Employers, the time to (AI) act is now!

The use of Artificial Intelligence (AI) systems in the workplace has increased rapidly in recent times and is expected to continue. Many employers and HR professionals have already incorporated AI into their day-to-day recruitment, performance-management and promotion processes. Employers may also be using AI to monitor employee IT usage, or to analyse performance against KPIs.

While employers are already subject to various laws including data protection laws and employment equality laws in the use of AI systems, the European Union Artificial Intelligence Act (the “EU AI Act”) puts into place a regulatory framework that all employers must comply with over a phased basis.

EU AI Act

The EU AI Act entered into force on 1 August 2024 and will be phased in over a three year period. The EU AI Act identifies four risk categories of AI systems:

• Unacceptable risk – these systems are a threat to fundamental rights.
• High risk – these systems pose a threat to health, safety and fundamental rights.
• Limited risk – these systems pose a moderate threat to rights and interests.
• Minimal risk – these systems pose little or no threat.

An employer’s compliance obligations will depend on the category of risk the AI systems that are being used in the workplace fall into. Employers must familiarise themselves with their obligations based on the designated category and plan their compliance journey accordingly.

A prohibition on the use of “unacceptable risk” AI systems will take effect on 2 February 2025 – for example, the use of biometric data of an employee to categorise employees or infer emotions will be forbidden from that date.

The key employment related aspects of the EU AI Act will come into force in two years’ time, on 2 August 2026.

AI in the Workplace

Of particular relevance to employers and HR professionals, the EU AI Act deems AI systems used in an employment context as “high risk” if it is used in the following cases:

• Recruitment and selection, in particular in placing targeted job advertisements, job application analysis and filtering, and candidate evaluation tools; and
• Any decisions affecting work-related relationships. This includes decisions relating to promotion, termination and performance evaluation.

Where a system is deemed high risk, an employer has strict obligations to make sure that there is human oversight in the life cycle of the AI system and to provide transparency as to how those systems will be used.

What are an Employer’s Obligations under the Act?

An employer’s obligations will depend on the category the AI system being used falls into and whether or not the employer is a “provider” of an AI system (develops and implements AI for others) or a “deployer” of an AI system (a user of AI systems). By and large, employers will be considered a “deployer” where they have bought their AI system from a provider and do not modify that AI, ie a user of the AI system.

Where using a high risk AI system as a deployer, employers must:

1. Ensure the AI system is used as per its instructions, monitor the system and report incidents to the provider;
   
   
2. Assign a person with appropriate training and authority to oversee the system;
   
   
3. Ensure that input data of which they have control of is relevant and sufficiently representative;
   
   
4. Keep logs automatically generated by the system for at least six months if possible;
   
   
5. Before using a high-risk AI system, employers must inform workers’ representatives and affected workers that they will be subject to the system; and;
   
   
6. Where appropriate, carry out a fundamental rights impact assessment, and if necessary, a data protection impact assessment prior to use.

We recommend contacting your legal advisor to discuss the practical implementation of these obligations.

Key Takeaways for Employers

AI has many benefits and can improve the workplace for both employees and employers by carrying out tasks, increasing efficiencies and driving innovation, however these benefits need to be balanced against the risks of using AI; the legal risks such as bias and discrimination, potential privacy concerns and legal and reputational risks, such as the use of generative AI that could lead to decisions being based on a “hallucination” (an incorrect output). We recommend that employers:

• Identify whether any technologies in use qualify as an AI system under the EU AI Act.
  
  
• Audit any current and proposed use of AI systems in the organisation and categorise what risk the AI system falls into.
  
  
• Employers should consider whether their AI systems are trained on data which contains bias, or where its application has a disparate impact on certain workers, as the use of such a system could result in discrimination;
  
  
• Implement an effective staff training programme on the use of AI in the workplace to explain the purposes of AI and gain employee trust;
  
  
• Implement policies and procedures to ensure alignment with the requirements of the EU AI Act. Ensure that technical documents are maintained and ensure that there is appropriate human oversight;

• Before using a high-risk AI system, inform workers’ representatives and affected workers that they will be subject to the system; and
  
  
• Put in place appropriate safeguards and controls to monitor AI systems and prevent or address any incidents.

Employers should be aware of key implementation dates of the EU AI Act and are advised to start their AI compliance journey in advance by reviewing and assessing AI systems already in use, identifying the risk category of those systems and the associated obligations. Appoint a compliance team who can identify steps to be taken to ensure a smooth compliance journey.

Educating your organisation from the boardroom down on the AI systems in use (or proposed to be used) and its purpose in the workplace is crucial to minimising potential risks associated with using AI; non-compliance with the EU AI Act can result in significant fines and reputational damage for any organisation. Please see further guidance on key issues from our Global AI Team.

Get in touch with our team if you have any questions or are interested in AI in the Workplace training for your organisation.