AI for strategic workforce planning: usually not high-risk, as long as it does not become individual
AI for strategic workforce planning and skills forecasting at organisation level is usually not high-risk under the AI Act. But once it steers individual decisions, it can tip over. Data quality, governance and transparency remain crucial.
Short answer: AI that forecasts capacity, skills and future staffing needs at organisation or team level is usually not high-risk under the AI Act โ unlike AI that evaluates or selects individual employees. The pitfall lies in the transition: as soon as the planning starts steering individual decisions (who stays, who gets training, who becomes redundant), it can tip into high-risk and bring the GDPR fully into play.
What strategic workforce planning is
Strategic workforce planning looks ahead: which skills and how much capacity will the organisation need in one to five years, given strategy, market and demographics? AI helps to run scenarios, flag skills gaps and model supply and demand. The object is the organisation, not the person. That difference determines the legal regime.
Why this is usually not high-risk
Annex III of the AI Act designates HR applications as high-risk when used for recruitment, selection, or decisions about working conditions, promotion or termination of individual workers. Planning at an aggregated level โ job groups, departments, skills categories โ in principle falls outside this. The system takes no decision about an identifiable person and directly affects no one's rights.
Where it tips over
The regime changes the moment the outcome becomes traceable to individuals or steers decisions about them. A capacity model that in fact produces names for a reorganisation, or that determines who "deserves" training, shifts into individual algorithmic management and thereby potentially into high-risk โ with conformity assessment, human oversight and transparency obligations. The same model can thus fall on either side of the line, depending on use.
The real pitfalls: data and governance
Even without a high-risk label there are substantial risks. Historical data reflect past choices; a model predicting on that basis entrenches existing skews (for example under-representation in certain roles). Poor data quality yields confident but wrong forecasts. And without governance โ who owns it, who checks the assumptions, how often is it revalidated โ a planning model imperceptibly becomes a decision machine. See also AI in the workplace.
Transparency and the human decision
Strategic planning should inform decision-making, not replace it. Make explicit which assumptions sit in the model, how uncertain the forecast is and who makes the final choice. The same discipline applies to related operational uses such as AI-driven scheduling and payroll: useful for capacity, dangerous once it imperceptibly comes to be about persons.
What to do
- Keep planning at organisation/team level and non-traceable to individuals.
- Guard the line: as soon as the outcome steers individual decisions, the high-risk regime applies.
- Invest in data quality and bias control; old data predict old inequality.
- Establish governance and transparency: ownership, revalidation and a human who decides.
Strategic workforce planning is one of the few HR AI applications that can be legally comfortable โ precisely because it is about the organisation and not the person. That comfort ends the moment the model starts naming names.
Sources
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2024/1689 (AI Act): Annex III makes HR AI high-risk for decisions about individual workers, not for mere organisational planning. - https://eur-lex.europa.eu/eli/reg/2016/679/oj
Regulation (EU) 2016/679 (GDPR): applies as soon as aggregated planning becomes traceable to individual employees.
Read next
Right to explanation of an AI decision: what Article 86 of the AI Act gives you
If you are affected by a decision based (in part) on a high-risk AI system, Article 86 of the AI Act gives you the right to a clear explanation of the AI system's role and the main elements of the decision โ from the deployer, on top of your GDPR rights.
The most common AI Act mistakes and how to avoid them
The biggest AI Act pitfalls are not exotic edge cases: overlooking hidden AI, misjudging your role, classifying too heavily or too lightly, forgetting transparency, and treating compliance as a one-off project.
Instructions for use and transparency to the deployer: Article 13
Article 13 requires high-risk AI to be transparent enough and to come with instructions that let the deployer understand and use the system correctly. Those instructions must cover purpose, performance, limits and oversight measures. This guide explains what belongs in them.