Anyone who has spent the past months preparing for 2 August 2026 can breathe out for a moment. The date on which the obligations for high-risk AI in the employment context were meant to apply has been moved. Not by weeks, but by sixteen months.
The legal basis is the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026. It sets out:
- 2 December 2027 for stand-alone high-risk systems under Annex III and Article 6(2). That includes number 4, employment and workforce management.
- 2 August 2028 for systems embedded as a safety component in regulated products, under Annex I and Article 6(1).
At the same time the definition of high risk was narrowed. Components that support the user now only count as high risk if their failure can actually endanger health or safety. Systems that deliver pure efficiency, automation or quality control no longer fall in on that basis alone.
What expressly has not changed
The prohibitions under Article 5 have applied unchanged since 2 February 2025. They are not a risk class but a ban, and they come with no transition period.
One of them is central to personnel selection: emotion recognition in the workplace is prohibited. Anyone using a tool that infers emotional states from video, voice, facial expression or speech patterns is breaking that rule today, not in fifteen months. It also covers procedures that bring such a feature along as a side function without anyone asking for it.
Two further prohibitions are added from 2 December 2026. They concern non-consensual intimate imagery and child sexual abuse material, and have nothing to do with selection procedures.
Why the delay is not a free pass
Sixteen months sounds like time. In practice it is not, for three reasons.
First, you are deciding today for the whole term. A selection system is not bought for a year. Anyone procuring a tool now that sorts applications or rates candidates will have to retrofit in 2027: risk management, technical documentation, human oversight, logging. Retrofitting costs more than buying properly, and doing it during live operations is unpleasant on top.
Second, employment law applies anyway. The AI Act is not the only source of requirements. The AGG requires selection decisions to be free of discrimination and demonstrably so in the event of a dispute. Co-determination under the Betriebsverfassungsgesetz applies as soon as a system schedules appointments, makes workload visible or measures performance. Neither depends on the date in an EU regulation.
Third, your reviewers are already asking. The question about AI classification has long been part of InfoSec questionnaires and procurement procedures. The fact that the obligation applies later does not change the fact that you need an answer during procurement today.
The practical consequence
The delay takes away the time pressure, not the task. Anyone using it properly does two things.
They draw the line cleanly in their own process: where does software act on the assessment of people, and where does it merely organise the operation around it? A tool that schedules appointments, allocates rooms and distributes documents rates nobody. A tool that sorts applications by likelihood of success does. That distinction is the basis of any classification, and it costs nothing but an honest stocktake.
And they procure with 2027 in mind. Do not ask suppliers whether their system is compliant today; ask what happens once the obligations apply. Is there a log that makes every action traceable? Does the judgement stay with people? Can features you do not want be switched off? A supplier without a clear answer is selling you a retrofit project.
At flynne we asked ourselves these questions before anyone else did. The answer was a decision of principle: our AI plans, warns and drafts. People do the judging. Not because a deadline demands it, but because diagnostic authority belongs where the professional expertise sits.
How we handle that in detail is set out in our AI principles. If you want to work through the classification for your own organisation, talk to us: we bring the documents your data protection officer and your works council can work with.
