news & insights
back to all news
The AI Act is the European regulation governing the use of artificial intelligence. For HR and Finance departments, it is not merely another technical regulation: it directly affects already widespread use cases, particularly AI-assisted recruitment and creditworthiness assessment.
This article explains what the AI Act actually is, its implementation timeline (which has recently changed), its risk levels, and, above all, what it means for an HR or Finance department that uses or is considering using AI tools in its processes.
The AI Act, officially Regulation (EU) 2024/1689, is the world's first comprehensive legal framework on artificial intelligence. Adopted on June 13, 2024, and published in the Official Journal of the European Union on July 12, 2024, it entered into force on August 1, 2024, with its provisions being gradually applied over a period of 6 to 36 months.
The regulation follows a risk-based approach: the greater the potential risk that an AI application poses to individuals' fundamental rights, the stricter the obligations imposed on the organization deploying it. The regulation applies to any organization that develops, markets, or uses an AI system affecting the European market, regardless of where it is established.
Annex III of the regulation explicitly classifies AI systems used for recruitment or personnel selection as high-risk applications. This classification is broad and covers most AI-powered HR tools currently available on the market.
In practical terms, a pre-screening chatbot that automatically filters candidates based on an initial conversation, a video interview analysis tool that evaluates behavioral traits, or an AI-powered personality assessment that infers skills from responses all fall within the scope of high-risk AI systems.
Annex III also covers two applications directly related to the Finance function: AI systems intended to assess the creditworthiness of natural persons or establish their credit score, and systems used for risk assessment and pricing in life and health insurance. For these applications, Article 27 of the regulation requires a specific fundamental rights impact assessment before deployment, except for systems used solely for the purpose of detecting financial fraud, which are exempt from this requirement.
For finance departments already using, or considering the use of, AI tools for internal credit scoring, customer risk assessment, or pricing activities, this requirement deserves particular attention from the tool selection phase onward.
The original timeline provided for high-risk AI systems to comply with the AI Act was set for August 2, 2026. This timeline has since been revised.
The AI Act distinguishes between the provider of an AI system (the software vendor) and the deployer (the organization that uses the system within its business processes). An HR department or Finance department that purchases and configures an AI-based HR or Finance tool is considered a deployer and is therefore subject to specific obligations, notably those set out in Article 26 of the regulation.
| Obligation | What it Means in Practice |
|---|---|
| Use in accordance with instructions | Use the system in line with the vendor's documentation and intended purpose, without misuse or unauthorized modifications. |
| Effective human oversight | Appoint trained and qualified individuals who can intervene in real time or disable the system if necessary. Oversight cannot be merely a formal requirement. |
| Logging and record-keeping | Retain the system's activity logs for at least six months. |
| Employee information | Inform employees before deploying an AI system in the workplace. |
| Information for affected individuals | Clearly inform, in advance, any person subject to a decision involving a high-risk AI system (for example, a job applicant). |
| Incident reporting | Monitor the system's operation and report any serious incident to the competent authority. |
The AI Act's penalty framework systematically applies the higher amount between a fixed monetary fine and a percentage of the company's global annual turnover.
For small and medium-sized enterprises (SMEs) and microenterprises, each fine is capped at the lower amount between the percentage of annual turnover and the fixed monetary penalty, a protective mechanism that does not apply to large organizations.
Yes. The AI Act applies to any organization that develops, markets, or uses an AI system affecting the European market, regardless of where the organization is established.
The obligations that apply depend on the risk level of the specific AI use case rather than the size of the company. However, SMEs and microenterprises benefit from certain adjustments, particularly regarding the calculation and maximum amount of financial penalties.
A purely informational HR chatbot (providing information on leave policies, internal procedures, or employee benefits) generally falls into the minimal-risk category, with only a transparency obligation if users could reasonably believe they are interacting with a human.
The high-risk regime applies only when the chatbot is involved in recruitment, employee evaluation, or career management decisions. This would be the case, for example, for a candidate pre-screening chatbot that helps assess or filter applicants.
The provider is the organization that develops and markets the AI system. The deployer is the organization that uses it within its own processes. An HR department that purchases a CV screening tool from a software vendor is a deployer: it is subject to its own obligations (human oversight, informing affected individuals), which are distinct from those of the provider.
No. The postponement provides additional time, but achieving compliance properly (mapping AI use cases, preparing documentation, establishing human oversight, and training teams) takes time.
Organizations that start early can avoid a last-minute rush as the deadline approaches, a scenario that was already observed following the previous postponement.
Yes. The two regulations are complementary and apply simultaneously.
The GDPR governs any processing of personal data, including processing carried out by an AI system. The AI Act specifically regulates the AI system itself, its risks, and its oversight.
As a result, any HR or Finance AI project involving personal data must comply with both regulatory frameworks at the same time.
Would you like to structure your AI strategy in HR or Finance?
