The EU Just Gave You 16 More Months on Your AI Screener. Don't Take Them.
The May 7 trilogue pushed the EU AI Act's high-risk hiring deadline to December 2027. Why US founders using LinkedIn Hiring Assistant still lose if they wait.
If you run hiring at a US company and you've been white-knuckling the August 2, 2026 EU AI Act deadline, exhale. Then read this carefully, because the relief is conditional, the trigger is broader than you think, and the people telling you to ignore it are wrong in a way that will cost you a customer before it costs you a fine.
On May 7, 2026, after the April 28 trilogue collapsed, EU negotiators reached a provisional political agreement on the Digital Omnibus. Member State representatives confirmed it in the Council on May 13. The headline: high-risk Annex III obligations, which include almost every AI tool you use to source, screen, and rank candidates, slip from August 2, 2026 to December 2, 2027. AI embedded in regulated products under Annex I slides to August 2, 2028.
That is 16 extra months to get your house in order. It is not 16 months of nothing-to-do.
The deferral isn't law yet, and August 2 is still on the books
Here is the part most founders are missing. The Gibson Dunn analysis of the May 7 deal is blunt: the changes only take legal effect once the Omnibus is formally adopted and published in the Official Journal, expected before August 2, 2026. Until then, August 2, 2026 remains an active compliance date.
If publication slips even a week, the original Annex III obligations technically apply for the gap. You do not want to be the test case for a Finnish market surveillance authority that already has live Article 99 fining powers as of January 2026. Finland was first. Germany's works councils and France's CNIL will not be far behind, and they will not enforce uniformly. The decentralized model means each member state gets to set its own enforcement priorities and interpretive style. Plan for the strictest, not the average.
The fine ceiling is the part that gets quoted. It is not the part that should keep you up at night.
The real risk is system withdrawal, not the fine
Regulators have the power to order non-compliant AI systems withdrawn or recalled from the EU market. For a US startup whose recruiting workflow runs through LinkedIn Hiring Assistant, Greenhouse scoring, Eightfold matching, or HireVue interviews, that is the operationally lethal scenario. A core tool pulled mid-quarter, with no fallback, while your competitors who built compliant pipelines keep hiring.
Worse: your EU enterprise customers are already writing AI Act language into procurement contracts. They do not care whether the Official Journal published on July 28 or August 4. They care whether you can answer their questionnaire. The customer clock is running regardless of the legal clock.
You are in scope even if you don't think you are
The standard founder reaction is "we don't sell in Europe, we don't have an EU entity, this isn't our problem." That reaction is wrong, and it is wrong in a specific, expensive way.
Article 2(1)(c) of the AI Act triggers when the output of an AI system is used in the Union. The word "used" is a deliberately lower bar than GDPR's "targeting" test. As the natlawreview analysis spells out, a US employer is covered without any physical EU presence if the AI outputs are intended to be used in the EU. Practical translations:
- You have one Berlin-based contractor and you run their application through Greenhouse's AI scoring. In scope.
- You hired a remote staff engineer in Lisbon last quarter. Your performance management tool uses AI to flag flight risk. In scope.
- You posted a role that anyone in the EU can apply to, and your ATS surfaces a ranked shortlist. In scope.
- Your global HR platform uses AI task allocation, and your Dublin sales team uses it. In scope.
Annex III explicitly classifies AI used in recruitment, candidate selection, performance evaluation, task allocation, worker monitoring, promotion, and termination as high-risk. That is the entire surface area of a modern hiring stack.
Deployer obligations cannot be contracted away
The second expensive misunderstanding: founders assume that buying LinkedIn Hiring Assistant or Eightfold means the vendor handles compliance. It does not.
Article 26 puts independent obligations on the deployer, meaning you, the company using the tool. Risk management, data governance, human oversight, automated log retention for at least six months, and a Fundamental Rights Impact Assessment where required. None of that hinges on whether your vendor has issued a compliance statement or whether the tool has an EU origin. Vendor marketing absorbs the attention; the law puts the burden on you.
The vendor sells you the gun. The Act prosecutes the person who pulled the trigger.
This matters most for the tools founders treat as commodity infrastructure. LinkedIn Hiring Assistant is the flagship case. Microsoft's pilot data is genuinely impressive: requisition drafting time drops from 3.5 hours to 45 minutes, a 28% lift in qualified pipeline from AI-recommended searches, 2.3x response rates on personalized outreach. Almost certainly classified as high-risk under Annex III point 4. You are the deployer. You owe the FRIA, you owe the logs, you owe the human oversight gate. So do the teams running Greenhouse, Lever, iCIMS, Findem, and HireVue.
What "human oversight" actually means for hiring
The phrase sounds soft. It is not. A meaningful human-oversight layer for AI hiring tools requires that a named person can:
- Understand the system's capabilities and limits well enough to spot anomalous output.
- Decide not to use the output, or override it, in any given case.
- Interpret the output in context, not as a verdict.
- Stop the system if it behaves unexpectedly.
If your "recruiter review" step is a coordinator rubber-stamping a top-10 list the AI produced, that is not oversight. That is laundering. Regulators in Helsinki, Paris, and Berlin are going to know the difference, and EU candidates have private rights of action.
