Don't Bring Your HR Stack Into Europe Before It Clears the AI Act.

European law regulates how AI is used on workers directly. The AI Act applies to employers established in the EU and to companies outside it whose AI output is used in the EU, and it sits on top of data protection law and works council rights. Software that is routine at home can be banned, high-risk or subject to works council approval once European candidates and employees are involved.

The prohibited practices and the AI literacy duty have applied since 2 February 2025, and the transparency rules since 2 August 2026. The high-risk rules for employment AI apply from 2 December 2027, a date set by the amending Regulation (EU) 2026/1744. The literacy duty was softened in July 2026: employers must take measures to support AI literacy, but no specific individual level has to be guaranteed.

Only for part of it. The delay to 2 December 2027 is real, but the bans and the literacy duty apply now, and so do data protection law and works council rights. There is a transitional rule for systems already on the market before the high-risk date, which are caught only if their design changes significantly afterward. HR platforms update constantly, so treat that as a question for your vendor, not a plan.

AI used to recruit or select people, including targeted job ads, filtering applications and evaluating candidates, and AI used to make decisions on terms of employment, promotion or termination, to allocate tasks based on behavior or personal traits, or to monitor and evaluate performance and behavior. A narrow exception covers tools that only perform procedural or preparatory tasks without materially influencing the outcome, but any system that profiles people is always high-risk. People affected by a decision based on a high-risk system also have a right to a clear explanation of the AI’s role in it.

Yes, within limits. Monitoring has to be proportionate to its purpose and disclosed before it starts; French law, for example, bars collecting personal information through a device employees were not told about in advance. Works councils have a say: in Germany and the Netherlands they must approve systems capable of monitoring performance or behavior, and in France the CSE must be consulted first. Employee consent is rarely a valid legal basis, and emotion recognition at work, including on job candidates, is banned except for medical or safety reasons. Regulators do enforce this: in December 2024 France’s CNIL fined a small company €40,000 for software that logged remote workers’ “inactivity” and took regular screenshots of their screens, and in December 2025 France’s highest administrative court upheld a €15 million fine against Amazon France Logistique for data protection breaches in how it tracked warehouse staff, even while accepting some of its tracking indicators.

No. New York City’s Local Law 144 asks for an independent bias audit within a year of use, a published summary and notices to candidates. The AI Act works differently: it bans some practices outright and, from December 2027, puts duties on employers using high-risk tools, from trained human oversight to informing workers’ representatives before use, while data protection and works council rules apply alongside it. A recent bias audit is useful evidence for that work, but it does not answer those questions.

It can change your role. Under the AI Act, a company that develops an AI system and puts it into service under its own name, including for its own use in the EU, is its provider, not just a user. Providers of high-risk systems carry the heaviest obligations, from technical documentation to conformity assessment. We flag this early so your counsel can confirm the position before the tool touches European candidates.

It is the best moment. Changing a tool costs least before anyone in Europe has been assessed by it, and several rules turn on what happens before use: employees must be told about monitoring in advance, and from December 2027 workers and their representatives must be informed before a high-risk system is used at the workplace.

A map of every HR tool and AI feature with its AI Act category and your role, a prioritized gap report covering the AI Act, employment law and data protection, country notes on employee representative and privacy requirements, and a launch plan with the notices and literacy measures to have ready. Where a point needs a formal legal opinion, we frame the question for your counsel.