Executive Summary

After the European Commission proposed delaying the high-risk AI obligations through its "Digital AI Omnibus" in November 2025, the negotiations did not end in one round. The first trilogue collapsed in late April, and the outline of a provisional deal took shape in May. Then, on June 22, 2026, the Parliament and Council reaffirmed the provisional agreement to delay the core obligations. What had been a "proposal" days earlier hardened into an agreed direction.

Lay out what slipped and to when, and the shape becomes clear. Obligations that had all hung on the same August 2 date scattered to different speeds, and the one pushed furthest back is the high-risk AI that judges people.

Worth keeping in mind: an extension is not an exemption. The start date moved back, but the content of the obligations is unchanged. And the reason for the delay was not that companies were ready — it was that the harmonized standards and guidance needed to check those obligations are not yet in place. Less "they're prepared" and more "the tools to prepare don't exist yet." On top of that, the provisional agreement only becomes final once it is published in the EU's Official Journal. Until that procedure closes, the original timeline is formally still alive.

The reason the EU AI Act classes hiring and HR AI as high-risk is simple: what these systems handle is people's livelihoods. Annex III enumerates AI in the employment domain as high-risk, and the scope reaches well beyond the single moment of hiring.

• • Résumé parsing and candidate ranking — reads applications, scores them, and narrows down who gets an interview.
• • Interview-assessment AI — analyzes video, voice, and answers to compute a fit score.
• • Performance reviews, promotions, termination decisions — intervenes in HR decisions that shape an existing employee's opportunities.
• • Credit-scoring decision systems — produce the scores that gate access to loans and finance.

Why these systems got the longest reprieve is a paradox. Their impact is the greatest, so the obligations are the heaviest; the obligations are the heaviest, so enforcement slipped further until the tools to check them are ready. But the size of the impact does not shrink during the delay. If anything, that time lets more unverified models screen more résumés.

The numbers backing that concern speak to the scale. The Stanford study on hiring-algorithm bias, reported in May 2026, found a racial gap in the systems it analyzed where more than a quarter of Black applicants could be filtered out regardless of ability. Around the same time, an industry survey found that four in five companies had not even classified whether their own hiring AI qualifies as high-risk. While adoption continues without an understanding of the risk, the law that would stop that risk does not operate until December 2027.

Look closely at the obligations whose enforcement slipped to December 2027, and the missing pieces all cluster around accountability for data. While these obligations sit idle, hiring AI is under no duty to disclose what it learned from.

• • Article 10 data governance — recording the provenance of training data, bias testing, quality documentation.
• • Article 11 technical documentation — a record of how the system was built.
• • Article 12 automatic logging — an operating history that can be traced and audited after the fact.
• • Article 14 human oversight — a structure where a person can review and intervene in decisions.

3.1The Debt a "Land-Grab Race" Creates

The 18 months with the obligations switched off look like an opportunity to vendors. They can ship fast without the documentation burden and lock in market share. But the earlier a model enters this race, the more résumés it processes without recording its provenance. When audits begin in December 2027, there is no way to verify the decisions accumulated in the meantime, retroactively. A model without data governance is not merely short on paperwork — it becomes a system to which accountability cannot be assigned.

Break the structure into steps and you can see where the gap forms. A vendor does not disclose where its training data came from, keeps no bias-testing log, and leaves the technical documentation blank; the HR team at the company that adopts that model then filters résumés without knowing the basis. The rejected applicant cannot learn why, and the auditor has no record to trace. Until December 2027, this chain remains legally permitted.

The most reasonable-looking reaction to news of a delayed regulation is, "Then let's delay our preparation too." But that judgment may be the most dangerous choice of this whole reprieve. The start date moved back, yet the substance of the obligations and the time it takes to certify and document them did not. A model without documentation in December 2027 will be caught immediately, and restoring provenance retroactively at that point is all but impossible. In the end, the companies that built their records first are the ones still in the market on that day.

And December 2027 is not the only clock pressing on companies. Lawsuits contesting hiring-AI discrimination are rising in both the U.S. and Europe, and those disputes invariably ask the same thing: what did that model learn from, and on what basis did it filter people out? Even before the regulatory start date arrives, a single dispute immediately demands the provenance of the training data and the bias-testing record. So voluntary governance is, before it is preparation for 2027, the record that defends a company in today's disputes.

The voluntary data governance that fills the seat the law left empty comes down to three things: recording where training data came from, keeping a log of bias testing, and securing the auditability to retrace it at any time. These three are a matter of model quality before they are regulatory compliance. The very act of recording where data came from reduces bias, and that record later becomes the basis of the trust customers demand across the supply chain.

Narrow the view to Korea and the word "delay" carries even less weight. Korea's AI Framework Act took full effect in January 2026, and hiring AI is already in scope as "high-impact AI" that significantly affects people's rights. The EU slowing its clock does not stop the clock for companies running hiring AI in Korea. Organize your data governance to one jurisdiction's requirements, and much of another jurisdiction's demands are resolved along with it.

Legal & Industry Analysis

• 1.Sidley Austin LLP. (2026). "EU Lawmakers Reach Provisional Agreement to Delay Key EU AI Act Obligations." Sidley Data Matters, 2026-06-22.
• 2.Gibson Dunn. (2026). "EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes."
• 3.ComplianceHub.Wiki. (2026). "The EU AI Act's August 2, 2026 Deadline Just Moved: Digital Omnibus Annex III Deferral to 2027."

Official Documents & Reporting

• 4.Council of the European Union. (2026). "Artificial Intelligence: Council and Parliament Agree to Simplify and Streamline Rules." Press Release, 2026-05-07.
• 5.Fortune. (2026). "Largest Study of AI Hiring Algorithms to Date Finds 'Clear Racial Disparities'." 2026-05-26.