AI is rapidly transforming HR, from recruitment to workforce management, yet it also brings new responsibilities under the EU AI Act and existing GDPR rules. Many HR teams wonder what is changing, which risks to consider and how to use AI in a safe and compliant way. The FAQ below offers a clear overview of the most important requirements, practical considerations and concrete steps organisations can already take today.
1. What does the EU AI Act mean for HR teams?
The EU AI Act is the new European law that regulates how AI may be developed, purchased and used. HR is one of the most affected domains because AI tools in hiring, screening, assessment and workforce management influence people’s careers. These tools fall under the category the law calls high risk. This means HR teams must ensure transparency, human oversight, proper documentation, logging, monitoring and quality controls throughout the lifecycle of the system.
3. Does the GDPR still apply when AI is used in HR?
Yes. The GDPR continues to govern how personal data is processed, even when AI is involved. HR must determine a lawful basis, usually legitimate interest or performance of a contract. Consent is not suitable in employment settings. A Data Protection Impact Assessment is often mandatory because HR AI involves sensitive data and automated decision support.
5. Do we need a DPIA for AI in HR?
In most cases, yes.
A DPIA is required when the processing likely involves high privacy risks. AI for screening, scoring, profiling, performance or workforce planning usually qualifies. A DPIA must describe the purpose of the AI system, the data used, the risks, the proportionality assessment and the measures taken to reduce harm.
7. What about vendors who store logs or train with user input?
Vendors may store logs or use input data for model improvement, which creates risks. HR teams must ensure vendor contracts include:
- explicit restrictions on training
- explainability and transparency commitments
- data isolation between customers
- the right to audit
- clear incident response processes
- safeguards for cross border transfer
9. How do we know if an AI model is fair and explainable?
The system must provide understandable reasons for its outputs, different from technical model internals. If a model functions as a black box without meaningful reasoning, it is not acceptable for HR decisions. Internal guidelines, audits and reporting help demonstrate explainability and fairness to stakeholders such as HR, Legal and worker councils.
11. How do we assess whether a vendor’s AI system is safe and compliant?
Vendors must answer questions about:
- training data sources
- fairness and performance metrics
- update cycles
- incident response
- transparency features
- storage locations
- cross border transfers
- security controls
Contracts must clearly define responsibilities, liability and audit rights.
13. What is adequate human oversight in HR AI?
Supervisors must:
- understand how the AI system works in broad terms
- detect unexpected outcomes or errors
- correct or override outputs
- intervene when necessary
They need training, authority and clear procedures.
15. Which metrics should HR monitor continuously?
HR teams should track accuracy, fairness across groups, drift, stability, response times, uptime, data quality and the frequency of human interventions. All changes and evaluations must be documented.
17. How should HR communicate the use of AI to workers and unions?
Workers and unions must be informed early. Communication should explain what the AI system does, why it is used, its benefits, its limits and how privacy and fairness are protected. Depending on national rules, works councils may have consultation or approval rights.
19. Which HR AI use cases offer quick value with low risk?
Examples include FAQ chatbots, administrative CV parsing, scheduling and workforce dashboards. These deliver efficiency without influencing final decisions.
21. What first steps should HR take after learning this?
Key early steps include:
- mapping which AI use cases are already present
- running DPIAs for high impact cases
- vetting vendors
- starting small pilots with monitoring
- establishing governance and documentation
- exploring compliance tooling such as Yields
