EU AI Act 2025 Update: GPAI Rules Before 2026 Deadline

Picture this: you apply for a job you're genuinely qualified for. You hear nothing. No feedback, no interview, no explanation. Weeks later, you find out the company was using an AI tool to screen every application, and yours never made it past the first filter. You ask why. The recruiter shrugs and says, honestly, "We're not sure. The system scored you low."

That's not a hypothetical. It's happening right now, in hiring offices around the world. And a major new law in Europe just declared it unacceptable.

The Problem Nobody Wanted to Name

AI in hiring isn't new. Companies have been using software to scan résumés, rank candidates, and flag "flight risks" among current employees for years. What is new is the scale, the invisibility, and, until recently, the total lack of rules around it.

Here's what a lot of organisations quietly built over the past decade: a patchwork of AI tools, each bought from different vendors, each making small automated decisions, none of them properly connected or explained. HR might use one tool to screen applications, another to score interview videos, another to flag performance patterns. Mercer, one of the world's largest HR consulting firms, calls what resulted from this "fragmented tool landscapes", a polite way of saying nobody actually knows how all these pieces interact or what they're really measuring.

The driving force behind this chaos? Mercer puts it bluntly: "AI initiatives have been shaped by fear of missing out (FOMO), anything 'AI-powered' sounded like progress." So companies bought. They deployed. They automated. And they largely skipped the hard part: checking whether any of it was actually fair.

"Recruiters must understand the rationale of AI solutions and decisions to ensure that hiring decisions are explainable, for example, in the form of transparency reports." Mercer, "From Regulatory Constraint to Strategic Compass"

That's not a small ask. Most organisations using AI hiring tools today couldn't produce a transparency report if you handed them a week and a whiteboard. This article is part of a series, start with The Ai Rule That Decides If Your Job Loan Or Face Gets A Hum.

---

What the EU AI Act Says About Rules for AI Systems (In Human)

The EU Artificial Intelligence Act, officially finalised on May 21, 2024, takes a straightforward approach: the more an AI system can affect your life, the more rules apply to it. The highest-stakes category is called "high-risk." And right there in the list, alongside things like medical devices and credit scoring, is hiring and HR software.

According to Mercer's legal analysis of the act, "Annex III Systems", which is the law's official term for this high-risk category, specifically covers AI used for employment evaluation and recruitment. That means tools that score your CV, rank you against other candidates, decide who gets promoted, or flag underperformers are now legally classified as high-risk technology. The binding compliance deadline for these systems arrives this August 2026.

What does "high-risk" actually require? Three things, in plain terms: the company must be able to explain what the AI is measuring and why; a human must be genuinely in the loop, not just rubber-stamping a machine's decision; and there must be a way to audit what happened, a real record, not a shrug.

---

Why "Unfair" Isn't Just Uncomfortable, It's Now Illegal

Here's the part that should genuinely worry you, especially if you've applied for a job recently or work somewhere that tracks performance metrics.

AI tools learn from historical data, meaning they learn from the past. If a company historically promoted mostly 35-year-old men from elite universities, an AI trained on that company's data will quietly learn to favour profiles that match those men. It won't announce this. There's no flashing warning light. It just... weights things that way. Legal firm Sanford Heisler Sharp McKnight puts the risk plainly: employers using flawed AI tools may unintentionally discriminate against applicants based on race, gender, age, or disability, and they're still legally on the hook for it.

In the US, the Equal Employment Opportunity Commission (the EEOC, the federal body that enforces workplace discrimination laws) has made its position clear: if your AI hiring tool produces discriminatory outcomes, that's your liability as the employer. It doesn't matter if a vendor built the tool. You used it. You own the outcome.

New York City already passed its own law, Local Law 144, requiring companies using AI hiring tools to carry out independent bias checks (called "audits") and disclose their use to candidates. California followed in October 2025. The EU's law is simply the biggest, most comprehensive version of what's clearly becoming a global shift. Previously in this series: Sick Kid Dead Scanner When Your Fingerprint Becomes Your Onl.

---

The Gap Between What Exists and What the Law Now Demands

Here's the uncomfortable truth most HR departments haven't fully confronted: they don't actually know everything their AI tools are doing.

That's not cynicism, it's the honest conclusion of years of fast, FOMO-driven AI adoption. A tool gets bought because it promises to save time. It gets integrated into the hiring workflow. Six months later, nobody can fully articulate what signals it weighs most heavily, or whether those signals are actually predictive of job success, versus just predictive of "looks like someone we already hired."

According to CIO Magazine, the explainability requirement cuts to this directly: if the only explanation a company can offer for a hiring decision is "the AI scored them low," that process will not survive legal scrutiny. The standard the EU AI Act sets is specific documented criteria, what factors were measured, how candidates performed against them, and why those factors were chosen in the first place.

