AI in onboarding and internal mobility: where is the line?

Short answer: AI in onboarding and internal mobility — talent marketplaces, skills matching, career paths — feels more innocent than AI in external recruitment, but legally it is not. As soon as such a system steers promotion, progression or task-allocation decisions, it falls under Annex III, point 4 of the AI Act and counts as high-risk. On top of that, the GDPR, transparency duties and the principle of equal opportunity apply — inside your own organisation too.

Why internal is not "safer"

Many employers assume the heavy rules only apply when hiring new people. That is wrong. Annex III, point 4 of the AI Act expressly captures decisions after entry into service too: promotion, termination, task allocation and evaluation. An internal talent marketplace that determines who becomes visible for an attractive role touches exactly that core. The employee is already inside, but their career is steered by an algorithm all the same. See AI in the workplace for the broader frame of what falls on the employer.

When the high-risk line is reached

The pivot is influence over a decision. A tool that merely makes learning suggestions or shows vacancies without filtering does not yet steer a decision. But as soon as the system ranks candidates for an internal role, gives progression advice that weighs heavily, or determines who is and is not put forward, it influences a promotion or progression decision. That is when it tips into high-risk. The practical test: would a human as a rule adopt the system's outcome? If so, it steers the decision. AI in evaluation, promotion and dismissal works this out further.

Skills matching and the GDPR

Talent marketplaces run on profiles: skills, performance, ambitions, sometimes derived scores. That is processing of personal data in full. The GDPR requires a legal basis, data minimisation and transparency about what you process and why. If you use decisions based solely on automated processing with significant effects — for example automatically excluding someone from a programme — Article 22 comes into play, with a right to human intervention. Be careful too with derived sensitive data; a skills profile can inadvertently reveal health or origin.

Equal opportunity, internally too

A matching algorithm trained on who has historically progressed reproduces historical skew. If promotion was once mostly granted to a particular group, the model learns that pattern and reinforces it. Internally that feels invisible — no one gets a rejection, people simply are not "matched". That is precisely why bias monitoring is essential here: measure progression per group and investigate unexplained differences. The ban on discrimination does not stop at the front door.

Algorithmic management and the grey zone

Between innocent recommendation and high-risk decision lies a growing grey zone: AI that distributes work, allocates opportunities and steers behaviour. That is a form of algorithmic management, and the regulator looks ever more closely at the actual influence, not the label the supplier attaches to it. So document explicitly how heavily the system weighs in and who makes the final decision.

Internal mobility with AI can make careers fairer and more transparent — but only if you recognise the line where a suggestion becomes a decision.