AI for HR: from hype to accountability

Welcome and introduction

Overview of AI in HR (CV screening, performance analysis); why the EU AI Act and the GDPR matter (fines of up to 4% of global turnover);

Poll: “Do you use AI in HR?”

AI Act risk classification

High-risk status for HR AI; risk management framework (from design to deployment); unbiased datasets; documentation, logs (6 months), registration in the EU database, human oversight.

Example: a hiring prediction tool unfairly rejecting candidates.

GDPR data principles

Lawfulness (consent/legitimate interest), fairness, transparent notices; purpose limitation, data minimisation, accuracy, security. Article 22: no automated decision-making without human oversight; special category data (health) requires a DPIA.

Example: a wellbeing app processing health data.

Key compliance steps

DPIA process (data flows, minimisation); transparency in notices; vendor due diligence (contracts, audits); regular bias audits, data governance, staff training.

Example: a step-by-step DPIA before launch.

Vendor and documentation obligations

Vendor due diligence (certifications, bias reports); contractual clauses (oversight, audits); maintaining live records for accountability.

Example: red flags in an AI SaaS vendor’s terms.

Q&A and key questions

Prepared FAQs (e.g., “What if the AI is hosted in the cloud outside the EU?”); quick tips.

Closing and resources

Key takeaways; next steps (internal audit).