AI in HR and compliance automation: a practical guide

In short: AI in HR and compliance automation pay off most when they remove repetitive work: onboarding, document collection, deadlines, checks and audit evidence. Decisions about people, such as hiring and performance reviews, should stay with a human: the EU AI Act treats them as high-risk, and in countries such as Italy employees must already be informed.

Key takeaways

Start with workflows that do not decide about people: onboarding, documents, deadlines, audit evidence.
Under the EU AI Act, AI for recruitment, evaluation and task allocation is high-risk: obligations apply from 2 December 2027.
Emotion recognition in the workplace has been banned since 2 February 2025.
In Italy, Law 132/2025 already requires employers to inform workers in the cases set out by Legislative Decree 152/1997.
AI training for staff (Article 4 of the AI Act) is already mandatory; national authorities start supervising it on 2 August 2026.

In mid-sized and large companies, HR and compliance run on forms, deadlines and checks: an online store hires seasonal warehouse and customer service staff, a B2B company receives supplier questionnaires, certification requests and audits from large accounts. According to Eurostat, in 2025 31.05% of EU enterprises using AI applied it to business administration processes or management, while 52.52% of those that considered AI without adopting it cited a lack of clarity about legal consequences. In Italy, Istat reports that companies with at least 10 employees using AI rose from 8.2% to 16.4% between 2024 and 2025. The question is where to use it, and with which obligations.

What can AI actually do in HR?

Today the most useful application of AI in HR is administrative work. Automation runs fixed rules: when a signed contract comes in, it creates accounts. Artificial intelligence interprets unstructured content: it reads a certificate and extracts its expiry date. In real projects they work together: a workflow in n8n or Make handles the steps, and a language model such as OpenAI's reads documents where rules are not enough.

Onboarding: document collection, account creation, mandatory training, reminders to the line manager.
Document management: contracts, certificates and training records sorted, with expiry dates extracted and flagged early.
Policy assistant: answers questions on leave, expenses and company rules, citing the document. Users must know they are talking to an AI.
Recruitment support: job ad drafts, interview scheduling, CV summaries. This is where high-risk territory begins.

An example: an online store bringing in fifteen warehouse staff for the November peak. With a well-built workflow, instead of HR chasing documents by email, each new hire uploads documents from a link, AI checks they are complete and legible, and only exceptions reach a person.

What is compliance automation and what does it check?

Compliance automation is the use of software workflows to continuously verify that processes, documents and suppliers follow internal rules and regulations, collecting audit evidence automatically. An audit trail is the record of who did what, when and with which data: it is the first thing an auditor asks for.

Supplier qualification (B2B): certification and compliance document expiry dates tracked, early reminders sent, orders flagged when a document has lapsed.
Privacy requests (e-commerce): customer access and deletion requests logged with date and response, data deleted when the retention policy says so.
Periodic checks: leavers' access revoked, training completed, customers' security questionnaires pre-filled from approved policies. On access control, see also AI and cybersecurity.

AI does not decide whether the company is compliant: it finds, compares and flags. Control criteria must be written down before you automate them.

The payoff is clearest in heavily regulated sectors and when an audit comes round: if every check leaves a trace, the compliance report is pulled from the log instead of being rebuilt by hand from emails and spreadsheets. A person still reads and signs it.

Which HR AI systems are high-risk under the EU AI Act?

Systems used to recruit staff and to make decisions about employment relationships are high-risk. Annex III, point 4, lists targeted job ads, filtering and evaluating applications, decisions on terms of work, promotion and termination, task allocation based on behaviour, and performance monitoring.

A high-risk AI system is allowed but subject to strict obligations: risk management, quality data to limit discrimination, activity logging, documentation, human oversight, accuracy and security. With the AI Omnibus, in force since 27 July 2026, these rules apply from 2 December 2027 instead of 2 August 2026: the delay buys time, but a CV screening tool chosen today will still be in use when they kick in. Emotion recognition in the workplace, on the other hand, has been banned since 2 February 2025, except for medical or safety reasons.

Use case	AI Act classification	What you need
Onboarding and documents	Outside Annex III if it does not assess people	Privacy notice, logs, a workflow owner
Policy assistant	Transparency duties: users know they are talking to AI	Approved sources, answers linked to the document
Compliance checks on suppliers and access	Outside Annex III if it does not decide about workers	Written criteria, audit trail, human review of anomalies
CV screening and ranking	High-risk (Annex III, point 4a)	Real human review, worker information, vendor documentation
Performance evaluation and behaviour-based task allocation	High-risk (Annex III, point 4b)	As above, plus involving workers' representatives
Emotion analysis from face or voice	Banned since 2 February 2025 (except medical or safety reasons)	Do not use it

What must a company using AI with employees do today?

