The date in flux — Regulation (EU) 2024/1689
High-risk employment obligations: originally 2 August 2026, being deferred to 2 December 2027.
High-risk obligations for employment AI systems were originally to apply from 2 August 2026. Under the EU’s Digital Omnibus (political agreement May 2026, formal adoption expected mid-2026) they are being deferred to 2 December 2027; until adoption is finalised the original date remains technically operative.
The EU AI Act’s high-risk employment provisions (Annex III) concern AI used to recruit, manage, monitor or make decisions about workers — a distinct matter from the task-displacement readiness this audit assesses. The Forta audit is not itself a high-risk AI system.
In force since 1 August 2024. Penalties up to €35m or 7% of global turnover for prohibited practices, and €15m or 3% for high-risk obligation breaches.
In force versus emerging
An honest register. No instrument currently compels an AI workforce audit — which is precisely why acting early is a leadership choice rather than a compliance burden.
| Instrument | Status | Relevance |
|---|---|---|
| Employment Rights Act 2025 | In force | Collective consultation duties already apply to redundancy programmes of scale. |
| Plan to Make Work Pay | Govt commitment | Commitment to examine what AI means for work, jobs and skills. Direction of travel, not yet obligation. |
| TUC model AI & Employment Bill | Proposed (not law) | Would mandate workplace AI risk assessments — but concerns algorithmic management of workers, not the task displacement assessed here. |
| EU AI Act (high-risk employment) | From Dec 2027 | Originally 2 Aug 2026; the EU Digital Omnibus (agreement May 2026) defers high-risk employment obligations to 2 December 2027. Extraterritorial; penalties to €35m / 7% turnover. Concerns AI used to manage workers — a distinct regime from this audit. |
The obligations register
Where a client uses AI to recruit, manage, monitor or decide about workers, these are the duties that may bite — and the duties an audit helps a buyer get ahead of. Forta scores roles, not individuals, so the diagnostic itself does not trigger automated-decision provisions.
EU AI Act — Article 26 deployer obligations (Reg. EU 2024/1689)
HighApplies to
Any UK firm using third-party or in-house workforce AI (recruitment, performance management, task allocation, contract decisions) where the system falls under Annex III Point 4. High-risk obligations originally set for 2 August 2026 are being deferred to 2 December 2027 under the EU Digital Omnibus (agreement May 2026); the original date remains technically operative until adoption is finalised.
Requirement
Use systems only per provider instructions. Trained, competent human oversight with intervention authority. Continuous monitoring; provider notification on materialised risk. Six-month minimum log retention. Workplace pre-deployment notification to workers' representatives and affected workers. Penalties up to €15m / 3% global turnover for high-risk obligation breaches; €35m / 7% for prohibited practices.
EU AI Act — Article 27 Fundamental Rights Impact Assessment
HighApplies to
Where the customer's AI deployment affects fundamental rights — typical for Annex III employment systems. Public sector deployers and certain private deployers required.
Requirement
Documented FRIA before deployment. Description of intended use, scope, frequency, affected categories of persons, reasonably foreseeable adverse impacts, oversight measures, governance arrangements.
EU AI Act — Article 86 right to explanation
HighApplies to
Affected individuals can request explanations of high-risk AI decisions that produce legal or similarly significant effects.
Requirement
Cooperation with explanation requests. Clear, meaningful explanation of role of AI in the decision and main elements of the decision taken. Documentation infrastructure to respond.
UK GDPR & Data Protection Act 2018 (as updated by DUAA 2025)
HighApplies to
All workforce data processing — universal. Data Use and Access Act 2025 phased in during 2026.
Requirement
Lawful basis documented. DPIA for automated decisions with significant effect. Data minimisation, retention limits, data subject rights including DSAR (30-day SLA). Tightened ADM lawful basis under DUAA 2025.
ICO Guidance on Automated Decision-Making and Profiling
HighApplies to
Any AI-assisted scoring or recommendation in workforce decisions with significant effect on individuals.
Requirement
Lawful basis. Human review capacity. Transparency to affected individuals. Right to challenge automated outputs. Forta's role-level (not individual-level) methodology is structurally aligned and does not itself trigger ADM provisions.
Equality Act 2010
HighApplies to
All redeployment, restructuring, and selection decisions — universal.
Requirement
Indirect discrimination assessment across protected characteristics (age, sex, race, disability, religion, sexual orientation, gender reassignment, pregnancy and maternity, marriage and civil partnership). Forta scores roles, not individuals — customers remain responsible for ensuring implementation does not produce indirect discrimination.
Public Sector Equality Duty (Equality Act s.149)
HighApplies to
Public sector clients — central government, devolved government, local authorities, arms-length bodies, NHS trusts.
Requirement
Equality Impact Assessment before workforce restructuring. Due regard for elimination of discrimination, advancement of equality of opportunity, fostering of good relations.
FCA Senior Managers and Certification Regime (SMCR)
HighApplies to
Financial services clients with certified or approved individuals.
Requirement
Fit-and-proper assessment continuity for certified staff during transition. Certified individuals remain SMCR-relevant through retraining and redeployment. Off-ramping of certifications must be deliberate and documented.
TUPE 2006 (Transfer of Undertakings)
MediumApplies to
Where roles transfer to recruitment partner, training provider, or external employer as part of transition.
Requirement
Consultation with employee representatives. Terms preservation. Information and consultation duty. Measures notification.
Collective Redundancies (s.188 TULRCA)
HighApplies to
Where 20+ redundancies are proposed within 90 days at one establishment.
Requirement
Statutory consultation period (30 days for 20-99, 45 days for 100+). HR1 filing with Insolvency Service. Engagement with appropriate employee representatives. Information disclosure on reasons, numbers, selection method, calculation of redundancy payments.
Regulatory register last reviewed 24 June 2026. This is a fast-moving area of law; the position is stated accurately and with sources as at that date. It is not legal advice.