What the EU AI Act means for your HR work

AI already screens candidates, reads employee feedback and flags who might be about to leave. The EU AI Act changes the rules for all of it, and HR teams will carry part of the responsibility. We asked Jacob Österberg, VP Corporate Development at Winningtemp, what you need to know, what to ask your vendors and how to get ready.

The date that matters for HR is 2 December 2027. That's when the core obligations for high-risk AI systems listed in Annex III of the Act start to apply. Employment is on that list.

It sounds far away. If you're buying or renewing an HR system in the next twelve months, it isn't. The system you sign for now is the one you'll have to stand behind when the rules kick in.

The AI Act applies to AI used in the EU. If your organisation has employees or candidates in an EU country, it applies to you, wherever your vendor is based. If you operate only outside the EU, the Act doesn't affect your HR processes directly.

"HR as a whole is becoming a regulated market"

Jacob, what's the biggest change the AI Act brings for HR?

"HR as a whole is becoming a regulated market. Recruitment systems, HR systems and platforms like ours, for engagement and performance, will be held to a higher standard. They'll be examined far more closely than unregulated software."

Does that change how HR teams can use AI day today?

"Yes. You probably won't be able to use AI the way you're used to. The regulation will set out how you're allowed to use it and which systems you're allowed to use. For HR, that's the real shift."

We'd rather be prepared than have our customers classify us and deal with it afterwards.

Most AI in HR will be classed as high-risk

Which HR systems are we talking about?

"Most AI systems in HR will be classed as high-risk, and that comes with stricter rules. We'll most likely classify ourselves as high-risk too."

That classification is more than a label. It decides what a vendor has to document, test and be transparent about, and what you as a buyer have the right to expect.

Many HR teams use general AI assistants for everyday tasks. Is that a problem?

"It can be. You need a model that meets the regulation, and not every general-purpose assistant does. Look at where your data is processed and stored, and whether the model can run in a closed environment so the data stays inside the system. European models or open-source models are worth considering for exactly that reason.

You can keep using the tools you already have. Just be careful with them in high-risk areas, and HR systems are exactly that."

Employee feedback shows why this matters. Comments in an engagement survey are some of the most candid things people write at work: about their manager, their workload, how they're really doing. People only write them if they trust where that data ends up.

What to ask before you sign

If you’re buying a new HR system today, what should you ask for?

"Ask the vendor how they're working with the AI Act. Do they hold ISO 27001 and ISO 27701? Do they have a plan for ISO 42001? The answers tell you a lot about how seriously they're preparing."

What the certifications mean

ISO 27001 covers information security.
ISO 27701 covers privacy and the handling of personal data.
ISO 42001 is the standard for managing AI responsibly.
ISO 9001 covers quality management.

None of them equals AI Act compliance on its own, but together they showwhether a vendor has the structure to get there.

How Winningtemp is preparing

What is Winningtemp doing?

"We already hold ISO 27001 and 27701, and our board has decided we'll implement ISO 42001 and ISO 9001. We'll also most likely classify ourselves as high-risk on our own initiative. We'd rather be prepared than have our customers classify us and deal with it afterwards."

Is anything still unclear?

"There are parts of the regulation the EU still needs to clarify. But we're well prepared, and we'll be done well ahead of the deadline."

Checklist: five things to start on now

The AI Act doesn't only put demands on the companies that build HR systems. If your organisation uses a high-risk AI system, you carry responsibility too. Start here:

1. Map where AI is used in your HR processes

Recruitment, performance, employee feedback, scheduling. You can't assess risk in systems you don't know use AI.

Ask each system owner one question: "Does this tool use AI to sort, score, summarize or recommend anything about people?"

2. Ask your vendors the hard questions

Which certifications do they hold? How do they classify their system under the AI Act? Where does your data go, and which AI models process it?

3. Keep a human in the loop

High-risk AI in HR should support decisions, not make them. Make sure someone with the right competence can understand, question and override what the system suggests.

4. Talk to your people early

Employees and their representativesshould know when AI plays a part in decisions about their working life. In theNordics, trust is the foundation. It's also what makes people answer honestlywhen you ask how they're doing. Being open about AI protects both.

5. Use the runway

December 2027 gives you time to do this properly instead of in a rush. The requirements haven't got any lighter. Only the date has moved.

The AI Act won't decide whether HR uses AI. It will decide whether your people can trust the AI you use.

Want to know how Winningtemp works with the AI Act and your employee data? Book a meeting with us, and we'll walk you through our certifications and our AI Act roadmap.