Some obligations already apply. In Italy, Law 132/2025, in force since 10 October 2025, requires in Article 11 that AI at work be safe, reliable and transparent, and that employers inform workers in the cases set out by Article 1-bis of Legislative Decree 152/1997.

That article covers fully automated decision-making or monitoring systems that provide relevant input on hiring, management or termination, task allocation, monitoring and evaluation. Before starting work, employees must be told the system's purpose, how it works, the main data and parameters, control and correction measures, and its accuracy and security. The same information goes to trade union representatives, changes must be notified in writing at least 24 hours in advance, and a data protection impact assessment is required.

Across the EU, Article 22 of the GDPR adds the right not to be subject to decisions based solely on automated processing with legal or similarly significant effects, except in specific cases and with safeguards such as human intervention. From 2 December 2027, for high-risk systems, the deployer (the company using the system under its own authority) will also have to assign oversight to competent people, keep logs for at least six months and inform workers' representatives and workers before putting the system into service. This is not legal advice: involve your employment lawyer and DPO. See also AI governance and explainability.

Can AI monitor employees? Remote monitoring and wellbeing

Some tools offer to measure productivity or wellbeing by analysing breaks, response times or computer activity. In Italy, before the AI Act even comes into play, Article 4 of the Workers' Statute (Law 300/1970) applies: equipment that also makes remote monitoring of employees' activity possible may only be used for organisational and production needs, workplace safety and protection of company assets, and may only be installed after an agreement with workers' representatives (RSU or RSA) or, failing that, with authorisation from the National Labour Inspectorate.

The rule does not apply to tools employees use to do their job or to systems recording access and attendance. Information collected can be used for employment purposes only if the employee has been properly informed about how the tools are used and how checks are carried out, in line with Italian privacy law. Whether an AI tool counts as a "work tool" has to be assessed case by case with an employment lawyer. Other EU countries have their own rules.

At EU level, AI used to monitor and evaluate performance is high-risk (Annex III, point 4b) and emotion recognition is banned. To understand team morale, the safer route is an anonymous survey with results aggregated by department, not tracking individual employees.

Do you have to train staff on AI? The AI literacy duty

Yes, in proportion to how AI is used. Article 4 of the AI Act requires providers and deployers of AI systems to take measures to ensure AI literacy among their staff and other people using the systems on their behalf, such as contractors or service providers. The obligation has applied since 2 February 2025; supervision and enforcement, handled by national authorities, start on 2 August 2026.

According to the European Commission's Q&A, the AI Omnibus keeps the obligation but no specific or "sufficient" level is mandated; no certificate is needed and an internal record of training and other initiatives is enough. Simply asking staff to read the software's instructions for use may be ineffective. Deployers of high-risk systems must still train the people in charge of human oversight.

For an HR or compliance team, in practice: one session on what the chosen tool does and does not do, which data must never go in, how to spot and report an error, plus a record with date, topics and attendees.

Can you use ChatGPT and other models with employee data?

Yes, if processing is set up properly. When an AI vendor processes personal data on the company's behalf, it is a processor: Article 28 of the GDPR requires a contract setting out the subject matter, duration, nature and purpose of processing and the type of data. Article 35 requires an impact assessment for systematic and extensive evaluation of personal aspects based on automated processing that leads to decisions with legal or similarly significant effects; in the Italian Decree 152/1997 cases above it is already mandatory.

Use business plans with a data processing agreement, not employees' personal accounts.
Enter only the data you need: summarising a policy needs no names; keep health data and other special categories out.
Keep decisions out of the prompt: the model drafts, a person decides.

For a wider view of generative AI in business, see generative AI and business strategy.

What penalties does the AI Act set?

Article 99 sets the maximums: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, such as emotion recognition at work; up to EUR 15 million or 3% for breaching deployer obligations (Article 26) and transparency obligations (Article 50). For companies the higher amount applies, for SMEs and start-ups the lower one. Member States lay down the actual penalty rules within these limits. GDPR fines for personal data processing come on top.

How do you build an automated onboarding workflow?

It starts from a reliable event, collects and checks documents, activates access and training, and logs every step, in an online store and a B2B company alike.

