Skip to content

Knowledge base · AI in HR

What do we, as an SME, have to arrange now if we use AI in HR?

Five things already apply: AI literacy of the people who work with the tools, no emotion recognition in the workplace, including for applicants, the transparency rules of Article 50, the GDPR (information, no solely automated rejections without safeguards, a DPIA where one is mandatory) and, if you have a works council, the council's consent for personnel data and monitoring systems. Use the time until 2 December 2027 to prepare for the high-risk duties.

In force nowTrusq editorial · checked against the official textLast verified:

Next step: Record your HR AI tools in Trusq

1. AI literacy

Take measures that support the AI literacy of everyone who works with AI on your behalf [1]. That has applied since 2 February 2025 [2].

2. No emotion recognition

AI to infer the emotions of persons in the workplace is prohibited, except for medical or safety reasons [3]. That also applies in job interviews: the prohibition covers situations related to the workplace [17].

3. Transparency

A chatbot must make clear that it is AI; the provider arranges that [4]. As a deployer, you disclose deepfakes [5]. This has applied since 2 August 2026 [6].

4. GDPR

Inform applicants about automated decision-making [7], do not leave decisions with significant effects solely to software [8], and check before use whether a DPIA is mandatory: among other cases for a systematic and extensive automated evaluation of persons, including profiling [9] [10], or where the processing is otherwise likely to result in a high risk.

5. Works council

If you have a works council, put a scheme on personnel data or a monitoring system to it for consent [11] [12] [13]. Without a works council, other, lighter rules apply; see the page on employee participation without a works council.

Preparing for 2 December 2027

Determine whether your tools fall under Annex III [14] [15]; from 2 December 2027 the deployer's duties then apply [16].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • Literacy programme AI Act 4
  • Role-based knowledge AI Act 4
  • Chatbot disclosure AI Act 50
  • Who carries Art. 50(1) and (2) for this system AI Act 3, AI Act 50
  • Deepfake label AI Act 50
  • DPIA for high risk

