Who must comply with NYC Local Law 144?

Any employer or employment agency using an automated employment decision tool (AEDT) to screen candidates for a job located in New York City, regardless of where the employer is headquartered. They must run an independent bias audit within the prior year, publish the summary, and notify candidates at least 10 business days in advance.

When do EU AI Act obligations apply to hiring systems?

AI systems used for recruitment and employee selection are high-risk under Annex III 4(a). High-risk obligations for hiring systems apply from December 2, 2027, delayed from the original August 2026 date under the EU's Digital Omnibus on AI, approved by the Council on 29 June 2026, covering risk management, data governance, human oversight, transparency, logging, and post-market monitoring.

An Automated Employment Decision Tool is any computational process derived from machine learning, statistics, or AI that produces a score, classification, or recommendation used to substantially assist or replace discretionary hiring or promotion decisions.

What are the penalties for NYC Local Law 144 non-compliance?

Fines start at $500 for a first violation and reach $1,500 for each subsequent violation. Each day of non-compliant use and each missed candidate notice counts as a separate violation.

Can our AI vendor perform our bias audit?

No. NYC Local Law 144 requires an independent auditor with no role in building, selling, or using the tool and no financial interest in it. Vendors can supply data but cannot serve as the independent auditor.

Research Library · United Kingdom

The EU AI Act Deadline Moved to December 2027: What That Actually Changes for UK Employers

Summary: On 29 June 2026, the Council of the EU gave final approval to the Digital Omnibus on AI, confirming a 16-month delay to the EU AI Act's high-risk obligations. Standalone high-risk systems under Annex III, which includes recruitment and employment decisions, now have until 2 December 2027 to comply, not 2 August 2026 as originally scheduled. For UK employers hiring into the EU, or running EU entities, this materially changes the near-term planning horizon. It changes almost nothing about the UK's own rules, which were never tied to this deadline.

What actually moved

The European Commission proposed the Digital Omnibus on 19 November 2025, in response to implementation being visibly off track, particularly around the finalisation of harmonised technical standards needed for high-risk compliance. After a stalled trilogue in April 2026, the European Parliament, Council, and Commission reached provisional agreement on 7 May 2026. Parliament formally approved it on 16 June 2026, and the Council gave final approval on 29 June 2026.

The result: Annex III standalone high-risk systems, covering recruitment, candidate selection, promotion, termination, task allocation, and performance monitoring among other categories, move from 2 August 2026 to 2 December 2027. Annex I embedded high-risk systems, such as AI inside medical devices, move from 2 August 2027 to 2 August 2028.

Two related dates also shifted. Article 50 transparency and synthetic-content marking obligations move from 2 August 2026 to 2 December 2026, with a grace period for content already on the market at that point. The deadline for member states to establish national AI regulatory sandboxes moves to 2 August 2027.

What did not move

The delay is targeted, not a general reprieve. Article 5's prohibited practices, the outright bans on certain AI uses, were not delayed and continue to apply on their original schedule. The Act's classification of recruitment and employment AI as high-risk under Annex III has not changed. What moved is when the full compliance machinery, conformity assessment, technical documentation, risk management systems, human oversight architecture, and post-market monitoring, must be in place.

Employment-related AI remains squarely high-risk. The delay changes the deadline for demonstrating compliance, not the underlying classification or the eventual obligation.

Why this matters specifically for UK employers

A UK-headquartered employer with no EU entity and no EU candidates is not directly affected by this deadline either way, since the EU AI Act's employment provisions apply based on where the system's output is used or where the employer is established, not simply because the company is in the UK.

The employers this changes things for are UK companies hiring into the EU, UK companies with EU subsidiaries or entities, and UK companies whose AI hiring tools are used to evaluate candidates for EU-based roles. For that group, the practical compliance deadline just moved out by sixteen months, which changes near-term prioritisation without changing the eventual obligation.

Why the UK side is unaffected

It is worth being explicit about this, because the two regimes are easy to conflate. The Data (Use and Access) Act's changes to UK GDPR automated decision-making, Articles 22A to 22D, took effect on 5 February 2026 and were never tied to the EU AI Act's timeline. The ICO's active enforcement posture on recruitment ADM, including the March 2026 letters to 16 organisations, is a UK GDPR matter, not an EU AI Act one. Nothing in the Digital Omnibus changes any of it.

An employer hiring in London should not read the EU delay as license to slow down on Article 22C safeguards, DPIAs, or ICO readiness. Those obligations are already in force and unaffected.

What to actually do with the extra time

For employers now working against a December 2027 EU AI Act deadline rather than an August 2026 one, the sensible use of the additional runway is not to stop preparing, but to sequence differently.

Continue UK GDPR and Equality Act work on the original timeline, since neither moved.
Use the additional EU AI Act runway for the harder structural work, conformity assessment processes and technical documentation, that benefits from not being rushed against a compressed deadline.
Watch for the finalisation of harmonised technical standards, since part of why the delay happened was that those standards were not ready, and their eventual publication will sharpen what conformity assessment actually requires.
Do not let old content or internal planning documents built around the August 2026 date persist uncorrected. A surprising amount of employer-facing material, including from advisory firms, continued citing the original date for months after the delay was agreed, since the negotiation played out over several months before Council approval made it final.

Frequently asked questions

Is the December 2027 date final, or could it move again? It was confirmed by final Council approval on 29 June 2026, with entry into force following publication in the Official Journal. Barring further legislative amendment, this is the operative date.

Does the delay apply to all EU AI Act high-risk categories? The 16-month delay to 2 December 2027 applies to Annex III standalone high-risk systems, which includes employment. Annex I embedded systems have a different, 12-month delay to 2 August 2028.

Does this affect UK GDPR automated decision-making rules? No. Those rules, Articles 22A to 22D, commenced 5 February 2026 under the DUAA and are entirely independent of the EU AI Act's timeline.

Should UK employers hiring only in the UK care about this at all? Only indirectly, as useful context. The deadline change is most relevant to UK employers with EU hiring activity or EU entities.

Were the AI Act's prohibited practices under Article 5 also delayed? No. Those prohibitions were not part of the delay and continue on their original schedule. They were never tied to the high-risk deadline.

PeopleNotResumes helps UK and EU employers plan against the real EU AI Act timeline rather than a stale headline date. Our methodology is grounded in behavioural science research from the London School of Economics.