Thirty-five million euros, or seven percent of global annual turnover, whichever is higher. That is the EU AI Act's top penalty ceiling, and the number does the work of the issue because it is not aimed where most people think it is aimed. It is not only a rule for European companies, and it is not only a rule for the firms that build the software. The Act reaches any provider or deployer whose AI systems touch people in the European Union, regardless of where the company sits - and a candidate in Frankfurt screened by an algorithm run from Bengaluru is a person in the European Union. The penalty is the headline. The reach is the story.
Read the tiers precisely, because precision is the whole point of a governance issue. The 35 million euro, seven percent ceiling attaches to prohibited practices - the AI uses the Act bans outright, such as emotion recognition in the workplace. For a deployer that simply fails its high-risk obligations - the documentation, the bias testing, the human oversight - the ceiling is 15 million euros or three percent of turnover. Both are extraterritorial. Both can be levied by a national market-surveillance authority that can also order the system withdrawn. The exact number depends on the failure, but the exposure does not depend on geography.
Now place the deployer. The Act draws a hard line between the provider who builds an AI system and the deployer who uses it, and it puts a distinct set of obligations on the deployer that the vendor's compliance does not discharge - human oversight, monitoring, logging, a fundamental-rights impact assessment, incident reporting, vendor verification. The employer using an AI applicant-tracking system is the deployer, not the software company. And for the offshore world that means the Recruitment Process Outsourcing provider running AI screening across thousands of EU-facing applicants is the deployer, carrying the high-risk obligations directly, no matter that it licensed the tool from someone else.
This is the corridor read at the governance layer, and it is a different layer from the last three weeks. Infrastructure, data labour, the application stack, the sector deep dive - all of those asked what AI does to the work. This asks who is liable for how the AI is used, and the answer routes the liability straight to the offshore screening desk. India runs the deepest base of recruitment-process and HR-shared-services outsourcing on earth, much of it for European clients. The number is the warning. What the rest of the issue does is locate the desk it lands on.
The EU AI Act's top penalty ceiling -- 35 million euros or 7 percent of global turnover, whichever is higher, for prohibited practices; 15 million euros or 3 percent for a deployer that fails its high-risk obligations. Both are extraterritorial. A candidate in Frankfurt screened from Bengaluru is a person in the EU, and the desk that screened them is the deployer.
The number is not aimed where most assume. The Act reaches any deployer whose AI touches people in the EU, regardless of where it sits, and it puts the liability on the operation that uses the system, not the firm that built it. India runs the deepest base of recruitment-process and HR-shared-services outsourcing on earth, much of it for European clients -- so the deployer obligations land on the offshore screening desk, in its own name, no matter whose software it licensed.
For three years the question in this corridor has been what AI replaces. The governance layer asks a different one: when an algorithm makes or shapes an employment decision, who answers for it. The EU AI Act's answer is unambiguous and, for the offshore world, uncomfortable - the deployer answers, not the vendor. That is a shift from a technology question to an accountability question, and accountability does not offshore the way a process does. You can move the screening desk to Bengaluru or Manila. You cannot move the liability for what the screening does to a candidate in the EU.
The mechanism is the deployer-provider split, and it is the part most offshore operations have not priced. A vendor can hand you a compliant system - documented, bias-tested, CE-marked - and you, the deployer, still owe human oversight, monitoring, logging, a fundamental-rights impact assessment and incident reporting on top. Provider compliance covers the tool as designed. Deployer compliance covers how you actually use it, on your real candidates, in your real pipeline. An RPO that assumed the vendor's paperwork was its shield is holding a shield for the wrong half of the obligation.
Watch how it compounds with the law already in force. GDPR Article 22 already gives a candidate the right not to be subject to a decision based solely on automated processing, so a purely automated rejection was exposed before the AI Act arrived. The Act adds the high-risk machinery on top - the documentation, the testing, the oversight - and the two run together rather than one replacing the other. The practical standard that emerges is blunt: use AI to screen in and to rank, keep a human on the rejection, and be able to show the file when a regulator or a rejected candidate asks. The autonomous-rejection workflow is the one that detonates.
