We're building an employer-branding program. And while we build it, I can't stop thinking about one piece of irony.
Among the systems the EU AI Act designates as "high-risk" is AI for recruitment. Right next to credit scoring, critical infrastructure, and the justice system. In other words: the algorithm that decides which CV a human gets to see and which they don't has been placed by the regulator in the same basket as the systems that let people through a border — or don't.
And at the same time, half the market is already filtering candidates with exactly this kind of AI, often without giving it a second thought.
I'm not writing this to scare anyone. I'm writing it because it's a moment when it's worth being honest — especially if you work in Responsible AI.
The deadline that's coming (with caveats)
In short, and without the legal jargon: the heaviest wave of obligations under the EU AI Act — the one for high-risk systems — has a binding date of around 2 August 2026. There are political conversations about delaying parts of it, so the exact picture is still shifting and needs watching. But sensible preparation doesn't bet on a delay. It bets on the deadline holding.
The stakes aren't small. The fines under the regulation reach magnitudes that don't just sink a startup but a serious company — up to tens of millions of euros, or a percentage of global turnover. And it applies outside the EU: if your system's output touches a European user, you're in scope, no matter where your servers sit.
For a company that hires in Europe and at the same time sells AI to others who hire in Europe, this isn't an abstraction. It's a Tuesday.
Governance isn't a brake. It's an advantage.
In a world where anyone can ship AI in minutes, trust becomes the scarce commodity.
I know how "compliance" sounds to an engineer. It sounds like bureaucracy that slows down the real work. I get it. And I disagree.
In a world where anyone can ship AI in minutes, trust becomes the scarce commodity. The customer no longer just asks "does it work?" They ask "can I explain to a regulator how it works?", "is it traceable why it made this decision?", "who's accountable when it gets it wrong?" The company that has the answers before they're even asked isn't slower. It's the one entrusted with the most sensitive processes.
That's exactly why Responsible AI isn't a marketing label. It's a competitive advantage — especially when your system makes decisions about people.
We practice what we preach
And here comes the self-irony, which I take on with an open face.
We are an employer brand. We will use AI in hiring. Which means we're obligated to do it transparently and traceably — to be able to explain why the system pushed one CV forward, to keep a human at the decisive points, to not let an algorithm decide on its own who deserves a chance. Not because the regulator makes us. But because otherwise we'd have no right to talk to our customers about Responsible AI with a straight face.
Managing risk by design — governed by design — is a boring phrase for something simple: build things so they hold up to scrutiny before anyone comes to scrutinize them. That's also the advice we give our customers. It's only right that we apply it to ourselves first.
If governance isn't a tedious obstacle for you but an interesting engineering and ethical problem — we have exactly those problems here, and people who love them. [See our open roles in governance and Responsible AI].