Trigger: a contract signed in the HR system starts the workflow.
Collection: the new hire receives a link and uploads the documents required for the role.
Checks: AI verifies completeness and legibility and extracts expiry dates; unclear cases go to a person.
Activation: accounts with role-based permissions (email, ERP, online store or CRM) and mandatory training assigned.
Logging: every step goes into a log, for example a table in Supabase, with date, outcome and approver.

The same pattern in reverse handles offboarding, often the riskiest flow: a forgotten account can stay open for months. For the general method, see the guide to business process automation; if the workflow will need to act on its own, you move into AI agents, with tighter controls.

What should you ask a vendor of AI-powered HR software?

Before signing, these questions show which obligations will fall on you as the deployer.

Question for the vendor	Why it matters
What is it designed for, and which AI Act category does it fall into?	A CV screening tool is high-risk, a policy assistant is not: your obligations change.
What accuracy does it declare, and with which metrics?	For high-risk systems, the instructions for use must state it (Article 13).
Which human oversight measures does it provide?	These also belong in the instructions for use, and the deployer must assign oversight to competent people (Article 26).
Which logs does it generate, and how long can I keep them?	For high-risk systems they must be kept for at least six months; you need them for audits anyway.
Who processes the data, and is there a processor contract?	Article 28 of the GDPR requires it.
How is training data checked for bias?	Data quality is a requirement for high-risk systems.

How to apply it in your company: first steps

Measure your baseline: for two weeks, count HR cases and compliance checks and the hours they take.
Classify every AI use with the table above and start only with cases that do not decide about people.
Automate a single workflow, with an owner, a log and a measurable target, such as the days needed to get a new hire fully set up.
Prepare the worker notice and impact assessment before going live.
After sixty days, compare the numbers and decide whether to extend; for indicators, see how to measure the value of AI.

This is the work I do in business automation projects; more cases are in the automation section of the blog.

Mistakes to avoid

Letting AI decide on hiring, promotion or dismissal: rubber-stamping the algorithm's output is not oversight.
Buying "AI-powered" HR software without asking questions about documentation, training data and measures against discrimination.
Automating without logs: in an audit you will not be able to prove what happened.
Tracking individual breaks or productivity without a union agreement or authorisation and without informing staff: in Italy this falls under Article 4 of the Workers' Statute.
Pasting employee data into personal AI accounts, with no vendor contract and no rules on what goes in.

Frequently asked questions (FAQ)

Can AI screen candidates instead of the HR team?

It can draft job ads, schedule interviews and summarise CVs, but it should not decide on its own who gets rejected. The EU AI Act classifies systems that filter and evaluate applications as high-risk, and the GDPR restricts decisions based solely on automated processing.

What does the AI Act delay to 2 December 2027 change?

With the AI Omnibus, in force since 27 July 2026, obligations for Annex III high-risk systems, including recruitment and workforce management, apply from 2 December 2027 instead of 2 August 2026. The classification is unchanged, and the ban on emotion recognition in the workplace has applied since 2 February 2025.

Do I have to tell employees that I use AI?

In Italy, Law 132/2025 requires employers to inform workers in the cases set out by Article 1-bis of Legislative Decree 152/1997, i.e. when fully automated systems provide relevant input on hiring, management, task allocation, monitoring or evaluation. Workers' representatives must be informed too; other EU countries have their own rules, so check with an employment lawyer and your DPO.

Which HR processes should I automate first?

Repetitive ones that do not decide about people: onboarding and offboarding, documents and expiry dates, leave and expense claims, common questions about internal policies. They happen often, are easy to measure and sit outside the AI Act's high-risk area.

Do I need new HR software to automate?

Usually not: it is enough to connect the tools you already use, such as the HR system, email, document storage and online store, through platforms like n8n or Make. The real work is designing the process and deciding who handles exceptions.

Can I use AI to monitor employee productivity?

Only within clear limits. In Italy, tools that also allow remote monitoring must serve organisational, production, safety or asset-protection needs, require a union agreement or authorisation from the National Labour Inspectorate, and proper information to employees. Under the AI Act, performance monitoring is high-risk and emotion recognition at work is banned.

Is AI training for employees mandatory?

Yes: since 2 February 2025, Article 4 of the AI Act requires organisations using AI systems to ensure AI literacy among staff and contractors, with national supervision from 2 August 2026. No certificate is needed and no minimum level is set: a programme proportionate to your use and an internal record of initiatives are enough.

Sources

If you want to find out which HR and compliance workflows to automate first without entering high-risk territory, book a free diagnosis.