Clifford Chance

The recent approval of the EU Artificial Intelligence Act (EU AI Act) marks a significant shift in the legal landscape surrounding the use of artificial intelligence (AI) in the workplace. Breaches of the EU AI Act could result in fines up to the higher of EUR 35 million or 7% of global annual turnover.

The EU AI Act introduces a tiered classification system for AI systems and models based on their potential impact on human lives, fundamental rights and society. In particular, it specifically classifies certain AI systems in employment, such as AI tools intended to be used in recruitment, selection, and decision-making processes related to work-related relationships, as high-risk – and hence subject to strict obligations. In addition, certain AI systems are prohibited including AI tools to infer emotions in the workplace subject to limited exceptions.

Employers and HR professionals must be aware of the EU AI Act, its risk classifications and the corresponding obligations to ensure compliance.

Territorial reach

It is important to be aware that the EU AI Act will have a cross border application to multinationals in certain circumstances, including if their AI systems outside the EU are used to make decisions in relation to the workforce based in the EU.

Timeframe

The Act’s provisions will be phased in over a period of 36 months, with different provisions coming into force at 6, 12, 24, and 36 months after publication in the Official Journal (which is expected in the next couple of months). Employers must be prepared to adapt to these changes , including ensuring that any use of prohibited AI is modified or ceased to avoid contravention.

• 6 Months: the prohibition provisions will apply (including the prohibitions in respect of the use of emotion recognition software in the workplace); AI literacy requirements (including staff literacy), general provisions
• 12 Months: the provisions concerning notifying authorities and notified bodies, governance, general purpose AI models, confidentiality and Member State rules on penalties will apply.
• 24 Months: the provisions in relation to stand alone high-risk AI including AI used in an employment context (e.g. re recruitment),specific transparency requirements; regulatory sandboxes, etc
• 36 Months: the provisions in relation to sector specific high- risk AI systems will apply.

Action points

The EU AI Act will introduce a comprehensive and complex regulatory framework for AI that will have a significant impact on employers and HR professionals who use or plan to use AI systems in their operations. In preparation for the new regime, employers should take proactive steps to:

• Audit their current and proposed use of AI systems in the employment/HR context
• Determine whether any of the AI tools are used, or are likely to be, to make decisions in relation to the workforce based in the EU
• Assess whether any of the AI tools or uses would be regarded as ‘high risk’ or unacceptable and prohibited, or whether they come under any of the other classifications and related requirements of the EU AI Act
• Consider what principles, policies and procedures should be implemented to ensure alignment with the EU AI Act’s requirements (this may include, depending on their role, ensuring data quality, maintaining technical documentation, conducting conformity assessments, ensuring appropriate human oversight, complying with transparency measures, ensuring a sufficient level of AI literacy)
• Assess what safeguards and controls are or should be in place to prevent or address any issues or incidents
• Consider what training and guidance should be provided to the staff. 
• Identify what consultation and communication is required in relation to domestic or European Works Councils, trade unions and individual employees
• Decide how staff will be provided with clear and transparent information about the AI tools that are to be deployed
• Confirm their role in the AI value chain and corresponding obligations, including an assessment of the risk of qualifying as a provider
• Assess and incorporate the employment/HR aspects within their organisation’s broader AI strategy, governance and risk management framework, and leverage existing mechanisms
• Consider this within a global regulatory and compliance landscape, taking account of existing and upcoming AI-focused legislation around the world, as well as applicable employment, discrimination, health and safety, privacy and other relevant laws impacting the use of AI tools in an employment context.