The Dispatch · Law & Governance · 2026

21 sources. No spin.

RegulationIn force now. Most rules apply August 2026.

The EU AI Act.
What UK recruiters
need to know.

The world’s first comprehensive AI law is live. Brexit does not put UK firms out of reach. Most modern hiring tech is classified as high-risk. Here is what it means, who it catches and what to do about it right now.

All claims sourced at the foot of this article.

Opinions labelled. Facts verified.

A lone figure stands before an enormous concrete monolith, a single vertical beam of purple light cutting from floor to ceiling · the weight of regulation

The audit begins whether you are ready or not. August 2026 is not a soft deadline.

01Plain English, first.

What the EU AI Act actually is.

Formally Regulation (EU) 2024/1689. In force 1 August 2024. The world’s first comprehensive cross-sector AI law. Rather than regulating a specific technology, it sorts AI systems into four risk bands and applies stricter rules as the risk goes up.[1, 2]

Band 01

Unacceptable risk

Banned outright. Government social scoring. Certain emotion-recognition uses in workplaces. Real-time biometric surveillance in public spaces.

In force since Feb 2025

Band 02

High risk

Heavily regulated. This is the band that catches most recruitment AI: CV screening, candidate ranking, scoring, video interview analysis.

Rules apply Aug 2026

Band 03

Limited risk

Lighter obligations, mainly transparency. If users are interacting with a chatbot, they must be told they are talking to a machine.

Rules apply Aug 2026

Band 04

Minimal risk

No specific obligations. Most AI in everyday use falls here: spam filters, music recommendation, content moderation tools.[1]

No obligations

Origin

The European Commission first proposed an AI law in April 2021 as part of its wider digital strategy.[3] After three years of negotiation it was adopted in 2024. The European Parliament describes it as the world’s first set of comprehensive rules on artificial intelligence.

TimelineWhen each rule takes effect.

The roll-out is phased.
Some of it has already started.

2 February 2025

Bans and AI literacy duties

The “unacceptable risk” bans came into effect. Emotion-recognition AI in workplaces prohibited. AI literacy training obligations begin for all deployers.[1, 4]

In force

2 August 2025

General-purpose AI model rules

Rules for large foundation models (the kind underlying most AI products) begin. Providers of these models must comply with new transparency and safety requirements.[1]

In force

2 August 2026

Main high-risk rules and transparency obligations

The full set of rules for high-risk AI systems applies. This is the deadline that catches most hiring tech. Deployers must have human oversight, logging, bias monitoring and candidate transparency in place.[1, 4]

10 weeks away

December 2027 (proposed)

Possible extension under Digital Omnibus

A “Digital Omnibus” package published by the European Commission in November 2025 could push some high-risk obligations back to December 2027. This has not yet been finalised. Do not plan around it.[5, 6]

Not finalised

02The question everyone asks.

Does Brexit protect UK firms?
No.

The Act has extraterritorial scope. Like GDPR, it applies based on where the AI’s output lands, not where the company is based.[7, 8]

A lone figure walks into a vast purple-lit corridor · the border is not a firewall

The border is not a firewall. If the output affects someone in the EU, the Act applies.

Who is in scope

If any of these apply to you, you are caught.

You place AI on the EU market
You distribute AI in the EU
You use AI whose outputs affect people in the EU[8]
Your AI model outputs are intended for use in the EU[9]

The penalties

They match GDPR for seriousness.

Up to €35 million or 7% of global annual turnover for the worst breaches, whichever is higher[8, 10]
For SMEs: the lower of the two figures applies
The UK itself has no single domestic AI law; existing regulators apply current rules[11]

Shout’s read

UK firms with any EU exposure should treat the EU Act as the binding standard. Waiting for a domestic UK law is not a compliance strategy.

03The bit that matters most to you.

This is where the Act bites hardest: recruitment.

Annex III, Point 4 of the Act explicitly classifies AI used in employment as high-risk. It is not ambiguous.[12, 13]

Classified as high-risk no exceptions

Placing targeted job advertisements · Analysing and filtering job applications (CV screening) · Evaluating and scoring candidates · Shortlisting and ranking · Decisions on promotion, termination, task allocation · Performance monitoring

Practically, this means AI-assisted CV parsing in an ATS, automated candidate ranking, AI-scored video interviews and AI sourcing tools are all captured.[14, 15]

A lone figure climbs a monumental concrete staircase toward white-purple light · five deliberate steps upward

Every ATS with an AI layer. Every ranking algorithm. Every video-interview scoring tool. High risk by default.

