The legal framework for AI in HR

HR is the most regulated department when it comes to AI use. And for good reasons: employment decisions directly affect people's fundamental rights (right to work, non-discrimination, privacy, dignity). An algorithm that decides who is hired, promoted or fired has an impact comparable to that of a judge.

The legal framework applicable to AI in HR in the EU consists of three pillars:

1. GDPR (General Data Protection Regulation, 2018): regulates personal data processing, including automated decisions (Art. 22).
2. AI Act (AI Regulation, 2024): classifies AI in employment as high-risk (Annex III.4) and imposes specific obligations.
3. National employment law: labor statutes, collective agreements, and worker representatives' information and consultation rights.

This module guides you through each of these pillars with practical instructions. It is not a legal document (you need a lawyer for that). It is a working guide for the HR manager who wants to use AI without breaking the law.

GDPR Art. 22: automated decisions in employment

GDPR Art. 22 establishes a fundamental right: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."

What it means in practice for HR

• Hiring: you cannot reject candidates fully automatically without meaningful human intervention. A human who simply "approves" what the algorithm says without reviewing it does not count as meaningful intervention.
• Performance evaluation: if the evaluation score is automatically generated and has consequences (bonus, promotion, dismissal), you need real human intervention in the decision.
• Monitoring: if you monitor employee performance with AI and the conclusions affect their employment situation, Art. 22 applies.
• Turnover prediction: if you use prediction to take measures that affect the employee (not renewing contract, changing team), you need a legal basis and transparency.

The 3 exceptions under Art. 22

Automated decisions are permitted when:

1. It is necessary for a contract between the data subject and the controller.
2. It is authorized by EU or Member State law.
3. It is based on the data subject's explicit consent.

In all three cases, you must implement measures to safeguard the data subject's rights: at minimum, the right to obtain human intervention, the right to express their point of view, and the right to contest the decision.

What is "meaningful human intervention"

The EDPB (European Data Protection Board) guidance clarifies that human intervention must be real, not simulated. Criteria:

• The reviewing person has authority and ability to change the decision.
• They have access to all relevant information (not just the algorithm's output).
• They dedicate sufficient time to the review (not an automatic click).
• They can bring criteria the algorithm does not have (context, personal circumstances).

AI Act Annex III.4: concrete obligations for HR

We covered the AI Act classification in HR02. Here we go deeper into the practical obligations it creates for the HR department.

Deployer obligations (the company using the AI system)

The AI Act distinguishes between provider (who develops the system) and deployer (who uses it). Your company is the deployer. Your obligations as a deployer of a high-risk system include:

1. Assign human oversight (Art. 26.1): designate persons with competence, authority and resources to oversee the system. Simply saying "HR monitors it" is not enough. You need specific people with training.
2. Use the system per instructions (Art. 26.1): read and follow the provider's usage instructions. If the provider says "do not use for automatic rejection" and you use it for that, you are liable.
3. Ensure relevant input data (Art. 26.4): the data you feed the system must be representative of the context in which you use it.
4. Inform employees (Art. 26.7): before using a high-risk system, you must inform workers and their representatives.
5. Conduct DPIA (Art. 26.9): data protection impact assessment before putting the system in use.
6. Retain logs (Art. 26.6): maintain automatic records generated by the system for at least 6 months.
7. Monitor the system (Art. 26.5): watch its operation and report serious incidents to the provider and authority.

Application timeline

• February 2025: prohibitions on unacceptable practices (e.g. social scoring).
• August 2025: obligations for general-purpose AI models (GPAI).
• August 2026: obligations for Annex III high-risk systems (includes HR).
• August 2027: obligations for high-risk systems integrated into regulated products.

Informing employees (AI Act Art. 26.7)

AI Act Art. 26.7 establishes that "deployers shall inform workers and their representatives that they will be subject to the use of a high-risk AI system". This obligation is independent of GDPR and adds to existing transparency obligations.

What information to provide

• Which AI system is used: name, provider, purpose.
• What it is used for: in which HR process stage and for what purpose (screening, evaluation, prediction).
• What data it processes: what employee/candidate information feeds the system.
• What type of decisions it produces: recommendations, scores, classifications.
• What human intervention exists: who reviews decisions and how the employee can challenge them.
• Employee rights: right to explanation, right to challenge, right to have the decision reviewed by a human.

Format and channel for information

The AI Act does not specify the format, but best practices include:

• AI policy document for HR accessible to all employees (intranet, employee handbook).
• Specific communication when introducing a new system (email, informational meeting).
• Notice within the process itself (e.g.: at the start of an online application: "This process uses AI for...").
• Query channel (email, form) for questions and complaints.

