EU AI Act vs UK rules: does AI hiring law apply to UK employers?

A UK employer using AI in hiring faces an obvious question: is the EU AI Act our problem, or are we governed by UK law? The honest answer is that both can apply, to different parts of what you do, at the same time. This article maps which rules bind a UK employer and where. It is a practical orientation, not legal advice; for decisions about your specific situation, speak to your own advisers.

Does the EU AI Act reach UK employers?

Often, yes, because the Act has extraterritorial reach. Two situations pull a UK company into scope. First, if you place AI-driven hiring tools on the EU market or put them into service there, the Act applies. Second, and more relevant for most employers, if the output produced by an AI system is used in the EU, the Act applies regardless of where your company sits.

{/* SOURCE (founder-verified 2026-06-18): the EU AI Act's territorial scope is Article 2; the "output used in the Union" hook is Article 2(1)(c). Recruitment/selection AI is high-risk under Annex III(4). Confirm article references against the consolidated text before publish. Source: artificialintelligenceact.eu. */}

In hiring terms, that means a UK company recruiting into EU member states, or whose hiring decisions take effect in the EU, can be a deployer of a high-risk system under the Act even with no EU office. If you operate EU entities, those entities are deployers in their own right. So "we are a UK business" is not, by itself, a reason the Act does not apply to you.

What binds a UK-only hiring process?

Suppose your hiring is genuinely UK-only, with no EU output. You are still not in a rules-free zone; you are in a different rulebook.

The Equality Act 2010 governs every stage of your process, automated or not. It prohibits direct and indirect discrimination across the protected characteristics, and crucially a claim does not require proof of intent. An AI tool that produces worse outcomes for a protected group, without objective justification, exposes you under UK law today, before any EU enforcement question arises.

{/* SOURCE (founder-verified 2026-06-18): indirect discrimination is Equality Act 2010 section 19; protected characteristics are section 4. The "no intent required" point is settled in indirect-discrimination case law. Confirm section numbers before publish. Source: legislation.gov.uk, Equality Act 2010. */}

UK data protection law adds the second layer. It restricts decisions based solely on automated processing that produce legal or similarly significant effects, which a hiring outcome plainly is, and it gives candidates rights to information about the processing and to seek human intervention. Note that this area is in flux: the UK has been reforming its data protection regime, so the precise contours of the solely-automated-decision rules should be checked against the current statute.

{/* SOURCE (founder-verified 2026-06-18): solely-automated-decision rights are UK GDPR Article 22, with transparency in Articles 13 to 15. The UK Data (Use and Access) Act / DPDI reforms may have amended the Article 22 framing; verify the CURRENT position and any commencement dates before publish. Source: ICO automated decision-making guidance, legislation.gov.uk. */}

So which deadline matters?

This is where UK employers get understandably confused, because the EU timeline is itself unsettled. The EU AI Act's high-risk obligations covering hiring were set to apply from 2 August 2026. On 7 May 2026 the EU reached a provisional Digital Omnibus agreement to defer standalone Annex III obligations, including recruitment and selection AI, to 2 December 2027. As of writing that agreement is not yet formally adopted, so the legal position today still points at 2 August 2026 for in-scope EU activity.

{/* SOURCE (founder-verified 2026-06-18): both dates are time-sensitive. The Digital Omnibus (7 May 2026) and the proposed 2 December 2027 deferral were NOT YET ADOPTED as of 2026-06-18; re-check adoption status before publish. Sources: Gibson Dunn, Travers Smith, EU AI Act Service Desk, artificialintelligenceact.eu. */}

For your UK-only activity, none of those dates govern you. The Equality Act and UK data protection duties apply now and have for years. The EU dates only bite on the portion of your activity that the Act reaches. The practical implication is that waiting for the EU timeline to settle is the wrong instinct: your UK obligations are live today, and a single hiring programme that touches the EU is governed by the earlier of the two regimes.

A simple way to work out which rules apply

Walk it stage by stage:

1. Where does the hiring outcome take effect? If anywhere in the EU, assume the EU AI Act is in scope for that activity.
2. Is the process UK-only? Then the Equality Act 2010 and UK data protection law govern it, today, with no EU deadline relevant.
3. Do you run any EU entity? That entity is a deployer in its own right under the Act.
4. Is the tool sold or deployed into the EU market? Then provider or deployer duties attach to that, separately.

Most employers find at least one branch lands them under live obligations. The clean takeaway is that no realistic UK hiring operation is fully outside both regimes.

How KimonRecruit approaches this

We built KimonRecruit to satisfy the demanding regime, so the same platform works whether your activity falls under the EU AI Act or under UK law. The platform produces decision support, never automated outcomes: there is no code path that moves a candidate out of a pipeline without a human recruiter making that call, which speaks directly to UK solely-automated-decision restrictions. An outcome dashboard monitors selection across Equality Act 2010 characteristics. Every assessment score is replayable from the prompt, model and version that produced it, which is the evidence both regimes ask for.

None of that decides your scope question for you, and we do not pretend it does; whether the EU AI Act reaches a given hiring programme is a legal judgement for your advisers. It does mean that once you know which rules apply, the evidence each one wants is generated as you hire. For the full picture, read our pillar guide to the EU AI Act and recruitment.

The mistake is to treat "EU or UK" as an either/or that lets one side off the hook. Map your activity honestly, and you will usually find you owe duties under both, just to different parts of what you do.