This is the ninth article in our 10-part series on the key questions posed by CHROs and senior HR leaders about AI implementation. The series explores the implications for work, talent, trust, ethics, regulation and human connection. Each article stands alone, and together they build a practical view of what responsible, commercially useful AI adoption requires. In the interests of transparency and openness the data sources for all ten articles are provided at the end of each article.
Key points:
- AI regulation is moving fast, with the EU AI Act becoming the global benchmark.
- HR technology is especially exposed, with many tools likely to be classed as “high risk.”
- Compliance starts with a full AI inventory, including hidden algorithms inside existing platforms.
- The AI Act adds obligations beyond GDPR, including monitoring, documentation and access controls.
- Vendors cannot carry the risk alone; organisations remain accountable.
- Procurement contracts must be tightened, with clear compliance, data protection and audit requirements.
- Legal, HR, IT and procurement need to work together before AI risk becomes regulatory risk.
The global regulatory landscape governing the deployment of artificial intelligence is evolving at breakneck speed. The most consequential, far-reaching legislative development in this arena is the European Union Artificial Intelligence Act (EU AI Act), a highly comprehensive, globally relevant framework designed specifically to enforce safe, ethical, and entirely transparent technological use. Because the EU AI Act carries strict extraterritorial reach, meaning it applies globally to any system affecting European citizens, and enforces severe, potentially crippling financial penalties for non-compliance, it has rapidly become the de facto gold standard for global enterprise governance, regardless of where a company's physical headquarters is located.
Under this stringent regulatory framework, technological systems are categorised strictly by their potential threat to fundamental human rights. Human resources technology is subjected to particularly intense scrutiny under this law, with the vast majority of impactful HR tools classified legally as "High Risk."
To achieve full compliance ahead of impending deadlines requires a comprehensive, forensic inventory of all technological systems utilised across the entire enterprise. This includes uncovering "hidden" or deeply embedded algorithms operating quietly such as might be the case within existing HR platforms or Customer Relationship Management (CRM) software.
The mandates of the EU AI Act intersect directly with existing General Data Protection Regulation (GDPR) frameworks. While the GDPR fundamentally ensures data minimisation and lawful processing, the AI Act adds layers of highly specific obligations, mandating continuous post-market monitoring, strict access controls, and highly detailed technical documentation for all high-risk tools. This cannot be entirely outsourced to software vendors. Organisations must proactively update all procurement contracts to include strict compliance clauses, demanding rigorous conformity assessments and transparent data protection agreements from their vendors, thereby ensuring the enterprise is legally protected from third-party liability and regulatory action.
Questions you may want to think about:
- Have we conducted a comprehensive, forensic inventory across all our HR platforms and CRMs to uncover "hidden" or deeply embedded algorithms that could be legally classified as "High Risk" under the EU AI Act?
- How are we updating our procurement contracts and vendor agreements to include strict compliance clauses and conformity assessments, given that our organization ultimately retains accountability and cannot outsource this regulatory risk?
- Do we have a formalized, cross-functional partnership between HR, Legal, IT, and Procurement to proactively manage the post-market monitoring and technical documentation required by the AI Act that goes well beyond existing GDPR frameworks?