That's a genuinely high bar. And a lot of organisations aren't close to meeting it.

Academic research published in a 2024 paper on fairness in AI-driven recruitment underlines why this matters beyond compliance: bias in hiring AI tends to compound quietly over time, because each round of biased decisions generates new training data, which makes the next round more biased. Without an external check, a real audit, done by someone independent, there's no natural correction mechanism. The bias doesn't announce itself. It just keeps running.

Mercer's framing is that all of this is actually an opportunity, not just a headache. Used properly, being forced to explain your AI decisions should reveal which tools are genuinely useful and which ones were just pattern-matching against whoever you happened to hire five years ago. That's worth knowing. An algorithm that scales decisions while also scaling bias isn't progress, it's a lawsuit with a loading bar.

One Thing You Can Actually Do Right Now

You probably can't demand a transparency report from every company you apply to, not yet, and not everywhere. But you can ask.

Before or after an interview, it's completely reasonable to ask whether any AI tools were used in the screening or assessment process. Ask it plainly: "Was automated screening software involved in reviewing my application?" A company that's done its homework will answer clearly. One that hasn't will stumble, and that tells you something useful about how they handle accountability in general.

If you're in a role where performance tracking software is used, monitoring outputs, flagging patterns, scoring productivity, ask your HR department what that software measures, who reviews its outputs, and how you'd challenge a decision you thought was wrong. These aren't aggressive questions. They're exactly the questions the EU AI Act says you're now entitled to have answered.

At CaraComp, the core problem we think about constantly is this: in a world where machines make consequential judgments about people, from identity verification to job screening, the question "how do I know this decision is right?" has to have a real human answer behind it. Not a score. Not a confidence percentage. A person who can look you in the eye and explain it. That's not nostalgia for a pre-AI world. That's just basic accountability.

"An algorithm that scales decisions while also scaling bias is not progress, it is a reputational, legal, and business risk." Mitratech, on AI accountability in recruiting

Here's the thing about the August 2026 deadline: it applies to companies operating in the EU. But the questions it's forcing those companies to answer, what does your AI actually measure? can you explain that decision to the person it affected? is a human genuinely responsible?, those questions don't respect borders. Workers and job seekers everywhere are going to start expecting these answers. The companies that can give them will have a real advantage. The ones that can't will have a very expensive problem on their hands.

The next time you don't hear back after applying for a job, there's a non-trivial chance a machine made that call. The interesting question isn't whether that bothers you. It's whether anyone at that company could tell you which machine, what it measured, and why it was wrong, if it was. Right now, at most companies, the honest answer is no. That's what this law is trying to fix. Whether it actually does will depend entirely on whether ordinary people start asking for the explanation they're owed.

Member States and the Rollout of the EU AI Act

The EU AI Act does not enforce itself from Brussels alone. Each of the EU's member states must stand up its own market surveillance authority, the body that actually investigates complaints, requests documentation from companies, and issues penalties when a high-risk AI system, like a hiring tool, is not compliant. That structure matters for job seekers because it means a complaint about an unfair AI hiring decision does not vanish into a distant EU bureaucracy, it gets routed to a national regulator with real enforcement power.

Systemic Risk and Why GPAI Models Get Extra Scrutiny

Separate from the high-risk category that covers hiring tools, the EU AI Act also singles out general-purpose AI, or GPAI, models that pose "systemic risk", meaning models powerful enough that their failures or misuse could ripple across many sectors at once. A hiring platform that is built on top of one of these large GPAI models inherits some of that scrutiny, since the company deploying it still has to demonstrate the underlying model was developed and documented responsibly. Systemic risk obligations exist precisely because a single flawed foundation model can quietly bias every AI system, including hiring software, that gets built on top of it.

Rules for AI Systems That Rank or Score People

Under the act, AI systems that rank, score, or evaluate people for employment fall under some of the strictest rules the law contains. Article-level obligations require the company deploying such a system to keep detailed technical documentation, to log how the AI systems arrived at each decision, and to make that record available to regulators or affected individuals on request. In practice, this means companies can no longer treat their hiring AI as an unexaminable black box, the rules require it to be auditable from the moment it is deployed.

What Changes for Public-Facing AI in August 2025

By august 2025, obligations tied to GPAI models and systemic risk begin phasing in ahead of the broader high-risk compliance deadline set for August 2026. This staggered rollout gives the European Commission time to publish guidance and gives companies a runway to align their AI systems, including the ones used in hiring, with the act's documentation and transparency rules before the heaviest obligations land. For job seekers, the practical effect of the 2025 obligations is that the GPAI models sitting underneath many hiring tools will already be operating under stricter transparency rules by the time the hiring-specific deadline in August 2026 arrives.

