![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2026\/09\/fivehunters-logo-400x300_TEXT.png\"){kind=logo}
<\/p>\n<\/p>\n
Recruiters know: AI has long been capable of doing more than just drafting job postings. Systems can analyze applications, preselect candidates, and support hiring decisions. The rule is: The more an AI system influences decisions about people, the stricter the security requirements become.<\/p>\n
And this is exactly where the European AI Act comes into play.<\/p>\n
Among other things, it determines which applications will be classified as high-risk systems in the future\u2014and which rules will apply to them.<\/p>\n
This classification also affects certain tools in the areas of recruiting and human resources management.<\/p>\n
For companies, this means, among other things, that they will need to examine even more closely in the future which AI they use, how it works, and which legal requirements apply to it.<\/p>\n
Of course, not every AI tool used in human resources is automatically a high-risk system.<\/p>\n
However, the AI Act explicitly mentions certain applications in the employment context. These include, in particular, AI systems used for the selection or hiring of individuals\u2014such as for the targeted placement of job postings, the analysis and filtering of applications, or the evaluation of candidates.<\/p>\n
Systems that influence decisions regarding working conditions, promotions, or the termination of employment may also fall under this category.<\/p>\n
The reasoning behind this is understandable: AI applications that can have a direct impact on a person\u2019s personal circumstances, opportunities, and fundamental rights are considered particularly risky. Consequently, they are to be subject to even stricter regulation. <\/p>\n
This classification by no means implies that such AI systems are prohibited.<\/p>\n
However, it does entail additional requirements. Depending on a company\u2019s role\u2014such as a provider or operator of a system\u2014the AI Act sets out different requirements for documentation, human oversight, monitoring, and handling the results of a high-risk system.<\/p>\n
For companies that use AI in recruiting, this means that the Act makes it even more important to know which systems are in use and what they are used for.<\/p>\n
Does that sound like more regulation at first? It does. But there\u2019s also good news.<\/p>\n
To put this in context: The AI Act already entered into force on August 1, 2024, but its provisions will be phased in gradually. The first regulations have been in effect since February 2025, with others taking effect in August 2025. As of August 2, 2026, a large portion of the regulation has been in effect\u2014including the transparency requirements under Article 50 of the AI Act. Other requirements, particularly for certain high-risk AI systems, will follow later.<\/p>\n
It adopted the AI Omnibus, an EU regulation amending the AI Act, which entered into force on July 27, 2026. The AI Omnibus is intended to take the capabilities of small and medium-sized enterprises into greater account.<\/p>\n
Specifically, this means:<\/p>\n
The risk is real. For certain violations related to high-risk AI or breaches of transparency obligations, the AI Act provides for a maximum fine of 15 million euros or 3 percent of global annual revenue.<\/p>\n
For larger companies, the higher of the two amounts generally applies. With the current reform, however, the EU has also made adjustments in this area.<\/p>\n
The AI Omnibus now explicitly takes into account so-called small mid-cap companies (SMCs). Simply put, these are companies that are already too large to meet the classic SME definition but still fall under the broader category of small and medium-sized enterprises.<\/p>\n
For these companies, in the case of the violations just described, the fine amount is no longer based on the higher of the two values, but on the lower one.<\/p>\n
Example: A small-mid-cap company generates 100 million euros in annual revenue worldwide. Three percent of that amounts to 3 million euros. Under the standard calculation, the higher value\u2014that is, 15 million euros\u2014would set the upper limit. Under the new small-mid-cap rule, however, the cap is 3 million euros.<\/p>\n
That\u2019s still a substantial sum. However, it represents the statutory maximum limit. The actual amount of a penalty depends on the circumstances of the specific violation.<\/p>\n
We can put your mind at ease here: SMEs and startups were already given special consideration in the original AI Act.<\/p>\n
For them, the lower threshold also applies to the maximum fine limits\u2014and in fact, to an even greater extent than under the new Small-Mid-Cap regulation.<\/p>\n
Example: Let\u2019s take an SME with 10 million euros in global annual revenue. In the event of a corresponding violation, the options are 15 million euros or three percent of revenue, i.e., 300,000 euros. For the SME, the lower amount applies. In this example, the statutory upper limit would therefore be 300,000 euros instead of 15 million euros.<\/p>\n
Even in the case of particularly serious violations of the ban on certain AI practices\u2014for which fines of up to 35 million euros or 7 percent of global annual revenue are generally provided for\u2014this principle of the lower value applies to SMEs.<\/p>\n
Small and medium-sized business owners, in particular, should therefore not apply the frequently cited million-euro figures from the AI Act to their own companies without considering the context.<\/p>\n
The latest amendments to the AI Act give small and medium-sized enterprises, in particular, additional time to prepare. At the same time, they demonstrate that the regulation is intended to take company size and economic capacity into account to a greater extent.<\/p>\n
However, this does not mean that employers should ignore the issue of AI regulation until 2027. After all, the greatest risk associated with using AI isn\u2019t necessarily a fine. Rather, there\u2019s the risk of data breaches, incorrect decisions, legal disputes, angry customers or job applicants\u2014and, above all, a loss of trust.<\/p>\n
For example, when employees enter confidential company or customer information into an unauthorized AI tool. When personal data ends up where it doesn\u2019t belong. When flawed AI-generated content or analyses are adopted without being reviewed. Or even when decisions are made using AI without establishing guidelines for its responsible use.<\/p>\n
That\u2019s why employers should use this extra time to take a structured approach to AI implementation within their own companies, train employees, and\u2014above all\u2014clearly define the following questions: <\/p>\n