EU AI Act and India: What HR Leaders Should Do in the Next 90 Days

On May 7, 2026, the EU Parliament and Council reached provisional agreement to move the EU AI Act’s high-risk compliance deadline from August 2, 2026 to December 2, 2027 — a 16-month extension (EU AI Act Omnibus, Gibson Dunn). For most Indian HR teams running AI-powered candidate screening, the reaction was a quiet exhale and a procurement conversation quietly deprioritised.

That reaction will cost them significantly when December 2027 arrives.

The Date Changed. The Architecture Did Not.

Employment AI is still classified as high-risk under EU AI Act Article 6. The obligations in force from December 2, 2027 are identical to what was scheduled for August 2, 2026: documented scoring rubrics, complete audit trails, a human review checkpoint before any rejection is communicated, annual bias audits, and candidate disclosure at the start of every AI interaction.

The EU extended the deadline because the compliance ecosystem — vendors, enterprises, and their implementation partners — was collectively unprepared. The EU AI Act Omnibus specifically noted that the additional time was intended for proper implementation, not to revisit the substance of the requirements. There is no signal that a further extension is coming.

Teams that treat this window as 16 months of legitimate preparation will be in a categorically different position than teams that treat it as a holiday. The work required in December 2027 is identical to what would have been required in August 2026. The difference is whether you do it in a calm window or a panic one.

Which Indian HR Teams Are Actually in Scope

The EU AI Act’s geographic scope is widely misunderstood. The regulation applies to any organisation that uses AI to make employment decisions about people in EU-scope employment contexts — regardless of where the organisation itself is headquartered.

You are likely in scope if your company has EU-based operations and uses AI screening for roles at those entities. You are in scope if your parent company is EU-headquartered and your HR function runs on a shared global platform like Workday or SAP SuccessFactors configured for EU entities. IT services firms and GCCs serving European clients — particularly in BFSI, healthcare, and manufacturing verticals — are almost certainly covered if their contracts include standard data processing terms.

Of the 73% of Indian employers planning to hire freshers in 2026, those with any EU operational nexus are running AI-assisted campus screening under the Act’s scope. For that group, the window between now and September 2026 is the quiet period before the next compliance cycle begins.

The Compliance Panic Cycle — and How to Opt Out

Indian enterprise HR has lived through two versions of this pattern. GDPR arrived in 2018 with similar cross-border scope ambiguity. The DPDP Act came in 2023 with a comparably rushed response window. In both cases, organisations that prepared during the calm period had significantly better outcomes than those who waited for vendor press releases and emergency procurement cycles.

The calm window for EU AI Act compliance closes around September 2026. After that, every AI screening vendor will pivot their marketing to compliance messaging. Procurement teams will rush to sign agreements they have not read carefully. Integration work that requires architectural changes will get compressed into Q4 timelines. The result, for most companies, will be compliance theater: documentation that satisfies a surface audit without changing the underlying system behaviour.

The vendors rushing to announce EU AI Act compliance certifications in Q4 2026 will mostly be documenting architectures built in 2023. Certification and compliance-by-design are different things, and Indian HR buyers who read the actual data processing agreements will notice the difference.

A Practical 90-Day Internal Agenda

This is not a vendor checklist — that work is covered in our earlier breakdown of what compliance actually requires. This is the internal HR operations work that cannot be outsourced to a vendor’s compliance team.

Weeks 1 to 4: Map your actual scope. Identify every JD currently using any form of AI in candidate screening or ranking. Determine whether the role is EU-linked — subsidiary, client-side delivery, or shared-platform configuration. Document it. Knowing your scope takes one work day. Not knowing it takes two lawyers three weeks when a regulatory inquiry arrives.

Weeks 5 to 8: Establish the human review checkpoint. The EU AI Act requires meaningful human oversight before consequential decisions — rejection notifications, specifically — are communicated to candidates. If your current workflow sends automated rejections before any human has reviewed the AI’s classification, this is the structural change to make now, during a planning cycle, not in Q4 2027 under deadline pressure. Changing a rejection workflow architecture at the last minute costs 3 to 5 times what it costs during a calm window.

Weeks 9 to 12: Audit your logging, not just your documentation. Ask your AI screening vendor to demonstrate — not describe — audit log retrieval for a specific past candidate interaction. In a 3,000-candidate screening campaign, that means all 1,099 completed conversations stored, retrievable by candidate ID, within 48 hours of any regulatory request. If your vendor’s response is “we would have to go to engineering for that,” you have a structural gap that is easier to resolve now than in November 2027.

The Honest Stakes

SHRM’s 2025 AI-in-HR survey found that 88% of HR leaders already identify AI screening as a compliance risk. The EU AI Act extension did not reduce that risk — it extended the timeline for addressing it properly.

The Mobley vs. Workday case — the first major AI-hiring discrimination case to proceed in US federal court — is built on exactly what the EU AI Act is designed to prevent: automated rejection decisions with no documented human review step and no retrievable audit trail. That case continues to progress. The regulatory pressure from Brussels and the litigation pressure from US courts are converging on the same architectural requirement. That convergence does not pause for a 16-month extension.

The quiet window closes around September 2026. Use it.