The AI Act Is Live. The Compliance Line Your Budget Is Missing.

The AI Act is not a problem for technology companies. It is a governance deadline for every company whose HR systems screen, score, or assign work to people — and the budget line for it is missing in most board plans.

Since 2 August 2026, the AI Act applies across the EU, and its rules for the high-risk systems of Annex III, hiring and HR among them, apply from 2 December 2027 (official regulation page; Article 113, as amended by Regulation (EU) 2026/1744). In our client work, most executives first describe it as a problem for software vendors — the companies that build AI. The regulation takes the opposite view: any company that uses AI in employment decisions counts as a deployer under the Act, and the obligations attach to that use.

And HR is where AI entered most companies first — a CV screener here, a video-interview scorer there, a chatbot answering leave requests somewhere else. None of it was bought as “regulated software”. Most of it, in the eyes of the regulation, is high-risk: Annex III, point 4 lists AI used to recruit and select people, filter applications, evaluate candidates, allocate tasks and monitor or evaluate performance (Digi24). The chatbot is the exception: the Act asks that people know they are talking to an AI system (Article 50).

What changed on 2 August 2026

Three properties make the AI Act different from the directives most companies are used to. It applies directly — no national transposition law to wait for, so each rule binds companies on the day it becomes applicable (Aleph Business). It reaches beyond the EU's borders — companies outside the Union fall under it if the output of their systems is used in the EU (Article 2). And it regulates uses, not products: the same general-purpose model can be unregulated in one context and high-risk in another, and employment is on the high-risk side of that line.

The use cases are spelled out rather than implied — filtering applications, evaluating candidates, deciding on promotion or termination, allocating tasks, monitoring and evaluating performance (Annex III, point 4). The Act treats those systems as high-risk, unless one only performs a narrow procedural or preparatory task and profiles no one (Article 6), and it splits the duties. The vendor, as provider, owes risk management, data governance, technical documentation and a design that allows human oversight (Articles 9 to 16). The company, as deployer, owes its own: use the system as instructed, give oversight to people with the competence and authority to exercise it, keep its logs for at least six months, tell workers' representatives and the workers affected before the system is used at work, and tell the people it decides about (Article 26; Juridice.ro analysis). “We only bought the tool” is not a defense — as deployer, those duties are the company's own.

Are you in scope? Three questions

1. Do we use software to screen, filter, or rank candidates or CVs?
2. Do we use algorithms to monitor or evaluate performance and behaviour, allocate tasks, or decide on promotion or termination?
3. Does any chatbot or automated system answer employees — about leave, pay, or policies?

A “yes” to either of the first two is enough to make the company a deployer of a high-risk employment system, with the oversight and information duties that follow from 2 December 2027; a “yes” to the third brings the Act's transparency rule for chatbots (Articles 26 and 50). The uncomfortable detail for mid-sized companies: the tools that trigger this are rarely bought from an AI vendor at all. Screening modules come bundled with recruitment platforms; evaluation features arrive inside HR suites; chatbots get added to an intranet. Each one entered the company through a different door, and no single person owns the register of all of them.

Where the exposure actually sits

The Act's penalties are structured in tiers rather than a single headline number — and the top tier is deliberately uncomfortable. A company faces whichever is higher, the amount or the share of turnover; an SME, whichever is lower (AI Act, Article 99; Financiarul).

The comfortable excuse is old and predictable: “it was only a supporting tool”. Romanian technology lawyers hear it often and reject it on the same grounds each time — where a system influences decisions about people, the paperwork obligations follow the decision, not the vendor (Juridice.ro; Digi24). A pilot is not a defense either. Once the high-risk rules apply, a pilot that runs for four months on real applications runs on real people.

The budget line — what to fund now

Most of the work is documentation over people decisions you are making anyway: hiring, evaluating, scheduling. Outside counsel can review it; your own teams have to build it.

• An AI-use inventory. One register of every tool that touches people data — HR, operations, marketing — with an owner for each. This single page is the difference between managing the exposure and discovering it.
• Documentation and assessments. Purpose, data, risk checks, test results. Template it once; reuse it per system. This is the layer authorities and enterprise customers ask to see first.
• Oversight design. For each system: who can override it, how they are told to, and how workers are informed. Oversight that exists only in the vendor's manual does not exist.
• Training that makes oversight real. A manager who cannot read a scoring output cannot oversee it. Change management, the obstacle 21% of executives already name, is what converts a policy into a control.

The bottom line

The companies that moved into AI in HR first are now in scope first, because in every technology wave use arrives before governance. The advantage from here belongs to whoever can produce the documentation, the oversight, and the policy before a customer, an auditor, or a works council asks for them.

Our HR Strategy Advisory covers the workforce side: mapping where people decisions are already algorithmic, and building the registers, checks and manager capability that make those decisions defensible. The legal reading stays with your counsel.