skip to content
← all resources whitepaper

governing AI in HR

a readiness guide to the EU AI Act, NYC Local Law 144 and the documentation your HR systems must hold

43 pages · 45 min read

The deadline moved. The work did not get smaller. Regulation (EU) 2026/1744, the Digital Omnibus on AI, pushed the obligations for Annex III high-risk systems from August 2026 to 2 December 2027. Employment, worker management and access to self-employment stay inside Annex III. Other obligations already bind you. Using AI to infer emotions in the workplace has been prohibited since 2 February 2025, and that prohibition falls on the employer who switches the feature on.

In New York City, employers using automated employment decision tools have needed an annual independent bias audit since enforcement began on 5 July 2023, with candidate notice at least ten business days in advance. California's rules on automated decision systems took effect on 1 October 2025. Singapore published a governance framework for agentic AI in January 2026. India's DPDP Rules set the main compliance date at May 2027.

This guide is precise about what applies, to whom, and from when. Includes an Annex III classification worksheet, the documentation set to hold for each system, a bias audit specification you can send to a vendor, and a mapping to ISO/IEC 42001 and the NIST AI Risk Management Framework.

what’s inside

  1. the obligations that already apply to your HR stack
  2. why employment sits in Annex III of the EU AI Act
  3. what the Digital Omnibus moved, and what it left alone
  4. NYC Local Law 144: specifying a bias audit that holds up
  5. the wider patchwork: California, Illinois, Colorado, Singapore, India
  6. the documentation set to hold for every HR AI system
  7. mapping to ISO/IEC 42001 and the NIST AI Risk Management Framework
  8. a readiness plan to December 2027, quarter by quarter

what you’ll be able to do

  • classify every HR AI system against Annex III and record the reasoning behind each decision
  • specify a bias audit to a vendor, covering selection rate, scoring rate and impact ratio by category
  • assemble the documentation set for each system, with an owner, a retention period and a review date
  • build a quarter-by-quarter readiness plan against the 2 December 2027 application date
  • identify which tools in use today would fail a fundamental rights review

referenced sources