EU AI Act — Paritas Regulatory Guide

Overview

The EU Artificial Intelligence Act (Regulation 2024/1689) is the first comprehensive legal framework for AI anywhere in the world. It establishes a risk-based approach to AI regulation, with the strictest requirements applying to "high-risk" AI systems—a category that explicitly includes AI used in employment, recruitment, and worker management.

The AI Act entered into force on August 1, 2024, with a phased implementation timeline. Most obligations for high-risk AI systems will apply starting August 2, 2026. For US companies with European operations or customers, compliance is not optional—the Act has extraterritorial reach.

Implementation Timeline

Aug 2024

Entry into force

AI Act officially becomes EU law

Feb 2025

Prohibited AI practices

Bans on social scoring, emotion recognition in workplaces, etc.

Aug 2025

Governance structures

Member states designate supervisory authorities

Aug 2026

High-risk AI system obligations

Full compliance required for employment AI systems

Employment AI: High-Risk by Default

Annex III of the AI Act explicitly classifies the following employment-related AI systems as high-risk:

AI for recruitment and selection, including screening, filtering, or assessing candidates
AI for making promotion and termination decisions
AI for allocating tasks based on individual behavior or personal characteristics
AI for monitoring and evaluating performance and behavior of workers

Emotion Recognition Prohibited

The AI Act prohibits AI systems that infer emotions of workers in the workplace, except for medical or safety purposes. If your video interview tool claims to analyze facial expressions or emotional states, it may be outright banned in the EU.

Requirements for High-Risk Employment AI

1. Risk Management System

You must establish and maintain a risk management system that:

Identifies and analyzes known and foreseeable risks
Estimates and evaluates risks from intended use
Adopts appropriate risk management measures
Ensures continuous iterative testing throughout the system lifecycle

2. Data Governance

Training, validation, and testing data must meet quality criteria:

Data must be relevant, representative, and free of errors
Bias testing must examine potential discriminatory impacts
Statistical properties must be understood and documented

3. Human Oversight

High-risk AI systems must be designed for effective human oversight:

Humans must be able to fully understand the system's capabilities and limitations
Humans must be able to interpret outputs correctly
Humans must be able to decide not to use, override, or reverse the system's output

4. Transparency & Documentation

Extensive documentation and disclosure requirements:

Technical documentation detailing system design and functionality
Automatic logging of system operations
Instructions for deployers on safe and compliant use
Disclosure to affected persons that AI is being used

5. Conformity Assessment

Before placing a high-risk AI system on the EU market, providers must conduct a conformity assessment to demonstrate compliance. For employment AI, this can typically be done via self-assessment (rather than third-party certification).

Implications for US Companies

The EU AI Act has extraterritorial reach. It applies to US companies if:

You place AI systems on the EU market (sell or license AI tools to EU customers)
You deploy AI systems in the EU (use AI for decisions affecting people in the EU)
The output of your AI is used in the EU, even if the system runs outside the EU

For US employers with EU operations: if you use AI hiring tools to recruit, evaluate, or manage workers in EU member states, you are subject to the AI Act regardless of where your company is headquartered.

How Paritas Helps

A Paritas audit helps you meet EU AI Act requirements:

Bias Testing: Our disparate impact analysis directly addresses the AI Act's requirement to examine datasets and outputs for potential discriminatory impacts.
Documentation: Our audit reports provide the statistical analysis documentation required for conformity assessment.
Risk Identification: Our three-tier classification identifies which demographic categories pose compliance risk.
Multi-Jurisdiction Coverage: Enterprise audits map findings against EU AI Act requirements alongside US regulations.
Remediation Roadmap: Our prioritized recommendations provide documented steps you're taking to address identified risks.

EU Artificial Intelligence Act