The shift, then, is from screening as a cost centre to screening as a governed, documented, auditable function - and that changes who is valuable in the offshore operation. The seat that grows is not the one running the most CVs per hour. It is the one that can produce the audit trail, run the bias test, sign the impact assessment and answer for the decision. India holds the deployer exposure because India runs the desks. The Gulf, building its own AI-governance regimes rather than importing the EU's, gets to decide its posture deliberately. The operation that survives the August date is the one that treated screening as a controlled process before the regulator made it one.
Accountability does not offshore the way a process does. A vendor can hand you a documented, bias-tested, CE-marked system and you, the deployer, still owe oversight, monitoring and an impact assessment on top -- on your real candidates, in your real pipeline. And it compounds with law already in force: GDPR Article 22 already gave a rejected candidate the right to human review, so the autonomous-rejection workflow was exposed before the Act even arrived.
If the deployer is liable, the durable move is to stop treating the vendor's compliance as your own and build the deployer-side controls the Act actually requires. reAImagine's read is blunt about the split: the provider's documentation is necessary and not sufficient. The RPO, the GCC HR-shared-services centre, the staffing platform - each is a deployer of a high-risk system the moment its AI screens an EU-facing candidate, and each owes human oversight, logging, a fundamental-rights impact assessment and incident reporting in its own name. The first move is to inventory every AI system in the hiring pipeline and classify which ones touch the EU, because you cannot govern an exposure you have not mapped.
The second move is to read the calendar, not the press release, because the timing is a live binary the deployer does not control. The Digital Omnibus would defer high-risk employment obligations from 2 August 2026 to 2 December 2027 - but it takes legal effect only on formal Council adoption and publication, anticipated in July. Until that happens the August date stands, and if adoption slips, it stands for real. An operation that has read the headline deferral and stood down its preparation has bet its compliance on a date that has not yet arrived. The disciplined posture is to build to the August date and be pleasantly surprised by December 2027, not the reverse.
The third move belongs to whoever sets the region's posture. The Gulf is not waiting to import EU rules - the UAE and Saudi Arabia are issuing their own AI strategies and frameworks, and DIFC and ADGM run independent data-protection regimes, so the Gulf can govern AI hiring as a sovereign and workforce-policy matter rather than as borrowed compliance. India's exposure is the mirror image: it runs the deployer desks for European clients, so the liability arrives whether or not India writes its own rule. The board that owns an offshore screening operation, and the head who runs it, both get to decide now whether they meet the August date as a controlled process or discover it as a fine. One is a budget line. The other is seven percent of turnover.
If the deployer is liable, the vendor's paperwork is your floor, not your shield. The durable move is to build the deployer-side controls the Act actually puts in your name.
The adoption curve and the attrition curve are the same line read from two ends, and this week's named cuts are not staffing-sector specific - that is the honest framing, because the chart shows announced redundancies and stated drivers, not a clean AI causation the data cannot support. Robinhood cut about 290 people, roughly 10 percent, to flatten its structure. Rackspace cut 750, around 15 percent, citing a shift toward AI. Across the first half of 2026 trackers recorded AI named as a driver in over half of layoff events, affecting more than 150,000 workers - though Deutsche Bank analysts warned of 'AI redundancy washing', firms attributing to AI the cuts they would have made regardless. Read the stated driver with care.
The rising roles sit on the governance side of the same shift. The AI-compliance officer for hiring grows because someone has to own the deployer obligations the vendor's paperwork does not cover. The algorithmic-bias auditor grows because the Act and laws like New York's Local Law 144 both require the test to be run and documented, not assumed. The human-in-the-loop reviewer grows because GDPR Article 22 and the Act together make the human on the rejection a legal requirement, not a courtesy. And a distinct seat appears wherever a region writes its own rule rather than inheriting one - the sovereign-AI-governance lead who builds the Gulf's posture rather than importing the EU's.
The honest watchout is that governance roles are real roles, not a compliance gesture, and the offshore operations that treat them as a box-ticking layer will staff them wrong. The seat that matters is the one that can actually produce the audit trail under a regulator's question, not the one that files a policy and hopes. Do not aim a hiring plan at the screening desk that runs the most CVs per hour - that desk is now a liability surface. Aim at the oversight, the audit and the impact-assessment seats that make the screening defensible. The exposure is not coming. For any operation screening EU-facing candidates, it is already here, and the only open question is the date it is enforced.
