Mid-2026, one question keeps coming up among recruiters: "The AI Act is delayed, right? We've got time?" Short answer: high-risk obligations have indeed shifted — but not everything, and not for everyone. Here's what changed, what didn't, and what it means in practice for agencies, staffing firms and HR teams (in the EU and beyond).
Summary
- What changed: the Digital Omnibus
- The new date for recruitment
- What did NOT change (and is already in force)
- Why "deferred" doesn't mean "cancelled"
- What a recruitment team should do with these 18 months
- FAQ
1. What changed: the Digital Omnibus
On 7 May 2026, the European Parliament and the Council reached a provisional political agreement on the Digital Omnibus AI — a simplification package for the EU's digital rulebook. It defers several AI Act application dates.
Important — This agreement is political and provisional. The final text still needs formal adoption by both institutions and publication in the Official Journal of the EU (OJEU). Until then, the original dates remain legally binding. Formal adoption is expected before 2 August 2026 (the original high-risk application date), but is not guaranteed.
2. The new date for recruitment
AI-assisted recruitment (filtering, scoring, candidate evaluation) falls under Annex III, point 4 of the AI Act — the high-risk category. For these systems:
| | Before Digital Omnibus | After (subject to final adoption) | | ----------------------------------------------- | ---------------------- | --------------------------------- | | Annex III high-risk systems (incl. recruitment) | 2 August 2026 | 2 December 2027 | | Annex I high-risk (regulated products) | 2 August 2027 | 2 August 2027 (unchanged) |
Net effect: product obligations for high-risk recruitment software are deferred by ~16 months, if the December 2027 date is confirmed by formal adoption.
3. What did NOT change (and is already in force)
The deferral concerns Annex III obligations — not the entire AI Act. Still in force:
- Prohibited practices (article 5) — since 2 February 2025. In recruitment, this covers emotion inference of a candidate in an interview, and biometric categorisation by origin, opinions, sex life, etc. (art. 5 §1 f and g).
- AI literacy (article 4) — train and raise awareness in teams — since 2 February 2025.
- GDPR (or UK GDPR) continues to apply fully: profiling, lawful basis, transparency, retention. The deferral does not affect data protection law.
4. Why "deferred" doesn't mean "cancelled"
The Digital Omnibus moves the date, not the content. The logic is pragmatic: avoid friction between AI Act and GDPR, give European actors time to prepare. It is not a withdrawal.
For a serious vendor or agency, doing nothing until late 2027 is risky — high-risk AI compliance does not happen in six months: usage mapping, risk management, data governance, effective human oversight, technical documentation are all medium-term programmes.
5. What a recruitment team should do with these 18 months
A realistic roadmap, no rush:
- Check today that no prohibited practice is in use in your tools (no emotion analysis of candidates — already in force).
- Train users to a thoughtful use of AI (art. 4 duty, already in force).
- Map the AI features used (CV filtering, scoring, matching).
- Coordinate with GDPR/UK GDPR: candidate information, retention. The deferral does not affect these.
- Keep real human oversight: AI assists, the recruiter decides.
For the full picture of obligations (provider vs deployer, product requirements, penalties), see our complete AI Act and recruitment guide.
Where this article comes from
Marvin Recruiter integrates GDPR and AI Act considerations in product design. This article is the output of our in-house R&D work on these topics — regulation, ICO/CNIL/AEPD doctrine, Digital Omnibus monitoring. Informative, not legal advice. Not yet reviewed by a lawyer. Validate compliance decisions with your DPO or a specialised law firm.
FAQ
Is the AI Act cancelled for recruitment?
No. Recruitment remains a "high-risk" AI use under Annex III, point 4. Only the application date for high-risk obligations is deferred to 2 December 2027.
When must a recruitment platform be AI Act compliant?
Subject to formal adoption of the Digital Omnibus, from 2 December 2027. If the agreement is not adopted and published in the OJEU before 2 August 2026, the original date applies.
Are there obligations in force today?
Yes: prohibited practices (article 5) and AI literacy (article 4) have been in force since 2 February 2025. And GDPR is unaffected.
Do I need an audit or notified body for recruitment?
For recruitment (Annex III, point 4), conformity assessment is done via internal control by the provider (Annex VI) — no notified body required.
Does the deferral change anything for GDPR or UK GDPR?
No. Data protection law is a distinct framework, fully applicable, not affected by the Digital Omnibus.
Informative article up to date as of 15 May 2026. Sources: Regulation (EU) 2024/1689; political agreement on the Digital Omnibus, 7 May 2026 (Council of the EU, European Parliament, European Commission). Status: provisional political agreement, formal adoption pending. Not legal advice.
Suggested internal links: Complete AI Act and recruitment guide (A1) · CV retention and GDPR (R2) · Request a demo.