This is also where the sourcing workflow itself matters. If your pipeline starts with a black-box ranker that nobody on your team can audit, oversight is a fiction. If it starts with a query you wrote in plain English and a shortlist you can interrogate name by name, oversight is real. That is part of why we built Refolk the way we did: you describe who you want, you get back a ranked list of actual people across GitHub, LinkedIn, and the open web, and the reasoning is legible enough that a recruiter can defend every name on it.
The 152,000-person reason this isn't an edge case
Founders convince themselves the EU exposure is a rounding error. It is not, and the labor market data makes that obvious.
If you are hiring senior technical talent in 2026, you are almost certainly touching this pool, whether you planned to or not. Remote-friendly US companies have been the largest single buyer of EU senior engineering capacity for three years running. Every one of those candidates triggers the Act the moment your AI screener emits an output about them.
What to do in the next 51 days
Treat the legal-limbo window as a free deadline. If you finish before August 2, you are protected regardless of whether the Official Journal publishes on time. If publication slips, you are still protected. If it lands early, you are ahead of the December 2027 substantive deadline by 16 months and you can use that time to actually integrate compliance into your workflow rather than bolt it on.
A reasonable order of operations:
1. Inventory the AI in your hiring stack
List every tool that scores, ranks, matches, screens, summarizes, or recommends candidates. Include the obvious (LinkedIn Hiring Assistant, Greenhouse AI, Eightfold) and the easy-to-miss (Notion AI summarizing interview notes, ChatGPT drafting outreach, your ATS's "similar candidates" feature). GPAI provider obligations under Articles 51 to 55 have been live since August 2025, untouched by the Omnibus. If your screener wraps OpenAI or Anthropic, that's already in scope.
2. Decide what stays, what goes, what gets a gate
For each tool: is the EU exposure worth the compliance lift? For some line items the answer is obviously yes (your ATS). For others, you may decide that an AI feature you barely use is not worth the FRIA. Turn it off. Document the decision.
3. Build a real human-oversight step
Not a checkbox. A named reviewer, a written standard for when to override, and logs you can produce on demand for at least six months. This is where most companies will fail an audit.
4. Rewrite the sourcing top-of-funnel
The cleanest way to reduce AI Act exposure in candidate discovery is to use tools where the human is in the loop from the first query. Plain-English sourcing, where you describe the person you want and review the actual matches, is structurally easier to defend than a black-box scoring engine that ranks 4,000 inbound applications. Several customers have moved their EU-touching sourcing entirely onto Refolk for exactly this reason: the query is auditable, the candidate set is auditable, and there is no opaque scoring layer in between.
5. Update your vendor contracts
Push your ATS and sourcing vendors for written statements on Annex III classification, FRIA support, log export, and bias testing. If they cannot answer in May 2026, they will not be able to answer in November 2027 either.
6. Brief your EU-based hires and contractors
They have rights under the Act. They will exercise them. Better that they hear about your AI use from you than from a works council.
The pattern to remember
Every regulatory cycle has the same shape. A deadline gets set. Founders panic. A deferral gets negotiated. The same founders use the deferral as permission to do nothing. Then the original deadline arrives in slightly modified form, and the companies that took the warning seriously eat the ones that did not.
The August 2 cliff is probably gone. December 2, 2027 is real. Finland is already enforcing. Your EU customers are already asking. Your Berlin contractor is already covered. The 16 months the trilogue gave you is a gift on paper. Spend it.
FAQ
Does the EU AI Act apply to my US startup if I don't sell in Europe?
Yes, if your AI hiring tools produce outputs about EU-based candidates, contractors, or employees. Article 2(1)(c) triggers on output use in the Union, which is a deliberately lower bar than GDPR's targeting test. One Berlin contractor whose application was scored by your ATS is enough to bring you in scope. You do not need an EU entity, an EU office, or EU revenue.
Did the May 7 trilogue actually delay the August 2, 2026 deadline?
The provisional political agreement reached on May 7 and confirmed by the Council on May 13 defers stand-alone Annex III high-risk obligations to December 2, 2027 and Annex I product-embedded AI to August 2, 2028. But the changes only take legal effect once the Digital Omnibus is published in the Official Journal, expected before August 2, 2026. Until publication, the original date stands. Plan for the original, benefit from the deferral.
Is LinkedIn Hiring Assistant a high-risk AI system?
Almost certainly yes under Article 6 and Annex III point 4, which covers AI used in recruitment and candidate selection. The same applies to AI resume screeners, ATS scoring tools like Greenhouse, Lever, iCIMS, and Eightfold, and video interview platforms like HireVue. Crucially, deployer obligations under Article 26 sit with the company using the tool, not the vendor selling it. You cannot contract out of risk management, human oversight, log retention, or FRIA duties.
What's the worst-case enforcement outcome?
Fines reach €15 million or 3% of global annual turnover for deployer violations, €35 million or 7% for prohibited practices, and €7.5 million or 1% for misleading regulators. But the more dangerous outcome for most companies is system withdrawal: regulators can order a non-compliant AI tool pulled from the EU market mid-contract. If your hiring depends on LinkedIn Hiring Assistant or an ATS scoring engine, a withdrawal order is operationally worse than a fine you can pay and move past.