The EU AI Act: what the 'high-risk' obligations change for you

Most legal and HR departments read the EU AI Act as a text aimed at AI software vendors, not at their own company. That’s a dangerous reading for any AI use touching employment: the regulation explicitly classifies systems used for recruitment, performance evaluation, task allocation or promotion decisions as high-risk — and it imposes obligations directly on the company deploying those systems, not only the one designing them. Documentation obligations apply starting August 2026, December 2027 for entities covered by the Omnibus mechanism. Here’s what that actually changes.

What “high-risk” actually means for employment

Annex III of the AI Act explicitly classifies as high-risk any AI system used for recruiting and screening candidates, evaluating work performance and behavior, allocating tasks based on individual traits, or making promotion and termination decisions. This classification doesn’t depend on how technically sophisticated the system is: a simple AI-assisted CV-screening tool falls within this scope the moment it influences an employment decision.

What changes with high-risk status isn’t a ban — it’s a burden of proof. The company must be able to demonstrate, on request, how the system works, what data it relies on, and what human oversight governs its outputs.

Provider and deployer: two distinct sets of obligations

The AI Act distinguishes the provider, who designs the system, from the deployer, who uses it in its own operations. Most mid-size French companies are deployers: they buy or integrate AI tools rather than building them in-house. That doesn’t exempt them from obligations of their own — a fundamental-rights impact assessment, informing affected individuals, effective human oversight, and documenting the system’s actual use within the organization. The contract with the vendor doesn’t transfer these obligations; at best, it can clarify who documents what.

The timeline that matters: August 2026 and December 2027

Documentation obligations for high-risk uses apply starting August 2026 for most affected entities. The Omnibus mechanism, which grants additional time to certain categories of entities, pushes that deadline to December 2027 — a welcome extension, but not a reason to wait: the documentation required covers actual usage, not some future ideal state. The longer a company waits to start tracking its own AI usage, the longer and more expensive reconstructing that documentation retroactively becomes.

The AI Act’s deadline isn’t a date to become compliant by. It’s a date by which you already need to be able to prove you were.

What the documentation must prove, not just state

Compliance documentation that merely asserts general principles won’t survive an audit. What needs to be traceable and verifiable:

• Task-to-system mapping — which specific task, in which role, is actually assisted or decided by the AI system.
• Real human oversight — who validates, at what stage, with what genuine ability to correct or override the system’s recommendation.
• A log of automated decisions — a usable history, not a statement of intent on paper.
• Pre-scaling risk assessment — a risk analysis conducted before extending a pilot use case to an entire division, not after the fact.

Why data sovereignty becomes a compliance lever

An on-premise deployment, where company data never leaves its perimeter and is never used to train a third-party model, simplifies a substantial part of this documentation: the data processing chain stays fully traceable and defensible to both the regulator and the works council. An architecture that’s GDPR-native by design, rather than patched into compliance after the fact, reduces the number of gray areas that need documenting after the fact.

What this actually changes for your AI roadmap

The practical conclusion for a leadership team isn’t to delay AI projects while waiting for the framework to settle — it’s the opposite: every use case launched without documentation from day one is a use case that will need to be reconstructed later, under pressure, with a reversed burden of proof in the event of an audit. Building traceability and human oversight into an HR use case from the design stage costs marginally more at launch and considerably less by the 2026 or 2027 deadline.

The AI Act doesn’t ask companies to prove that AI works well. It asks them to prove they know exactly what it’s doing — which, for most HR departments today, still needs to be built.