Andrada Popescu, Senior Associate, Noerr

article by Andrada Popescu, Senior Associate, Noerr

It is well known that technology is continually transforming the way we work. More and more companies are using programs that involve artificial intelligence (AI) software in order to simplify and accelerate their decision-making processes and overall business activities. One of the last areas to begin using AI is HR processes. 

There is no debate over the positive impact of AI software in HR processes or how AI reshapes the manner in which companies manage such processes. From recruitment, to measuring productivity and providing adequate training to employees, to overall employee participation within the company, AI is known for helping companies to streamline processes, cut time and costs and reduce (even unconscious) human biases. 

The new legal framework on the horizon

The use of AI software in HR processes may easily seem to be the “go-to” solution for employers. However, any company that uses AI software knows that there is a thin line between being fully compliant and breaking the law, which means that there is a strong risk that a desire for innovation could trigger a compliance catastrophe.

Until now, employers have been required to primary observe GDPR requirements when using AI software in HR processes, but the situation will soon become more complicated. A draft EU AI Regulation proposed by the European Commission in 2021 is currently the subject of political negotiations and is expected to be put to a plenary vote in late 2022 or early 2023. 

The draft AI Regulation establishes a risk-based approach (unacceptable, high, limited and minimal) – the higher the risk, the stricter the rule. HR technology systems and tools, i.e.: 

AI systems used for recruitment or selection of natural individuals - job ads, screening or filtering applications, assessment of candidates during interviews;

AI systems used for taking decisions on promotion and termination of employment agreements, tasks allocation, performance and behaviour assessments,

are considered high-risk AI systems. This means that the use of AI systems in HR processes is permitted subject to (i) compliance with strict requirements regarding data quality, documentation and transparency, human supervision, robustness against cyberattacks, and (ii) a conformity assessment of the application.

The draft AI Regulation also provides for detrimental consequences for companies that fail to comply with the requirements – up to €30,000,000 or 6% of total worldwide annual turnover for the most serious infringements. 

Given the above, it seems useful to compile a list of the main aspects that employers must take into account when implementing or using AI software in HR processes. 

A. Preventing algorithmic biases and ensuring transparency

Although AI software eliminates human bias, companies must be aware that such software can have an algorithmic bias.

AI software is based on algorithms, i.e. a set of instructions that are fed into computers to be used by the computers as a basis for decisions. Thus, a biased algorithm (e.g. due to a faulty database or incorrect programming) may lead to indirect discrimination against candidates/employees. For example, in the case of recruitment, if the company usually hires men, the AI software is likely to filter out female applicants.

Employers making decisions based on AI software that has an algorithmic bias are exposed to penalties if candidates/employees file discrimination claims with the National Council for Combating Discrimination (CNCD) or with a court of law, i.e. fines of up to RON 100,000 (€20,000).

In order to mitigate the risk of algorithmic bias, companies should take steps to be adequately informed about the AI software, meaning (i) discussing with the developers the data set and how the computer is to be trained to use the algorithms and (ii) testing the product to ensure that all the protected characteristics (e.g. gender, ethnicity etc.) are included in the training datasets. Moreover, employers must be able to ensure traceability of the system’s operations so as to be able to explain, if necessary, to employees/candidates or even labour authorities how the AI software produced the result on which the HR decision was based. 

B. Assess data protection risks

AI software in HR processes involves a variety of big-data analyses that may trigger significant implications from a GDPR perspective. Thus, employers that use AI software for HR processes must consider a data protection impact assessment (DPIA) in accordance with GDPR regulations, based on which it could consider taking measures such as:

pseudonymization of personal data, if possible;

ensuring transparency, i.e. ensuring that the individuals know how their data is being processed;

informing candidates/employees regarding the manner in which their data is being processed. 

C. Inform employees’ representatives or trade union

Employers have a general obligation to inform their employees on the elements of the employment relationship, as well as to consult with the employees’ representatives/trade union with respect to decisions which may substantially affect their rights and interests. Moreover, companies have an information obligation regarding the processing of personal data under the GDPR.

Although there is no specific labour information obligation related to the use of AI software, using AI software in HR processes with respect to its own employees involves the aggregation of data which may affect the employees’ rights and interests. Thus, in addition to a GPDR obligation, it could prove useful for companies to consult the employees’ representatives or trade union when implementing or using AI software in HR processes. 

D. Train and ensure a human element 

Both the GDPR and the draft AI Regulation prohibit to use AI software for exclusively automated decisions. Thus, it is of the utmost importance for companies to ensure that AI software is “supervised” by a human operator, most likely from the HR department. 

In such a case, the employer should make sure that the human operator has the competence, training and authority to perform this task. Thus, it is advisable for the employee to receive appropriate training so as to be able to carefully oversee the functioning of the AI software, correctly interpret the output and/or decide whether such output should be used, overridden or reversed. 

Irrespective of whether the draft AI Regulation comes into force, employers intending to or using AI software in HR processes should see the proposal as an opportunity to carefully assess the opportunities and risks of such software and adapt their practices accordingly.