The AI Omnibus moved Chapter III Sections 1–3 duties for Annex III HR-AI to December 2027

Regulation (EU) 2026/1744 was published on 24 July and entered into force on 27 July 2026. The easiest summary—‘the AI Act was delayed’—is also the most likely to misdirect a governance programme. The final Omnibus set two fixed later dates for Chapter III, Sections 1–3. It did not restart every AI Act clock, suspend every duty or make every HR system high-risk.

Two high-risk dates, not one universal extension

For systems classified as high-risk under Article 6(2) and Annex III, Chapter III, Sections 1–3 apply from 2 December 2027. Annex III point 4 includes specified uses involving recruitment and selection, targeted job advertisements, filtering applications, evaluating candidates, promotion, termination, task allocation, and monitoring or evaluating workers. This is the path most likely to be relevant to a stand-alone HR application.

For systems classified under Article 6(1) and Annex I, the same sections apply from 2 August 2028. That route concerns AI systems used as safety components of, or themselves constituting, products covered by listed Union harmonisation legislation. It should not be substituted for the Annex III date merely because an HR product includes embedded software.

These dates concern Sections 1–3: classification, provider requirements and the obligations of providers and deployers and other parties. Section 4, which covers notifying authorities, notified bodies and related conformity-assessment governance, has followed a different timetable since 2 August 2025.

The HR label does not settle classification

The consolidated AI Act makes intended purpose and actual use central. Not every tool bought by HR is automatically an Annex III high-risk system. Article 6(3) provides a limited route for an Annex III system that does not pose a significant risk of harm and does not materially influence a decision outcome; a system that profiles people remains high-risk. A provider relying on the exclusion has documentation and registration consequences under Article 6(4). Applying those tests to a named product is a legal assessment, not a feature-list exercise.

The actor label also changes with the facts. ‘Vendor’ does not always mean provider, and ‘employer’ does not always answer whether an organisation is only a deployer. Branding, commissioning, substantial modification and the way a system is put into service can affect the analysis. The Omnibus therefore changes a date before it answers who carries each duty.

The other clocks keep running

A useful calendar preserves at least these separate milestones:

• 2 February 2025: Chapters I and II began applying, including AI-literacy duties and the prohibited practices then in Article 5. The Omnibus amended parts of this framework but did not move that starting date.
• 2 August 2025: governance provisions, the general-purpose AI regime and Chapter III, Section 4 began applying.
• 2 August 2026: the general application date arrived, including Article 50 transparency duties subject to their specific transition.
• 2 December 2026: new Article 5 prohibitions apply, and the special grace period for Article 50(2) ends for qualifying systems placed on the market before 2 August 2026.
• 2 August 2027: obligations reach GPAI models placed on the market before 2 August 2025; national AI sandboxes are also due.
• 2 December 2027: Sections 1–3 apply to Article 6(2)/Annex III high-risk systems.
• 2 August 2028: Sections 1–3 apply to Article 6(1)/Annex I high-risk systems.
• 2 August 2030: a special outside date remains relevant to certain high-risk systems used by public authorities.

Article 50 illustrates why a single ‘delay’ is unsafe. Provider-side machine-readable marking under Article 50(2) and human-facing deployer disclosures under Article 50(4) are different controls. The December 2026 grace period is limited to Article 50(2) and qualifying pre-existing systems; it does not move Article 50 as a whole.

A planning question, not a legal conclusion

The immediate investigation is whether the organisation's register can represent more than one date. A review record might capture the system and intended purpose, provider or deployer role, Article 6 and Annex path, first market or deployment date, version and possible significant change, applicable clock, evidence owner and next legal-review date. That is an editorial planning proposal, not a statutory checklist, and it requires qualified review before use.

What this article cannot do is classify a real recruitment, learning or workforce product from its marketing description. Nor does the amended timetable decide how the AI Act interacts with data-protection, employment, equality or national law in a particular deployment. The defensible conclusion is narrower: the Omnibus moved important high-risk dates, but it left organisations with a multi-clock classification problem rather than a general pause.

This AI-assisted editorial analysis is general information, not legal advice or an external legal opinion. Check the current consolidated law, the system's facts, applicable national and sectoral rules, and competent-authority guidance before acting.