Already banned since February 2025 stop using these now

Emotion-recognition AI in the workplace including in interviews falls under the prohibited category. Tools that claim to read a candidate’s personality, sentiment or emotional state from a video are banned. If you are using one, the ban is not August 2026. It was February 2025.[16]

04Two roles. Two sets of obligations.

Your vendor being compliant does not make you compliant.

The Act splits responsibility between the provider (the company that builds the AI tool) and the deployer (the company that uses it). A vendor’s compliance does not discharge your own duties as a deployer.[13, 17]

Provider

Your ATS vendor. Your video platform. Your sourcing tool.

Must register high-risk systems in the EU database
Must provide technical documentation to deployers
Must conduct conformity assessments
Must implement quality management systems
Must enable logging capability

Deployer

You. The agency. The in-house recruiter. The hiring manager.

Human oversight: a competent human must be able to review and override AI decisions
Transparency to candidates: applicants should be told when AI is used
Record-keeping: system logs retained as required
Bias monitoring: ongoing checks for discriminatory outcomes
AI literacy: staff using tools must understand them[13, 14, 18]

Video interview platforms are saying this directly

HeyMilo states that employers are deployers and that vendor compliance does not fulfil employer duties both parties carry independent legal responsibility.[17] This is the consensus position across the market. Do not expect your vendor to cover you.

05The readiness gap is real.

Almost every company uses AI in recruitment.
Almost none are ready.

87%

of companies already use AI in recruitment[14]

24%

of HR-AI users have started formal compliance preparation[14]

10wks

until the August 2026 high-risk rules apply

What vendors are doing about it

The provider-deployer split is now standard messaging across the recruitment tech market. Vendors who invested early in transparency, human oversight and bias testing will stand apart from those now retrofitting compliance.[14]

Bias-auditing and retrievable audit trails are becoming product features, not optional extras. Recruiters are being advised to ask suppliers for bias-audit results segmented by protected characteristic, complete and retrievable decision logs and the technical documentation deployers need to meet their own obligations.[14, 19]

Carv, a volume-hiring AI platform, frames it commercially: recruitment leaders need to reassess AI software providers against new compliance, transparency and risk-management standards.[20] This is the correct framing. Choosing a recruitment AI tool is now a governance decision, not a buying decision.

06What to do about it.

Five practical steps.
One of them is already overdue.

Solicitor Ross Saunders recommends starting with an AI inventory of the hiring process: what tools are in use, what decisions they touch and which fall under high-risk.[18] That is step one.

Inventory every AI tool in your hiring process.

Include AI features that have been quietly added to existing ATS, sourcing and assessment platforms since you originally signed the contract. Many tools now have AI layers that were not there 18 months ago.[21]

Classify each tool under the Act’s risk bands.

If it influences who gets hired, assume high-risk until proven otherwise. CV screening, ranking algorithms, video interview scoring, sourcing tools: all high-risk by default under Annex III.[12]

Stop using prohibited tools now. This deadline has passed.

Anything doing emotion or sentiment recognition on candidates in interviews, or in the workplace, has been banned since 2 February 2025. The August 2026 deadline does not apply here.[16]

Update vendor contracts.

Require the technical documentation, bias-audit evidence segmented by protected characteristic and logging access you’ll need as a deployer to evidence your own compliance. A vendor that cannot supply this is a liability.[14, 19]

Train your team. AI literacy is already a legal duty.

This obligation came into force on 2 February 2025, not August 2026. Staff who use AI tools in hiring decisions must have sufficient understanding of what those tools do, how they reach conclusions and where they can go wrong.[4, 18]

The common thread

The Act is shifting AI in recruitment from a buying decision to a governance decision. The vendors that thrive will be the ones who make it easy for clients to evidence compliance, not just deliver features. The agencies and in-house teams that thrive will be the ones who treated August 2026 as a deadline to meet, not a line to watch from a distance.

What the EU AI Act actually is.

The roll-out is phased.Some of it has already started.

Does Brexit protect UK firms?No.

This is where the Act bites hardest: recruitment.

Your vendor being compliant does not make you compliant.

Almost every company uses AI in recruitment.Almost none are ready.

What vendors are doing about it

Five practical steps.One of them is already overdue.

The roll-out is phased.
Some of it has already started.

Does Brexit protect UK firms?
No.

Almost every company uses AI in recruitment.
Almost none are ready.

Five practical steps.
One of them is already overdue.