Sources

  1. [1] Regulation (EU) 2026/1744 Art. 1(5) (replaces AI Act Art. 4(1)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Providers and deployers of AI systems take measures that support the development of AI literacy among their staff and other persons operating and using AI systems on their behalf, tailored to knowledge, experience, training, context of use and the persons on whom the systems are used.
    Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
    Source, retrieved on 2 October 2026.
  2. [2] Regulation (EU) 2026/1744 Art. 1(40)(a) (replaces AI Act Art. 113, third paragraph, point (a)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Chapters I and II of the AI Act (including Article 4 and the prohibitions of Article 5) have applied since 2 February 2025.
    Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;
    Source, retrieved on 2 October 2026.
  3. [3] AI Act Art. 5(1)(f) (AI Act, Regulation (EU) 2024/1689). Placing on the market, putting into service or using AI to infer the emotions of a natural person in the workplace is prohibited, unless the system is intended for medical or safety reasons.
    the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;
    Source, retrieved on 2 October 2026.
  4. [4] AI Act Art. 50(1) (AI Act, Regulation (EU) 2024/1689). The provider ensures that an AI system intended to interact directly with people is designed so that they know they are interacting with AI, unless this is obvious to a reasonably well-informed, observant person.
    Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
    Source, retrieved on 2 October 2026.
  5. [5] AI Act Art. 50(4), first subparagraph (AI Act, Regulation (EU) 2024/1689). Deployers of a system that generates or manipulates image, audio or video content constituting a deepfake disclose that the content has been artificially generated or manipulated; for an evidently artistic, creative, satirical or fictional work, appropriate disclosure suffices.
    Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.
    Source, retrieved on 2 October 2026.
  6. [6] AI Act Art. 113, second paragraph (AI Act, Regulation (EU) 2024/1689). The general date of application of the AI Act is 2 August 2026; the transparency duties of Article 50 fall under it.
    It shall apply from 2 August 2026.
    Source, retrieved on 2 October 2026.
  7. [7] GDPR Art. 13(2)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). When collecting data from the data subject, the controller states the existence of automated decision-making referred to in Article 22, with meaningful information about the logic involved, the significance and the envisaged consequences.
    the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
    Source, retrieved on 2 October 2026.
  8. [8] GDPR Art. 22(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
    The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
    Source, retrieved on 2 October 2026.
  9. [9] GDPR Art. 35(3)(a) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A DPIA is required in particular in the case of a systematic and extensive evaluation of personal aspects based on automated processing, on which decisions are based that produce legal effects or similarly significantly affect the person.
    a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
    Source, retrieved on 2 October 2026.
  10. [10] AP DPIA list (Stcrt. 2019, 64418), list, point 15 (Profiling) (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). Systematic and extensive automated evaluation of personal aspects (profiling), such as assessment of performance at work, is on the list of mandatory DPIAs. Original Dutch text:
    15. Profilering Systematische en uitgebreide beoordeling van persoonlijke aspecten van natuurlijke personen gebaseerd op geautomatiseerde verwerking (profilering), zoals bijvoorbeeld beoordeling van beroepsprestaties, prestaties van leerlingen, economische situatie, gezondheid, persoonlijke voorkeuren of interesses, betrouwbaarheid of gedrag.
    Source, retrieved on 2 October 2026.
  11. [11] WOR Art. 27(1), introductory wording (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). For every proposed decision to adopt, amend or withdraw the schemes in Article 27(1), the employer needs the consent of the works council. Original Dutch text:
    De ondernemer behoeft de instemming van de ondernemingsraad voor elk door hem voorgenomen besluit tot vaststelling, wijziging of intrekking van:
    Source, retrieved on 2 October 2026.
  12. [12] WOR Art. 27(1)(k) (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). The employer needs the works council's consent for a scheme on the processing and protection of personnel's personal data. Original Dutch text:
    k. een regeling omtrent het verwerken van alsmede de bescherming van de persoonsgegevens van de in de onderneming werkzame personen;
    Source, retrieved on 2 October 2026.
  13. [13] WOR Art. 27(1)(l) (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). The employer needs the works council's consent for a scheme on facilities aimed at or suitable for observing or monitoring the attendance, behaviour or performance of personnel. Original Dutch text:
    l. een regeling inzake voorzieningen die gericht zijn op of geschikt zijn voor waarneming van of controle op aanwezigheid, gedrag of prestaties van de in de onderneming werkzame personen;
    Source, retrieved on 2 October 2026.
  14. [14] AI Act, Annex III, point 4(a) (AI Act, Regulation (EU) 2024/1689). AI for recruitment or selection, such as placing targeted job advertisements, analysing and filtering applications and evaluating candidates, is listed in Annex III.
    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
    Source, retrieved on 2 October 2026.
  15. [15] AI Act, Annex III, point 4(b) (AI Act, Regulation (EU) 2024/1689). AI for decisions on terms of employment, promotion or termination, for task allocation based on behaviour or characteristics, and for monitoring and evaluating performance and behaviour is listed in Annex III.
    AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.
    Source, retrieved on 2 October 2026.
  16. [16] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 2 October 2026.
  17. [17] AI Act, recital 44 (AI Act, Regulation (EU) 2024/1689). The Regulation prohibits emotion recognition in situations related to the workplace, because of the power imbalances in the context of work.
    Considering the imbalance of power in the context of work or education, combined with the intrusive nature of these systems, such systems could lead to detrimental or unfavourable treatment of certain natural persons or whole groups thereof. Therefore, the placing on the market, the putting into service, or the use of AI systems intended to be used to detect the emotional state of individuals in situations related to the workplace and education should be prohibited.
    Source, retrieved on 2 October 2026.

Related questions

Do we have to make our HR team AI literate if we use AI tools?May we use AI that infers the emotions of applicants or employees, for example in video interviews?Does our recruitment chatbot have to say that candidates are talking to AI?May software automatically reject applicants without a person looking at it?Do we have to carry out a DPIA before we use AI in recruitment or personnel management?Does our works council have a right of consent if we introduce an AI tool for HR?Is our AI tool for recruitment, selection or personnel management a high-risk system?We have fewer than 50 employees and no works council. Do we have to arrange employee participation for an AI tool?

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.