This article is for general informational purposes and does not constitute legal advice. AI regulation is genuinely fast-moving — employers with specific concerns should consult a qualified solicitor or the Data Protection Commission.
Most Irish employers already use some form of AI without thinking of it that way — a CV-screening tool, an applicant ranking feature inside a recruitment platform, performance-monitoring software, scheduling tools that allocate shifts algorithmically. Under the EU AI Act, several of these common HR tools fall into the Act's highest compliance tier. This article sets out what's actually settled, what's genuinely still in flux as of June 2026, and what's worth doing now regardless of which deadline ends up applying.
Which AI Tools Used in HR Are Classed as High-Risk?
Under Annex III of the EU AI Act, AI systems used in employment-related decisions are explicitly listed as high-risk. This covers AI used for:
- recruitment and candidate selection, including CV screening and ranking
- targeted job advertising
- evaluating candidates through automated assessments or video interview analysis
- performance evaluation and monitoring of workers
- task allocation based on profiling
- decisions on promotion, contract terms, or termination
The threshold that matters in practice: if a tool merely performs an administrative function with no filtering, ranking, or scoring of people, it's unlikely to be high-risk. The moment a system ranks CVs, shortlists candidates, or scores performance against criteria, it almost certainly qualifies.
When Do These Obligations Actually Apply? (Updated June 2026)
This is the part of AI governance advice that goes stale fastest, so it's worth being precise about the current state rather than quoting an old deadline as settled.
The AI Act as originally enacted set 2 August 2026 as the date high-risk obligations would apply to Annex III systems, including employment AI. Through 2025 and into 2026, the European Commission, Parliament, and Council negotiated a "Digital Omnibus on AI" intended to defer this deadline, citing delays in finalising the technical standards needed to make the obligations workable.
As of 16 June 2026, the European Parliament approved a provisional trilogue agreement that would push the deadline for Annex III high-risk systems (including employment AI) to 2 December 2027, and for Annex I systems (AI embedded in regulated products) to 2 August 2028. This agreement still needs formal adoption and publication in the Official Journal before it takes legal effect — expected before 2 August 2026, but not yet finalised at the time of writing.
What this means practically: the direction of travel is toward a later deadline, and that direction is now very well established. But until the Omnibus is formally published, the original 2 August 2026 date remains the legally operative one. Treat 2 December 2027 as the realistic planning date, keep an eye on formal confirmation, and don't let the likely deferral become a reason to stop preparing — the underlying obligations (risk assessment, human oversight, transparency, documentation) aren't going away, only the deadline is moving.
What Should Employers Do Now, Regardless of the Final Deadline?
The substance of what's required doesn't change with the timeline shift:
- Audit what you're actually using. List every tool involved in recruitment, screening, performance review, or scheduling, and check with the vendor whether it falls under Annex III.
- Keep a human in the loop. A person with real authority to override the system must be involved in any decision that affects a specific employee or candidate — not a rubber-stamp review.
- Tell people when AI is involved. Candidates and employees affected by an AI-assisted decision must be told that AI was used and given a meaningful explanation of how it influenced the outcome.
- Check the data protection angle separately. AI use in HR almost always involves processing personal data, which means GDPR applies independently of the AI Act. If an AI tool processes employee or candidate data at any scale, a Data Protection Impact Assessment is often required regardless of the AI Act's own timeline.
- Document your reasoning. Keep a record of why a tool was classified as high-risk or not, and what controls are in place. This is the kind of paper trail that matters most if a regulator or a WRC claim ever asks.
Who Actually Regulates This in Ireland?
Ireland has adopted a distributed model rather than a single AI regulator. The Data Protection Commission is one of several designated national competent authorities for AI, alongside sector regulators like the Health and Safety Authority. A new central coordinating body, the AI Office of Ireland, sits under the Department of Enterprise, Tourism and Employment and is intended to act as the single point of contact and run Ireland's AI regulatory sandbox.
For most employers, the DPC remains the regulator most likely to be relevant in practice, since AI use in HR is almost always also a data protection question.
Don't Forget Existing Employment Equality Law
The AI Act doesn't replace the Employment Equality Acts 1998–2015. An AI recruitment tool that systematically screens out candidates with career gaps, or scores older applicants lower, can constitute indirect discrimination — and the employer is liable for that outcome regardless of intent or what the vendor's documentation claims about the system. AI-assisted decisions still need to survive the same fair-procedure scrutiny as any other dismissal or disciplinary decision.