Key Regulations Impacting Tech Hiring and Compliance

Hiring in tech is under more scrutiny than ever. Speed matters, but speed without compliance is a trap. In 2026 the rules moved: the EU pushed back the AI Act's hiring obligations, the Netherlands brought NIS2 into force, and US federal enforcement changed direction. Here is where things stand and what it means for your hiring process.

GDPR: Data Privacy in Recruitment

Every CV, background check and interview note is personal data. Each step in your hiring process needs a lawful basis. In recruitment, that is usually legitimate interest, steps taken before entering into a contract, or a legal obligation. Consent is rarely the right choice: because of the imbalance of power between employer and candidate, it is hard for consent to be freely given.

Criminal record data gets extra protection. Under Article 10 of the GDPR, you may only process it where EU or national law allows it. In the Netherlands, for example, that means working with the Certificate of Conduct (VOG).

Be transparent with candidates about what you collect and why. Keep only what you need, delete it once it is no longer needed, and be ready to handle requests from candidates who want to access or erase their data. If a decision about a candidate is fully automated and has a significant effect on them, they have the right to human involvement.

What's next: the EU's Digital Omnibus proposal of November 2025 would change parts of the GDPR, including the definition of personal data and the rules on automated decisions. As of October 2026, it is still being negotiated. Until it is adopted, the GDPR applies in full.

In short, GDPR is not just a legal requirement. It is a way to build trust with candidates.

EU AI Act: High-Risk Recruiting Tools

The EU AI Act classifies AI used in recruitment and selection as high-risk. That covers tools that place targeted job ads, screen or filter applications, and evaluate candidates. Employers that use these tools must follow the provider's instructions, assign trained staff to oversee the system, check that the input data is relevant, keep logs, and inform candidates and employees that AI is involved. You cannot simply plug in a tool and walk away; you need to understand how it works and how it affects decisions.

The deadline has moved. The Digital Omnibus on AI entered into force on 27 July 2026 and pushed the high-risk obligations back from 2 August 2026 to 2 December 2027. The obligations themselves did not change. Some rules already apply: since February 2025, emotion recognition in the workplace has been banned, and since August 2026, transparency rules cover AI systems that interact with people, such as recruiting chatbots.

Use the extra time well. Map which tools in your hiring process use AI, ask your vendors how they will meet the requirements, and set up human oversight now rather than in late 2027.

NIS2: screening for cybersecurity-critical roles

ISO 27001 is the gold standard for information security management. It shows NIS2 requires essential and important entities to manage their cybersecurity risks, and people are part of that risk. Human resources security is one of the required measures. For digital infrastructure and ICT service providers, the EU's implementing rules explicitly include background verification for relevant staff.

EU member states are bringing NIS2 into national law at different speeds. In the Netherlands, the Cyberbeveiligingswet (Cybersecurity Act) has applied since 15 August 2026. It covers more than 8,000 organisations, which must register with the National Cyber Security Centre, take security measures, report significant incidents, and make sure their board members follow cybersecurity training.

If your organisation falls under NIS2, screening people in sensitive roles is no longer a nice-to-have. Read our NIS2 guide to employee screening to see what it means for your hiring process.

ISO 27001 and SOC 2: data security standards

ISO 27001 is the international standard for information security management. Certification shows that an independent auditor has checked how an organisation keeps sensitive data safe. The current version is ISO/IEC 27001:2022; the transition period ended on 31 October 2025, so certificates under the old 2013 version are no longer valid. When you assess a vendor, ask for a current 2022 certificate. The standard itself also includes screening of employees as a control.

SOC 2 is a US framework. It is not a certification but an attestation report from an independent auditor on how a vendor protects data. A Type II report, which tests controls over a period of time, tells you more than a Type I report, which looks at a single moment.

For HR, both give you confidence that candidate data is handled responsibly. They are not just badges; they are signals of trust.

FCRA and EEOC: fairness in US hiring

The Fair Credit Reporting Act (FCRA) has not changed. Before running a background check through a screening provider, employers must give a standalone disclosure and get written permission. If the report may lead to a rejection, they must first send a pre-adverse action notice with a copy of the report, give the candidate time to respond, and then send a final adverse action notice. Many states and cities add their own fair chance rules on top.

Federal enforcement on fairness has shifted. In January 2025, the Equal Employment Opportunity Commission (EEOC) removed its guidance on AI in hiring. In June 2026, the Department of Justice concluded that the EEOC's guidelines on disparate impact (rules that are neutral on paper but hit one group harder) are unconstitutional. And in October 2026, the EEOC sent the White House a draft rule to withdraw its 2012 guidance on using arrest and conviction records in hiring.

That does not mean anything goes. Title VII still bans discrimination, including disparate impact, and candidates can still sue. Many states have their own rules, too. New York City requires bias audits of automated hiring tools, Illinois has banned discriminatory use of AI in employment since January 2026, and California's rules on automated decision systems have applied since October 2025. Treating similar candidates the same way, and being able to explain why a background check is relevant to the job, remains the safest approach.

Fairness is not optional. Compliance and ethics go hand in hand.

What smart HR teams do

Smart HR teams build compliance into their workflows and connect it to their ATS. They work only with certified and audited partners, document every step, and train their people to keep up with changing rules. They also keep an eye on deadlines that are still moving, such as the AI Act's December 2027 date and the GDPR changes under negotiation. That way, audits become easier and compliance becomes part of everyday practice.

Turning compliance into an advantage

Regulations do not have to be a burden. They can become a competitive advantage. When candidates see that you value privacy, transparency and fairness, your employer brand gets stronger.

At Pescheck, compliance is not a box to tick; it is part of our DNA. We are ISO 27001 certified, fully GDPR compliant, integrated with more than 100 ATS platforms, and committed to making hiring both fast and compliant.