Who actually decides about your employees?
AI, HR and the legal boundary you cannot afford to ignore.
As of 2 August 2026, the new transparency rules under the AI Act have entered into force. Employers, in their capacity as deployers, must provide the necessary information where AI systems are used for emotion recognition or to generate or manipulate image, audio or video content into a deepfake.
In principle, the obligations for high-risk AI systems also became applicable. These include, for example, AI systems used in the selection and evaluation of employees. However, these obligations have been postponed to 2 December 2027.
This is probably already happening in your organisation
Many HR departments already make extensive use of AI tools today. A growing company receives hundreds of applications for every vacancy. Recruitment software automatically filters the pile on the basis of certain parameters. The HR department uses ChatGPT or Copilot to summarise and structure interview notes and other conversations. And a team lead facing an evaluation round runs the various targets through a tool to help formulate their assessments.
No one within the company considers this problematic as part of HR policy. It simply feels more efficient, faster and better structured.
Until the moment someone asks a question. A rejected candidate wants to know why they never made it to an interview. An employee contests a dismissal. Or it emerges that a manager pasted personal data and health information into an external AI tool.
AI in HR: where do the legal risks begin?
a) Unequal treatment
The principle of equal treatment is imposed by various pieces of legislation and applies throughout the entire employment process, from recruitment to dismissal.
For recruitment and selection there is even a separate national collective bargaining agreement, CBA No. 38. This has given rise to a number of good practices, such as neutral job postings, anonymity during pre-selection, and consistency in interviews and tests. Recruiters and HR staff are turning to recruitment tools more and more frequently. These tools sometimes go beyond merely analysing and categorising candidates. In some cases, AI is also used to assign a score to candidates, ultimately producing a ranking.
AI, however, learns from historical data, and historical data carry historical patterns. A system may therefore indirectly select on characteristics correlated with sex, age, origin, health or family situation. Certain profiles are consequently pushed forward and thus favoured. This gives rise to unequal treatment, even where that was never the intention.
b) Privacy and data protection
There are also risks in the area of privacy and data protection.
Employers are required to protect employees’ privacy with regard to the processing of their personal data. The General Data Protection Regulation (GDPR) provides that “appropriate technical or organisational measures” must be taken.
Entering individual employees’ data into AI tools, for example within an HR department, is therefore not without consequence. Robust security mechanisms are essential to safeguard employee privacy.
c) Other points of attention
Article 22 of the General Data Protection Regulation reads as follows: “The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” Even within the limited exceptions, appropriate safeguards must still be put in place, including at a minimum the right to human intervention.
Where an HR decision — such as a decision on recruitment, promotion or dismissal — is delegated to an AI tool, this may well constitute automated individual decision-making of this kind.
From an employment law perspective, this is not without risk. AI tools can of course support an employer in building a dismissal file. In light of CBA No. 109 and the anti-discrimination rules, however, it is essential that dismissals are based on objective and therefore non-discriminatory grounds. Where the dismissal decision is left blindly to AI, the employer may find itself in a difficult position.
HR and the AI Act
The use of AI is growing exponentially, including in the workplace. As noted above, this brings with it a range of legal challenges. With the AI Act, European policymakers sought to introduce a comprehensive framework.
Annex III to the AI Act designates certain AI systems as high-risk. It includes a category covering “employment, workers management and access to self-employment”, and more specifically:
- “AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”
- “AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships”
Given this broad definition, virtually any use of AI systems in an HR environment must be treated as high-risk. This does not mean that the use of AI in this context is automatically prohibited, but rather that obligations attach to it — including for employers in their capacity as deployers (such as human oversight). As noted above, these obligations have been postponed to 2 December 2027.
In a number of cases, the high-risk label is expressly disapplied. Examples include:
- structuring data and organising HR documents;
- refreshing the text of a job posting;
- analysing previous HR decision-making;
- translating HR documents.
The AI Act further prescribes that employees (and their representatives) must be informed before a high-risk AI system is deployed in the workplace. This is therefore an information obligation. The Regulation does not, however, specify how that information must be provided in practice, leaving this to national rules and practice. The concrete implementation is therefore not entirely clear. It is sometimes argued that CBA No. 39 applies, but this does not appear to follow automatically given the criteria it contains. Moreover, the Regulation refers only to a communication. It is therefore questionable whether a consultation obligation can be triggered at all.
AI and emotion recognition in the workplace
It is entirely conceivable that employers may wish to use certain information — such as heart rate or walking patterns — for example to improve wellbeing at work or to streamline the production process.
Since February 2025, such practices have become more difficult. In certain cases, the AI Act prohibits inferring or detecting emotions in the workplace. This prohibition applies only where so-called biometric data are used for that emotion recognition. This covers physical, physiological and behavioural human characteristics such as the face, eye movements, voice, posture, heart rate, blood pressure and keystrokes.
Importantly, emotions are not the same as physical states. According to the European Commission, AI systems may indeed be used to detect fatigue (for instance in drivers) in order to prevent accidents. The AI Act itself also contains an express exception for AI systems on “medical or safety grounds”. The Commission clarifies, however, that this exception cannot provide a legal basis for the general monitoring of stress levels in the workplace.
AI policy
It is entirely possible for an employer to impose an AI policy. Such a policy can set out rules on the use of AI in the workplace. Possible rules include:
a list of the departments and/or roles permitted to use AI tools;
a list of the AI tools that may be used;
a prohibition on entering certain sensitive and confidential personnel and company information.
Unlike the work rules, a policy — as an HR document — is relatively straightforward to implement and subsequently update. Enforcement of the policy could, however, be strengthened by expressly making breaches sanctionable under the work rules.
The AI literacy obligations have been in force since February 2025. The policy can also set out how this level of AI literacy is maintained within the organisation.
Let’s review this together
Quorum assists employers in mapping AI use within HR, reviewing recruitment and evaluation tools, and drafting or tightening AI policies that also hold up at process level — all at the intersection of employment law, privacy and the AI Act. A concise AI & Employment scan is often enough to establish where you stand.
