The EU AI Act Applies Worldwide.

Somalia. South Sudan. Yemen. Libya. Syria. – Those are the only exceptions.

The $3 Million Question

A company in Texas uses an AI tool to screen job applicants. 500 applications in, 20 out. One of the 480 rejected candidates sues. Not under the EU AI Act. Under Title VII of the Civil Rights Act – a law that’s been on the books since 1964.

The judge’s question: “Explain how this decision was made.”

Silence.

Not because the company acted in bad faith. Because nobody in the company can explain how the AI tool produced those 480 rejections. HR bought the tool. IT installed it. And the decision logic sits inside a black box that nobody can open.

This isn’t hypothetical. This is happening right now. In courtrooms across the United States. And across the world.

Accountability Is Not a European Invention

Most executives have mentally filed the EU AI Act under “European regulation.” That’s an expensive mistake. The EU AI Act didn’t invent the principle of explainable decisions. It was simply the first to write it down specifically for AI systems.

The principle itself is universal.

United States: Title VII of the Civil Rights Act prohibits discrimination in employment decisions – since 1964. The EEOC can demand at any time that a company explains why a candidate was rejected. The ADA covers disability discrimination. ADEA covers age. And in New York City, Local Law 144 has required mandatory bias audits for AI hiring tools since 2023.

Brazil: LGPD Article 20 grants an explicit right to explanation for automated decisions. Brazilian labor courts process over 3.5 million new cases per year – the most active labor judiciary on the planet.

China: Algorithmic Recommendation Management Provisions have been in effect since 2022. Even China demands transparency in algorithmic decisions.

United Kingdom: Post-Brexit, the UK is building its own AI regulatory framework. But the ICO has been clear: automated decisions must be explainable under UK GDPR and the Equality Act 2010.

India: The IT Act 2000 combined with the Industrial Disputes Act gives employees tools to challenge automated decisions.

Everywhere else: In every country with a functioning civil legal system, a person affected by an AI decision can challenge that decision in court. The question “Why?” is universal – and a black box is an acceptable answer nowhere.

Of the 193 UN member states, there are exactly 5 where a company cannot be held legally accountable for an unexplainable AI decision. Not because those countries allow it – but because they have no functioning court system.

The EU AI Act isn’t European overregulation. It’s the first honest answer to a universal question.

Why HR Is Ground Zero

Wrong AI decisions about products are annoying. Wrong AI decisions about processes are expensive. Wrong AI decisions about people are existential – for the affected individuals and for the company.

HR is where AI decisions create the largest attack surface. Three scenarios that are already happening today:

AI-powered CV screening systematically filters out candidates with career gaps. Affected: parents, people with chronic illness, career changers. In most jurisdictions, this constitutes disparate impact discrimination.

Sentiment analysis in video interviews misreads cultural differences in expression and body language as negative signals. Affected: candidates from different cultural backgrounds. This is potentially ethnic discrimination.

A performance prediction tool trained on historical promotion data reproduces past patterns. If men were promoted more frequently in the past, the tool replicates that pattern. That’s systematic gender discrimination – automated and scaled.

Every one of these scenarios is already actionable in most countries. Not starting August 2026. Right now. The difference: the EU AI Act turns this from reactive liability into proactive obligation.

And the real problem with AI discrimination compared to human discrimination: a biased manager might make 50 questionable decisions per year. A biased algorithm makes 50,000. Simultaneously. Consistently. Provably.

The Two Layers Every Company Needs

The solution isn’t complex – but it requires architectural thinking. Every company that uses AI for decisions about people needs two layers.

The Decision Layer – the evidence. The Decision Layer breaks down every process into individual decision steps and defines for each step: human, ruleset, or AI. Every AI-assisted decision answers: What data went in? Which model decided, in which version? What was the result and at what confidence level? Did a human review the result before it took effect? Is the decision reproducible?

This isn’t a technical nice-to-have. It’s the digital equivalent of bookkeeping. And just as no company can operate without bookkeeping, no company will soon be able to operate without a Decision Layer.

The Governance Layer – the rules of engagement. Before the first AI decision is made: What AI applications even exist in the company? Most companies don’t know. How risky is each application – not by regulatory categories, but by real impact on people? Who bears responsibility? Spoiler: “IT” is not an answer. When must a human intervene? And how is all of this audited?

In Germany, there’s an additional dimension: co-determination (Mitbestimmung). Under the Works Constitution Act (BetrVG §87), works councils (Betriebsräte) have co-determination rights when AI systems are introduced that make decisions about employees or monitor their behavior. Without traceable decision logic, without documented Human-in-the-Loop processes, without works agreements as system constraints, no works council will give its approval.

The Elephant in the Room: Shadow AI

And now the most uncomfortable point. Most companies are debating governance for AI tools they’ve officially deployed. Meanwhile, their employees are already using ChatGPT, Claude, Copilot, and other tools for decision support – without anyone knowing.

Recruiters are using ChatGPT to summarize applications. Team leads are having Copilot draft promotion recommendations. L&D is generating performance reviews with AI.

All of this is happening. Now. Without a Decision Layer. Without a Governance Layer. Without any traceability.

And when someone sues, the answer won’t be “the AI decided” – it’ll be worse: “We didn’t even know AI was deciding.”

The Real Question

The question isn’t: “Are we EU AI Act compliant?”

The question is: Can we explain tomorrow – in every country where we operate – why we decided the way we did today?

If you can answer yes, you’re automatically compliant. With the EU AI Act. With GDPR. With EEOC requirements. With LGPD. With whatever comes next.

If you can’t, you don’t have a regulation problem. You have a governance problem.