and simplified technical documentation compliance pathways.

Status intelligence

Current status and key dates

Regulatory status

Passed into law; structural governance active; implementation dates for high-risk employment use cases provisionally amended and postponed to December 2027 by the May 2026 digital omnibus package.

Date timeline

Passed
13 June 2024

Live from
2 August 2024

Enforcement / compliance
2 December 2027

Mandatory audit scope

Bias auditing and protected characteristics

Bias audit summary

The source establishes robust internal validation mechanisms for bias detection and correction but does not create a freestanding external or independent third-party bias audit requirement for employment tools. Instead, under Article 10, providers must execute continuous bias monitoring as a fundamental part of data governance. Crucially, the May 2026 omnibus update explicitly clarifies that both high-risk and non-high-risk systems are permitted to process special categories of personal data (e.g., race, health data) exclusively when strictly necessary to detect and correct algorithmic biases, subject to strict privacy safeguards and immediate deletion post-correction.

Protected characteristics summary

The regulation integrates anti-discrimination protections by linking data governance explicitly to the prevention of unlawful biases against protected classes. It completely prohibits biometric categorisation systems that deduce sensitive traits such as race, political opinions, trade union membership, religious beliefs, sex life, or sexual orientation, and bans emotion recognition systems within workplace settings to protect employee dignity and mental well-being.

Duties and legal nuance

Obligations and requirement levels

Binding duties are shown as compact cards. Evidence and notes are collapsed by default.

Bias Audit

BindingApplies to: ProviderExpress

Trigger and timing

Trigger: Developing high-risk AI systems that use techniques involving the training of models with data.

Timing: Continuously during the design, development, and pre-market validation phases, and via post-market monitoring.

Source: Article 10(2)(f)-(g), Article 10(5), and 2026 Press Release

Evidence

examination in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination... appropriate measures to detect, prevent and mitigate possible biases identified

Notes

The 2026 Omnibus amendment provides an explicit legal basis to process special categories of personal data where strictly necessary to detect and correct biases in both high-risk and non-high-risk AI systems, subject to technical limitations and strict control filters.

Candidate Notice

BindingApplies to: DeployerExpress

Trigger and timing

Trigger: Deploying high-risk AI systems listed in Annex III that make decisions or assist in making decisions related to natural persons.

Timing: Prior to or at the time the AI system is utilized to make or assist in a decision affecting the individual.

Source: Article 26(11)

Evidence

Deployers of high-risk Al systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk Al system.

Notes

Directly impacts candidates and employees undergoing screening, scoring, performance evaluation, or automated promotion assessments.

Human Review

BindingApplies to: DeployerExpress

Trigger and timing

Trigger: Operating a high-risk AI system in the workplace.

Timing: Throughout the operational lifecycle of the system while in active deployment.

Source: Article 26(2)

Evidence

Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

Notes

Designed to combat automation bias and empower HR managers to disregard, override, or reverse automated selections.

Explainability

BindingApplies to: DeployerExpress

Trigger and timing

Trigger: When a deployer's decision is based mainly upon a high-risk AI output and adversely affects a natural person's health, safety, or fundamental rights.

Timing: Post-decision, upon the affected individual's exercise of rights.

Source: Recital 171

Evidence

Affected persons should have the right to obtain an explanation where a deployer's decision is based mainly upon the output from certain high-risk Al systems that fall within the scope of this Regulation and where that decision produces legal effects or similarly significantly affects those persons

Notes

Crucial tool for candidates challenging recruitment, ranking, or dismissal decisions generated by automated platforms.

Recordkeeping

BindingApplies to: DeployerExpress

Trigger and timing

Trigger: Controlling the automatically generated logs of a high-risk AI system.

Timing: Retained during active use and stored for at least six months.

Source: Article 26(6)

Evidence

Deployers of high-risk Al systems shall keep the logs automatically generated by that high-risk Al system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk Al system, of at least six months

Notes

Financial institutions may maintain logs as part of pre-existing sectoral governance records under Union financial services law.

Transparency Disclosure

BindingApplies to: DeployerExpress

Trigger and timing

Trigger: Deploying a high-risk AI system at the workplace.

Timing: Pre-deployment notice to staff and representatives.

Source: Article 26(7)

Evidence

Before putting into service or using a high-risk Al system at the workplace, deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the high-risk Al system.

Notes

Acts as an ancillary workplace information right complementing traditional industrial relations frameworks.

Actor split

Who the record says is responsible

Primary liability role: Both

Employer / employment agency duties

Bias Audit · BindingCandidate Notice · BindingHuman Review · BindingExplainability · BindingRecordkeeping · BindingTransparency Disclosure · Binding

Vendor support context

Hiring and employment use cases

Affected use cases

ScreeningExpressly coveredExpress

AI systems used in employment, workers management and access to self-employment, in particular for the recruitment and selection of persons