DPIA for AI systems in HR

The DPIA (Data Protection Impact Assessment) is mandatory when data processing presents a "high risk to the rights and freedoms" of individuals. Using AI in employment decisions always falls into this category.

When is DPIA mandatory

According to EDPB guidelines, a DPIA is mandatory when 2 or more of these criteria are met:

• Evaluation or scoring (including profiling)
• Automated decision-making with legal or significant effect
• Systematic monitoring
• Sensitive or highly personal data
• Large-scale processing
• Combination of datasets
• Data of vulnerable persons (employees = power relationship)
• Innovative use of technology
• Processing that prevents exercise of a right

An AI system for CV screening meets at least 4 of these criteria. The DPIA is not optional.

DPIA content

1. Processing description: what data, what system, what purpose, what flow.
2. Necessity and proportionality: why is this processing necessary? Is there a less invasive alternative?
3. Risks to rights: discrimination, lack of transparency, data loss, unjust decisions.
4. Mitigation measures: for each risk, what measure reduces the impact or probability.
5. DPO consultation: the Data Protection Officer must be consulted.
6. Stakeholder consultation: when possible, consult employees or their representatives.

Prompt to start a DPIA

"Generate the outline of a DPIA for an AI system used in [CV screening / performance evaluation / turnover prediction]. Data processed: [list]. Purpose: [description]. Responsible: [department]. For each DPIA section (description, necessity, risks, mitigation): generate 3-5 relevant points. Include the applicable GDPR and AI Act articles. NOTE: this is an initial draft for DPO review, not a final legal document."

Consultation with worker representatives

In EU member states, employment law generally recognizes the right of worker representatives to be informed and consulted about the introduction of new work systems that may affect workers. This explicitly includes AI systems.

Recommended consultation process

1. Prior information: at least 15 days before implementing an AI system, deliver a document to the works council/representatives with: system description, purpose, data processed, impact on working conditions.
2. Consultation period: give representatives the opportunity to ask questions and raise objections.
3. Reasoned response: if representatives raise objections, respond with reasons (accepting or justifying why they are not accepted).
4. Documentation: record the entire process (dates, documents delivered, questions, responses).

Activity logging and records

Both GDPR (Art. 30) and the AI Act (Art. 12 and 26.6) require maintaining records of AI system use. In the HR context, this means:

• Decision log: for each AI-assisted decision (candidate rejected, evaluation generated, turnover score), record: date, input, output, final decision, and who made the final decision.
• Retention period: at least 6 months per the AI Act. GDPR may require more depending on the legal basis.
• Accessibility: logs must be available to the supervisory authority and for internal audits.
• Integrity: logs must not be retroactively modifiable.

Contracts with AI vendors for HR

If you use an external AI provider for HR (an ATS with AI, an evaluation platform, a screening service), your contract with that provider must include specific clauses.

Essential clauses

• GDPR role: the provider is a data processor. You need a processor agreement (Art. 28 GDPR).
• Algorithmic transparency: the provider must give you sufficient information about how the system works to fulfill your transparency obligations.
• Audits: right to audit the system (or have a third party audit it) to verify fairness and compliance.
• Incidents: provider obligation to notify you of incidents affecting the system's accuracy, bias or security.
• Data portability: right to extract your data if you change providers.
• Data location: where data is processed (within the EU is a requirement in many cases).
• Data use for training: the provider must NOT use your employee/candidate data to train AI models (unless you explicitly authorize it).

Compliance checklist for AI in HR

Use this checklist before implementing any AI system in HR:

GDPR

• Legal basis identified for data processing (Art. 6)?
• DPIA conducted and documented?
• DPO consulted?
• Information to data subjects (Art. 13/14) updated?
• If automated decision-making (Art. 22): meaningful human intervention implemented?
• Processor agreement with the provider (Art. 28)?
• Record of processing activities updated (Art. 30)?

AI Act

• System classified as high-risk (Annex III.4)?
• Human oversight assigned (specific people with training)?
• Employees and representatives informed (Art. 26.7)?
• Automatic logs functioning and stored (min. 6 months)?
• Provider usage instructions read and followed?
• Incident procedure defined?

Employment law

• Works council informed and consulted?
• Consultation process documentation archived?
• Employee complaint channel enabled?
• Collective agreements reviewed (are there AI clauses)?

Ejercicio practico

Puntos clave