A world first

The EU AI Act (the Act) is the first piece of legislation anywhere in the world that regulates AI. The Act creates obligations based on the level of risk associated with particular uses of AI systems. The provisions relating to the "riskiest" uses of AI came into force on 2 February 2025 and the entire Act will be in force by 1 August 2026. The European Parliament's intention is that regulating and classifying AI systems in this way will increase safety, transparency and sustainability, and prevent discriminatory AI practices. It is vital that employers take proactive steps to ensure compliance with the Act to avoid facing significant fines, legal or regulatory action, and reputational damage.

AI capabilities have accelerated dramatically in recent years, creating legal and ethical challenges. For example, incomplete and biased training data has resulted in AI systems discriminatorily assessing CVs, mislabelling images and misidentifying suspected criminals. AI also poses privacy and transparency concerns, such as when users' personal information is "scraped" from publicly available sites without their knowledge. Generative AI can similarly create disturbing, offensive and racist images. In response to these issues, the European Parliament passed the Act to strike a balance between fostering innovation and safeguarding users and protecting their rights.

Does this apply to your business?

The Act applies to suppliers of AI systems to the EU market, irrespective of where they are established or located, and to providers and deployers (users) of AI systems located or established outside the EU, if the output of the AI system will be used in the EU. So, it is not just those businesses located in the EU that need to be aware of the Act's implications. If, for example, you use an AI recruitment tool in the UK for recruitment across your business in the EU, then this will fall within the Act's scope.

Risk categories

The Act attempts to do this by classifying AI uses into various risk categories, escalating in severity from "minimal risk" and "limited risk" to "high risk" and "unacceptable risk". Under the Act, "minimal risk" AI systems (which include most AI systems currently available in the EU market) will remain unregulated. "Limited risk" systems will be subject to light touch obligations to ensure that users know and understand they are engaging with AI. The Act imposes much stricter regulation for "high risk" and "unacceptable risk" systems. The maximum fine for non-compliance is the higher of €35 million or up to 7% of a firm's total worldwide annual turnover for the previous financial year.

"High risk" AI systems

High risk AI systems include those that are used to categorise people based on their biometric data (e.g. AI used in CCTV); for education and training (e.g. AI used to detect erratic student behaviour during exams); in employment (e.g. AI used in HR decision-making, or during onboarding or recruitment processes); and to administer justice (e.g. AI used in alternative dispute resolution).

A system will only qualify as high risk if it poses a significant risk of harm to health, safety or fundamental rights. A system that only performs a narrow procedural task or is intended to improve the result of a previously completed human activity, for example, will be deemed not to pose a significant risk of harm and will fall outside the high risk classification.

It is clear from the prescribed list above that many of the AI tools which businesses might use in an HR context will fall into the high risk category. This will include AI systems that assist with CV and job application screening and AI performance management tools.

Developers of high risk AI have until at least 2027 to:

• create and update a risk management system from the beginning to the end of the AI system's lifecycle;
• implement a system of data governance;
• create a quality management system as well as technical documentation to show and ensure compliance with the Act and enable authorities to test compliance;
• design the AI so that it automatically and regularly keeps and updates records to indicate any risks or significant changes to the AI;
• give instructions on how to use the AI to its deployers; and
• design the AI so that humans can oversee it and so that the AI is secure, works correctly and gives the correct output.

"Unacceptable risk" AI systems

The Act has prohibited unacceptable risk AI systems since 2 February 2025. There are eight AI systems that are banned under the Act for posing a significant threat to its users and society more widely. These include systems that involve socially scoring people (e.g. ranking users or groups of users based on personality traits and resulting in detrimental or unfavourable treatment), emotion recognition in the workplace or educational institutions, and the use of biometric information for categorisation systems inferring sensitive attributes (e.g. gender, religion, ethnicity). The European Commission has recently approved guidelines on prohibited AI practices.

What do employers need to do?

If your business, or part of it, comes within the scope of the Act, you should take action now to ensure you fulfil your obligations under the Act:

• Audits: Consider conducting an audit of the AI systems you currently use in case they fall within the "unacceptable risk" or "high risk" categories. If any AI within those categories is identified, you should phase them out or alter them immediately to avoid the consequences of non-compliance.
• Policies: Implement AI governance policies to clearly outline how employees should responsibly use AI to adhere to the Act.
• Training: Consider training on AI usage to help employees understand the challenges, risks and opportunities that AI presents and their role and responsibilities.
• Supplier compliance: If you use third-party providers for your AI systems (e.g. for AI in recruitment), ensure that the AI provider complies with the Act and review your supplier contracts to ensure liability for non-compliance rests with them.

By taking positive action now to ensure compliance with the Act, employers can maintain a people-centred workplace culture and avoid substantial fines, as well as reputational repercussions. If you have any questions or require assistance relating to the Act, please get in touch with your usual Dentons contacts.