AI Act for recruiters: where the rules apply in 2026, country by country

What "AI Act" actually means in recruitment

Every recruitment agency I speak to is being asked the same question right now. "What are you doing about the AI Act?" The honest answer depends on which AI Act, in which jurisdiction. There is no single global AI Act. There is a growing collection of national, regional and city-level laws, and they vary wildly in scope, in timing, and in what they actually require from a recruiter.

This is the index. Below is the country-by-country picture as of May 2026, with one paragraph per jurisdiction, and a link to the full guide for each. I have stuck to primary sources only. Every date, fine and obligation in the deeper guides is traceable to a government, parliamentary or regulator page. No law-firm summaries dressed up as facts. No invented statistics.

If you only have ten minutes, read the country relevant to your placements. If you have an hour, read the parent guide and the country you care about most. If you have an afternoon, read everything; the patterns across jurisdictions are more instructive than any single law.

One framing point before the country list. Every regime on this page treats AI in recruitment as something that needs at minimum some level of human oversight, transparency to candidates, and accountability for biased outcomes. The differences between jurisdictions are about how much process, how much paperwork, and how big the fines are. The underlying expectations are remarkably consistent. If your agency runs AI properly under one regime, the move to compliance under another is rarely as big as the headlines suggest.

European Union: live in stages from 2025 to 2027

The EU AI Act, Regulation (EU) 2024/1689, is the most comprehensive horizontal AI law in force anywhere. Prohibited practices have applied since 2 February 2025. The general applicability date is 2 August 2026. The high-risk obligations under Article 6(1), which explicitly cover recruitment AI such as CV-sorting software, apply from 2 August 2027. Fines reach €35 million or 7 percent of global turnover for prohibited practices, and €15 million or 3 percent for high-risk breaches. The Act has extraterritorial reach, so UK and Dubai agencies placing into the EU are caught. The full picture is in the EU AI Act guide for recruiters.

United Kingdom: no Act, but live enforcement

The UK has no AI Act in force. The Artificial Intelligence (Regulation) Bill, a Private Members' Bill, received its second reading in the House of Lords on 22 March 2025 and is unlikely to pass as written. A government-introduced bill may follow the next King's Speech. In the meantime, the Information Commissioner's Office has launched a consultation on draft guidance about automated decision-making, open until 29 May 2026, with final guidance due in Summer 2026. The ICO has formally written to sixteen organisations the regulator identified as using automated decision-making on jobseekers; those organisations have committed to acting on the ICO's recommendations. Detail is in the UK AI hiring law guide.

United States: no federal Act, state patchwork

There is no federal AI Act in the United States. The 2023 Executive Order on AI was rescinded in January 2025. Enforcement falls to the states. New York City's Local Law 144 (AEDT) has been live since 5 July 2023, requiring bias audits and candidate notice; penalties run $500 to $1,500 per day of violation. California's automated-decision system regulations took effect on 1 October 2025 under the Civil Rights Council, requiring four-year retention of automated-decision data and prohibiting discriminatory AI under FEHA. Colorado's SB24-205, originally due 1 February 2026, was delayed to 30 June 2026 by SB25B-004 signed on 28 August 2025. The full state-by-state breakdown is in the USA AI hiring law guide.

Canada (Ontario): simple disclosure rule since 1 January 2026

Canada has no federal AI Act in force (AIDA died with Bill C-27 in early 2025). Ontario, however, has introduced the simplest and cleanest AI hiring rule of any jurisdiction we cover. From 1 January 2026, the Employment Standards Act, 2000 requires every publicly advertised job posting to include a statement disclosing the employer's use, if any, of artificial intelligence to screen, assess or select applicants. The rule applies equally to third parties, including recruitment agencies, acting for an employer. One sentence in the job ad is enough to comply. The simplicity is the point. Full breakdown is in the Ontario AI hiring law guide.

South Korea: AI Basic Act live since 22 January 2026

South Korea's Act on the Development of Artificial Intelligence and Establishment of Trust (the AI Basic Act) took effect on 22 January 2026, making Korea the first Asia-Pacific country with a comprehensive horizontal AI law. The Act covers both AI development and AI utilisation business operators; most recruiters using AI tools fall into the second category. High-impact AI operators must provide a meaningful explanation of outcomes, deploy a user protection plan, implement a mechanism for human intervention and supervision, and document their trust and safety actions. MSIT has granted a one-year grace period before administrative fines apply, taking effective fine exposure to January 2027. The detailed guide is in the South Korea AI Basic Act guide.

United Arab Emirates: no AI Act, but other rules apply

The UAE has no horizontal AI law regulating private-sector recruitment AI. The National AI Strategy 2031 is direction, not binding obligation. What does apply is the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the UAE Labour Law (Federal Decree-Law No. 33 of 2021), and the stricter data protection regimes inside DIFC (DIFC Law No. 5 of 2020, which includes automated individual decision-making provisions) and ADGM. From 1 May 2026, MoHRE and ICP use an AI platform to screen every new work permit application, which changes placement timelines for agencies. The Dubai-specific deep dive is in the UAE AI hiring law guide.

Five things every agency should do, regardless of jurisdiction

Inventory your AI use. Walk through every tool that touches a candidate. CV parser, sourcing tool, matching engine, interview scorer, outreach personaliser. Mark which use AI and which do not. You cannot comply with what you do not know you have. This is the foundation; every other action depends on it.

Disclose to candidates. Tell candidates when AI is involved in a decision that affects them. Ontario forces this in the job ad. NYC forces it ten business days before AEDT use. The EU AI Act and South Korea require transparency in different forms. Even where the law is silent (UAE, much of the US outside CA/CO/NY), candidate trust is improved by honest disclosure. Get ahead of the obligation.

Keep a human in the loop, and mean it. Every framework above expects a human to be able to override an AI decision. That human has to actually exist, have the authority to overturn the call, and have a clear route a candidate can use to request a review. Rubber-stamping the AI's recommendation does not count as human oversight; the regulator can tell the difference.

Audit for bias and document the audit. NYC requires it explicitly. California's regime catches discriminatory ADS. The EU AI Act requires bias testing as part of risk management. The UK ICO expects proactive bias monitoring. The pattern is universal. Run regular bias checks on your AI tools and keep the records. Documentation is the difference between a defensible position and a fine.

Vendor due diligence in writing. Your AI vendor's compliance becomes your compliance. Ask every AI tool in your stack for a written statement on bias testing, regulatory readiness, and which jurisdictions' frameworks they consider themselves accountable to. Keep the answers. If a vendor cannot give you a written position, that is the answer, and it is the wrong one. The same discipline applies to the AI features inside your own CRM. We publish the position on the AI features inside Recruitly so agencies can include them in candidate disclosures and vendor questionnaires without having to reverse-engineer the product.

A few jurisdictions that did not get a dedicated guide are worth noting. Japan has the AI Promotion Act, which is light-touch and principles-based rather than prescriptive on recruitment. India's IndiaAI techno-legal framework is still emerging. Brazil has a comprehensive AI bill that has not yet been enacted. China's Interim Measures for Generative AI cover the use of generative tools but do not target recruitment specifically. We will add country guides for those markets as their positions stabilise.

A note on method. Every fact in this series is sourced from a primary government, parliamentary or regulator page. No statistics have been invented. No customer names or fines have been fabricated. Where a fact could not be verified from a primary source, it was left out rather than guessed. This is the same standard we hold ourselves to inside Recruitly when shipping AI features, and the same standard I expect any agency advising clients on compliance to apply. If you spot anything that has moved since this guide was published, let us know. The regulatory landscape on AI in hiring changes fast and this guide will be updated as it does.