How the Commission Is Preparing Companies for Compliance

The European Commission has been publishing implementation guidance and standards to help companies interpret exactly what "high-risk" documentation and human oversight require in practice. This matters because the act's text sets the obligations, but it is the Commission's practical guidance that tells an HR department what a compliant audit trail or transparency report actually looks like. Companies that ignore this guidance and wait until closer to the deadline risk finding out, too late, that their existing AI systems do not meet the documented standard the act demands.

Taken together, the EU AI Act's timeline, the 2025 GPAI obligations, the August 2026 high-risk deadline, and the ongoing Commission guidance, forms a single connected system rather than one isolated rule. A hiring platform built on a GPAI model, deployed by a company operating across several member states, and used to rank or score candidates touches nearly every layer of the act at once. Understanding that overlap is exactly why job seekers, HR departments, and compliance teams are all watching the same law for slightly different reasons.

GPAI Became Effective Before the Wider High-Risk Deadline

It is worth restating plainly: gpai became effective as a regulated category months before the high-risk obligations that govern hiring tools kick in. This sequencing was deliberate, the European Union wanted foundation-model providers held to transparency obligations early, so that by the time high-risk deployers, including HR platforms, must comply in August 2026, the models underneath them are already documented. For anyone tracking the eu ai act august 2025 milestone, this is the concrete thing that actually changed that month, not the hiring rules themselves, but the layer beneath them.

The transparency obligations that came into force in 2025 require gpai providers to disclose training data summaries, document known capabilities and limitations, and cooperate with the Commission on systemic-risk assessments. None of that is optional paperwork, it is the foundation the rest of the act depends on. A company that skipped it cannot credibly claim, a year later, that its high-risk hiring system was built on a well-documented model.

It also helps to see how this compares with earlier EU tech law, since the act did not invent transparency obligations from nothing. The European Union has required disclosure and documentation in other regulated sectors for years, and the ai act rules for gpai models borrow that same logic: the bigger the potential blast radius of a system, the earlier and more detailed the disclosure has to be. That is also the thinking behind why member states were given time to build enforcement capacity before the heavier hiring-specific deadline lands.

None of this is about slowing AI down for its own sake, the stated goal, repeated across Commission guidance, is to make ai safer for the people affected by it, whether that is a job applicant, a loan applicant, or someone flagged by a public-sector system. The august 2025 obligations are the first real test of whether that goal translates into practice, since they are the first obligations under the act that gpai providers actually have to meet, rather than plan for.

For job seekers and HR teams alike, the practical takeaway is the same one running through this whole article: ask what changed, and when. If a hiring platform's underlying model became subject to transparency obligations in 2025, that is a fact worth asking a vendor about directly, and a company with nothing to hide should be able to answer it in a sentence, not a shrug.

Anyone searching for the eu ai act 2025 update is really asking one plain question: what changed this year, and does it touch me? The honest answer is that the eu ai act 2025 update is mostly about the plumbing beneath hiring tools, not the hiring rules themselves, but that plumbing still shapes whether the ai act compliance a company claims later actually holds up. High-risk systems, including the ones used to screen job applicants, depend on the GPAI layer underneath being properly documented, so this year's act update is the quiet groundwork for next year's louder deadline.

Act implementation has never been a single flashing switch, it is a sequence of implementing acts, guidance documents, and Commission publications that arrive in stages. The digital omnibus discussions circulating in Brussels touch on how the EU coordinates this kind of staged rollout across its wider digital rulebook, since the act does not exist in isolation from the EU's other digital and data rules. Understanding that wider digital context helps explain why the timeline was built the way it was, rather than as one single hard deadline.

For companies, act compliance in 2025 mostly means proving the information trail exists, what the model was trained on, what its known limits are, and who is accountable if something goes wrong. That information has to be available not just to the Commission but, eventually, to the people affected by decisions the model contributes to. Good governance in this context is not a vague ideal, it is a specific paper trail: documented data sources, documented limitations, and a documented chain of responsibility from the GPAI provider down to the HR platform using it.

The updated guidelines the Commission has been issuing alongside the act exist to translate legal text into something a compliance officer can actually action. Responsible ai use, in the Commission's own framing, is not just about avoiding harm, it is about being able to prove, on request, that the harm was considered and addressed before deployment. That governance requirement runs through every layer of the act, from the GPAI provider at the bottom to the hiring platform a job seeker actually encounters.

None of this changes what a job seeker should do in the meantime. Ask the same questions this article has raised throughout, what does the ai measure, who reviews it, and can someone explain the decision in plain language. The eu ai act 2025 update matters because it is the year the answers to those questions started having real paperwork behind them, even if the loudest deadline for hiring specifically still sits a year further out.