6 rising role categories, each with a sourced hiring signal.
The seat that owns the deployer obligations the vendor's paperwork does not cover. As the EU AI Act makes the operation using an AI screening tool liable rather than the software firm, someone has to own the human oversight, logging and impact assessment in the deployer's own name.
The role the Act and New York's Local Law 144 both require rather than assume. Bias testing of hiring algorithms has to be run, documented and in some jurisdictions published, so the auditor who can produce the test under a regulator's question becomes a control function, not a courtesy.
The seat GDPR Article 22 and the EU AI Act together turn from courtesy into requirement. A candidate has the right not to be rejected by an algorithm alone, so the human who reviews the automated decision before it counts is now a legal step in the pipeline, not an optional one.
The Gulf seat that writes the region's posture rather than importing the EU's. The UAE and Saudi Arabia are building their own AI strategies and frameworks, and DIFC and ADGM run independent data regimes, so the lead who designs governance as sovereign policy rather than borrowed compliance is a distinct and funded role.
The role that maps the exposure before it is enforced. You cannot govern an AI system you have not inventoried, so the lead who catalogues every screening and ranking tool, classifies which touch the EU, and runs the fundamental-rights impact assessment is the precondition for every other control.
The seat inside the RPO or GCC that makes the screening desk defensible. As the EU AI Act reaches any deployer whose systems touch the EU, the offshore operation needs the lead who can produce the audit trail and the impact assessment for European clients, turning a liability surface into an assured service.
Printed, not charted. These figures are not measured the same way, on any of the four counts that would let them share a scale. Drawing them together would suggest a comparison the sources do not support, so the numbers are set out instead.
Week of 15 June 2026
Week of 22 June 2026
This week's signal through the India, Middle East and Africa lens.
ACCELERATING
Signal
The deployer desk of the world. India runs the deepest base of recruitment-process and HR-shared-services outsourcing anywhere, its GCC estate alone more than 1,700 centres and over 1.9 million people, much of it screening and administering hiring for global clients including European employers. Under the EU AI Act that makes the Indian operation the deployer of a high-risk system the moment its AI sorts an EU-facing candidate -- carrying human oversight, logging and a fundamental-rights impact assessment in its own name, no matter whose software it licensed.
EMERGING
Signal
Writing its own rule rather than inheriting one. The Gulf is not waiting to import EU compliance: the UAE and Saudi Arabia are issuing national AI strategies and frameworks, and the common-law hubs of DIFC and ADGM run independent data-protection regimes. Combined with Emiratisation and Saudisation favouring nationals in skilled roles, that lets the Gulf govern AI hiring as a sovereign and workforce-policy matter, deliberately, rather than as borrowed rules arriving from Brussels.
LATENT
Signal
Entering EU-facing work into the same liability. Africa's growing business-process and recruitment-outsourcing base, concentrated in South Africa, Kenya and Nigeria, takes on EU-facing screening and administration just as the deployer-liability rules bite -- so the continent arrives at the exposure at the same moment it reaches for the work. The opening is to build the governance layer in from the start, entering as an assured deployer rather than a cheap screening desk.
Short read · this week's signal across the nine sectors we cover
The lead weather, because the deployer desk lives here. RPO providers, staffing firms, Employers of Record and the HR-shared-services arms of consulting and GCC operations all run AI screening for clients, and the Act makes each of them the liable deployer, not the vendor. The same advisory firms also gain a new engagement: helping clients inventory, classify and govern their AI hiring before the August date. The liability and the opportunity sit in the same sector.
The provider side of the split, and the lighter exposure. The vendors that build applicant-tracking and screening AI carry the provider obligations -- documentation, bias testing, CE marking -- but the Act deliberately does not let provider compliance discharge the deployer's duties. So the technology sector's exposure is real but bounded: build a compliant tool, and the harder, ongoing liability still sits with whoever deploys it.
High-volume, high-scrutiny hiring and a parallel governance muscle. Banks and financial firms screen at scale and already run model-risk and control functions, so the AI-hiring obligations land on an operation that understands documented, audited decision-making -- but also on one whose offshore GCCs run much of that screening from India, inheriting the deployer exposure directly.
