AI Hiring Rules Moved to 2027. The Explainability Problem Didn't Move With Them.

The EU AI Act treats software that screens and ranks job candidates as high-risk, and it's the category carrying the law's strictest requirements. Those requirements were due to apply from August 2nd, but lawmakers recently pushed it back to December of 2027. Any company hiring in Europe now has sixteen more months before the rules bite, and that includes any American employers recruiting there.

Companies hiring inside the US had already seen the same pattern in May. Colorado repealed its own AI law weeks before it was due to take effect and replaced it with a lighter version starting in January 2027. Both changes moved a date, but neither one touched the underlying expectation. An employer that uses software to screen candidates still needs to understand how that software reaches its conclusions, and still carries responsibility for the hiring decisions that follow.

Playing by the rules

The reprieve covers the high-risk rules and nothing else. Those requirements govern how high-risk systems get built, documented and overseen, and they now apply from December 2027. A separate part of the same law, requiring companies to tell people when they are dealing with an AI system, took effect on August 2 as planned. Employment discrimination law didn't change at all, in Europe or the US, and an employer remains answerable for a rejection whether a person or a program produced it.

Josh Millet, CEO of Criteria, spends his days with HR teams working out how much of their hiring to hand to software. His company has sold hiring assessments for two decades, which puts its products in the category the AI Act calls 'high risk.' He puts one standard to any team weighing a purchase. "The customer should be able to explain in two sentences how it works," says Millet. "If they can't, they shouldn't use it in their hiring process."

Behind the delay

Europe wasn't ready to enforce the rules on time. The technical standards companies were meant to build against hadn't been published, the guidance explaining what compliance looks like hadn't arrived, and several countries hadn't named the authorities responsible for enforcement. The requirements themselves stayed exactly as written, and only the date changed.

A later date does nothing for a company that still has to explain how its hiring software works, and Millet's standard is written for exactly that situation. He argues a vendor who calls its method 'proprietary' has given an answer that should rule the tool out for hiring, even where the same answer would be fine in a product with less at stake. An employer choosing who gets a job may have to defend that choice to a regulator or a court, and defending it means being able to describe how the software reached its recommendation.

Signed now, governed later

Sixteen months is roughly one enterprise procurement cycle, and an assessment platform bought this year on a multi-year contract will still be in use in December 2027. A team that skips the explainability question now will be running that tool when the requirements take effect. Article 26, the section covering companies that use these systems, will apply those requirements to the employer as well as the vendor.

Whoever operates a high-risk hiring tool will have to assign human oversight, keep six months of logs, and notify affected workers. Those duties stay with the employer even when the vendor contract assigns compliance to the vendor.

Companies are reaching different conclusions about how far to go. Millet describes a real ambivalence inside HR, where enthusiasm for the technology coexists with worry from people who feel responsible for protecting human work. "Half the conversations I have with customers are, 'Show me what your AI can do,'" Millet concludes. "The other half are, 'Can I turn the AI off?' Both are legitimate."