Your AI hiring tool might be high-risk under the AI Act. Here's what that means.
AI Act transparency rules apply from August 2, 2026. High-risk employment AI rules apply from December 2, 2027. Practical preparation guide.
AI Act 2026 Checklist for Chatbots, HR Tools, and Internal AI Workflows
The AI Act is not only a legal topic. Companies need an inventory of AI tools, owners, data, risks, logs, human review, and vendor responsibilities.
Start the AI register with the tools your support, HR and sales teams already use. Record the purpose, the data involved and the owner of each one. That inventory lets you assess which AI Act obligations apply to your use.
This article is not legal advice. It is a technical and organizational checklist for management, IT, and product owners.
Timeline to know
The AI Act entered into force on 1 August 2024. Its obligations do not all arrive with it, which is why the date on the press release tells you almost nothing about what your company has to do this quarter. Prohibited practices and AI literacy obligations have applied since 2 February 2025. General-purpose AI models came next, on 2 August 2025. Then transparency, from 2 August 2026, which covers chatbot interfaces as well as selected AI-generated content.
The European Commission’s current timeline sets 2 December 2027 for high-risk uses in areas including employment and 2 August 2028 for systems embedded in regulated products. The AI Omnibus entered into force on 27 July 2026. Those later dates do not postpone obligations already in application, so continue the inventory, staff training and transparency work.
Which AI uses to check first
Start where AI talks to people, where it processes personal data, or where it could tip the decision.
Typical areas:
- website or app chatbot,
- AI in customer support,
- HR screening, CV ranking, or worker management,
- internal agent with access to CRM, ERP, email, or documents,
- generated marketing content, images, voice, or video,
- scoring of customers, priorities, risks or access to the service itself.
HR deserves special attention. Read our article on AI Act and high-risk HR AI if you use AI in hiring or employment.
AI register as the minimum
On a smaller screen, scroll the table horizontally.
| Item | What to record |
|---|---|
| Tool name | for example web chatbot, CRM agent, HR screening |
| Owner | business owner and technical owner |
| Purpose | what the tool does and why |
| Data | inputs, personal data, sensitive data, sources |
| Vendor | custom solution, SaaS, API provider, model provider |
| Users | employees, customers, candidates, partners |
| Risk | low, medium, high, and why |
| Human review | where a person checks or approves output |
| Transparency | how the user is informed |
| Logging | what is logged and for how long |
| Status | idea, pilot, production, disabled |
An AI register is useful even outside compliance. Management can see where AI is duplicated, which tools leak data, and which ones have no technical controls at all.
Technical controls for an AI workflow
Ask these questions for every internal AI workflow:
- Does the tool have a clear owner?
- Is the purpose and scope documented?
- Do we know what data it processes?
- Is the user told when they interact with AI or when AI materially contributes to the output?
- Are permissions limited to the minimum?
- Are inputs, outputs, tools and every resulting decision written to a log?
- Can a person stop or change a risky output?
- Is there an incident process?
- Can the vendor provide documentation?
- Does the company have rules for generated content?
With custom software, these controls can be designed from the start. With SaaS tools, you need to ask what the vendor can actually provide.
Where RISE can help
RISE helps implement the technical controls. An AI register, permissions and approval workflows need to connect to the systems you already use. A lawyer handles the legal assessment.\n\nStart with AI automation or contact us if you need help putting those controls in place.
Sources
- European Commission: AI Act
- European Commission: Political agreement on AI rules
- AI Act Service Desk: Frequently Asked Questions
- European Commission: GPAI Code of Practice
FAQ
Does the AI Act apply to companies that only use AI?
Yes. Depending on the use case, deployers and ordinary users of AI systems can carry obligations too, not only the providers who trained the model in the first place. The scope depends on purpose and risk category.
Are AI agents a separate category?
The AI Act Service Desk says AI agents are not a separate category. The rules depend on what the agent does and which risk category the use case falls into.
Does a chatbot need to be labelled as AI?
Systems that interact with natural persons need transparency, and the relevant rules have applied since 2 August 2026. The exact wording and format depend on the implementation.
Is this legal advice?
No. Take this as a technical and organizational checklist, hand the legal assessment to a lawyer or compliance specialist, and treat the two as separate jobs.
Founder and CEO of Rise.sk. He designs and delivers web applications, data systems, and automation, and writes about software decisions, AI, and digital services.
- Software architecture
- AI automation
- Data systems
Back to blog
Share:
Read Next
Instant payments in the EU: What changes for payment matching and cash flow
Instant transfers and automatic matching solve different problems. Check the timeline for your bank, verification of payee outcomes and the rules in your ERP.
AI Phishing and Deepfakes. Verify the Sensitive Request
Correct language and a familiar voice do not establish identity. Verify bank-detail changes through a known contact and rehearse the team response.