Volume hiring is the exposure. Retail recruits at scale and seasonally, exactly the pattern that pushes employers toward automated screening to handle application volume -- and high-volume automated screening of EU-based applicants is squarely the high-risk use the Act targets. The convenience that makes automation attractive is the same feature that makes the compliance obligation unavoidable.
Workforce-critical hiring under a stricter eye. Healthcare recruits constantly and across borders, and the sector's regulatory culture means automated screening here draws particular scrutiny on fairness and documentation. The fundamental-rights framing of the Act lands hard where the workforce decision affects access to a regulated profession.
Cross-border hiring and supplier-chain workforce exposure. Manufacturers hire across multiple jurisdictions and increasingly screen with AI, so the extraterritorial reach of the Act catches any EU-facing recruitment run from a shared-services centre, wherever that centre sits. The exposure travels with the candidate, not the company's headquarters.
High-churn, high-volume recruitment and lighter but real exposure. Hospitality's constant hiring pushes toward automated screening, and where that screening touches EU-based applicants the high-risk obligations apply, even though the sector's individual decisions are lower-stakes than in finance or healthcare. Volume, not complexity, is what draws the obligation here.
Modest direct hiring exposure, mostly through outsourced administration. Real estate firms hire less at volume than retail or hospitality, so the AI-hiring exposure is lighter and concentrated where recruitment is outsourced to a screening provider -- at which point the deployer-liability question moves to that provider, and the chain of responsibility has to be mapped.
Specialised, lower-volume hiring and the lightest exposure of the nine. Energy recruits for technical, often scarce roles where human judgement dominates and automated mass-screening is least useful, so the AI-hiring obligation bites least here. The exposure is real only where the sector adopts screening AI for its higher-volume administrative and support hiring.
For Editor reAImagine · curated to this issue's signal · 90-day horizon
Why now
Where the operations or HR lead transitions into the AI-systems inventory lead. You cannot govern an exposure you have not mapped, so the first move is cataloguing every screening, ranking and evaluation tool and classifying which touch the EU.
Do this
Why now
Where the compliance or HR-operations analyst transitions into the AI-hiring compliance officer. The deployer obligations are distinct from the vendor's, so the skill is owning the oversight, logging and impact assessment in your own name.
Do this
Why now
Where the analyst or data lead transitions into the algorithmic-bias auditor. The Act and laws like New York's Local Law 144 require the bias test to be run and documented, so the skill is producing the audit, not assuming the tool is fair.
Do this
Why now
Where the recruiter or pipeline lead transitions into the human-in-the-loop review lead. GDPR Article 22 and the Act together make the human on the rejection a legal step, so the skill is designing review that is real oversight, not a rubber stamp.
Do this
Why now
Where the policy or technical lead transitions into the sovereign-AI-governance lead. The Gulf is writing its own rules rather than importing the EU's, so the skill is designing governance as regional policy rather than borrowed compliance.
Do this
Issue 014's lead is, in board terms, a liability sitting in an offshore cost centre that no one has put on the risk register. If any part of your hiring or screening touches a candidate in the EU, your operation is the deployer of a high-risk AI system under the EU AI Act -- and the deployer, not the software vendor, answers for it, with penalties up to 35 million euros or 7 percent of global turnover at the top tier and 15 million euros or 3 percent for a deployer that fails its high-risk duties. Three questions sit between you and your next AGM. Do you have an inventory of every AI screening and ranking tool in your hiring pipeline, and do you know which ones touch the EU? Do you have the deployer-side controls -- human oversight, logging, a fundamental-rights impact assessment -- in your own name, rather than relying on a vendor's CE mark? And have you prepared to the live 2 August 2026 date rather than betting on a deferral that is agreed but not yet law? The Board AI Briefing, reAImagine.work x InGovern, datelined Bengaluru and Dubai, reads each week's signal at the resolution your risk register needs. Read more at reaimagine.work/board-briefing.
What you receive
A board-ready brief tied to your sector and the workforce decisions in front of you this quarter, this fiscal year, and twelve-plus months out.
Who it's built with
Editorial by reAImagine.work, founded by Debu Mishra. Board governance practice from InGovern Research Services, founded by Shriram Subramanian. Bengaluru and Dubai.
How it lands
Approve. Appoint. Commission. Separate. Deploy. Decide. Establish. Stakes in INR or USD ranges. No theatre.