Artificial Intelligence in Human Resources: Obligations and Key Considerations for Safe Implementation

Artificial Intelligence in Human Resources: Obligations and Key Considerations for Safe Implementation

What companies should review before implementing these tools and while using them

The use of artificial intelligence in recruitment and personnel management requires companies to assess how it influences decision-making, what information concerned individuals receive, and what controls the company applies. Proper implementation must combine employment law obligations with data protection safeguards and effective human oversight.

Identifying how AI is involved in Human Resources processes

These tools can facilitate the analysis of applications, shift planning and performance assessments. Their usefulness depends on the reliability of their outputs and on users understanding their limitations. Informing individuals that a system is in use forms part of compliance, but the company must also be able to justify its use and demonstrate the measures adopted.

The review should address the actual functioning of each process. A programme that ranks applications, suggests targets or recommends salary increases may have a significant influence, even where it is presented merely as a support tool. Companies should also draw up an inventory of solutions provided by external suppliers and those implemented by the parent company of an international group.

As practical examples, companies should identify CV-screening filters and job-fit scoring tools; systems that allocate tasks or shifts; recommendations relating to promotion and remuneration; and profiles that predict performance or employee retention. In each case, it should be specified what output the tool generates, who receives it and what consequences it may have for the individual concerned.

The use of AI assistants in HR Teams

The review should also include the common use of AI assistants by HR teams. Introducing CVs, assessments or disciplinary records in an unauthorised tool may expose confidential personal data and documentation. Our recommendation is to establish which apps may be used and with which information.

New information requirements about algorithmic systems

Royal Decree 723/2026, in force since 5 October 2026, reinforces the obligation to keep written information about algorithmic or automated decision-making systems. The general regime set out in Chapter II applies to employment relationships lasting more than four weeks, without prejudice to any specific provisions and other applicable obligations.

Where these systems are used to make decisions on working conditions, the information provided must explain their guidelines, criteria and operating rules. This includes decisions on working hours, tasks, remuneration, career progression, workplace or termination of employment. A generic reference to the company’s use of artificial intelligence will rarely enable employees to understand how it is involved in these processes.

For new employment relationships, the information must be provided before the start of the employment relationship. For existing employment relationships, any information not already available to the employee must be provided within 30 working days of their request. Any changes must be communicated as soon as possible, but no later than the date on which they take effect.

The information may be included in the employment contract or in supplementary documents, in paper or electronic format, provided that it is accessible, storable and printable. The company must retain evidence that the information has been sent or received. Information on algorithmic systems cannot be replaced by a mere reference to the law or the collective bargaining agreement.

Information provided to employees’ legal representatives

The individual communication requirement is additional to the right to information recognised under Article 64.4(d) of the Spanish Workers’ Statute. Employees’ legal representatives are entitled to be informed of the parameters, rules and instructions of algorithms or AI systems that affect decisions on working conditions, access to employment or continued employment, including profiling.

We therefore recommend preparing an explanation tailored to the system in use and establishing a process for updating it whenever its criteria change. The fact that the tool is provided externally does not remove the need to have sufficient information to comply with the company’s obligations. Any consultation rights that may apply due to the nature of the organisational change should also be reviewed.

Human oversight must be effective

Warning AI-00009-2026 issued by the Spanish Data Protection Agency (AEPD) examines a tool intended to analyse CVs, assign scores and prioritise candidates in recruitment and internal mobility processes. It is a preventive action, not a penalty or a declaration that an infringement has occurred. Its relevance lies in reminding companies that safeguards must be assessed before the system is used.

A formal validation of a recommendation does not demonstrate that an effective review has taken place. The person responsible for the review must be able to examine the relevant data, critically assess the outcome and depart from it. The company must ensure that this person has the necessary expertise, time and authority to do so, and that the process does not turn the score into an almost unavoidable criterion.

For example, if a filter excludes an application because of a gap in the candidate’s career history, an effective review must make it possible to check whether that information is accurate and whether it is relevant to the requirements of the role. Confirming the exclusion without examining its basis would perpetuate the risk of an inappropriate decision. Reviews and corrections should be documented at an appropriate level of detail.

Data protection and automated decisions

Where personal data are processed, the purpose, legal basis, the data required and retention period must be defined. The analysis covers both the information entered into the system and the scores, profiles and inferences associated with identified or identifiable individuals. The accuracy of the data, access controls and security measures must also be reviewed.

Article 22 of the GDPR establishes a specific regime for decisions based solely on automated processing, including profiling, which produce legal effects concerning individuals or similarly significantly affect them. Not every use of AI falls within this scenario. Where it does, a valid exception and the required safeguards must be verified; general acknowledgement or the mere convenience of automation do not resolve this assessment.

In the employment context, consent requires particular caution because of the imbalance between the parties. Information provided to candidates and employees must explain the processing and the applicable rights in a clear and comprehensible manner. A channel must be available to deal with requests and, where applicable, to obtain human intervention, express one’s point of view and challenge the decision.

Is a data protection impact assessment necessary?

Before processing begins, it should be assessed whether a data protection impact assessment is required. This is mandatory where processing is likely to result in a high risk to the rights and freedoms of individuals, in accordance with Article 35 of the GDPR. The use of new technology, systematic assessment and the consequences of decisions are relevant factors in this analysis.

Reviewing potential bias and discriminatory criteria

As part of the review, we recommend checking that the variables used are relevant to the employment-related purpose and do not create unjustified disadvantages. Explicitly excluding sex or age does not, in itself, prevent other data from acting as indirect indicators or reproducing biases contained in historical information.

For example, career breaks, availability to work certain hours or particular career patterns should be reviewed before they are used to classify applications or allocate opportunities. The company should assess their relevance to the role and review the outcomes. If unjustified differences are identified, the criteria should be corrected and the affected decisions reviewed.

What to review before engaging an AI provider

Before contracting or activating a solution, we recommend requesting documentation on its purposes, the data processed, limitations, controls and review options. The contract should reflect the role of each entity for data protection purposes and, where applicable, regulate the data processing agreement, sub-processing, security and assistance with the exercise of data subject rights.

It is also advisable to check where the data are hosted, who can access them, whether international transfers take place and whether the data are reused to train models. Where implementation is centrally managed by the parent company, responsibilities must be clearly defined and communications adapted to the actual use of the tool in Spain. The provider’s safeguards should be assessed against the company’s specific configuration and processes.

How can we help?

At Bové Montero, we support companies in reviewing the employment-law implications of artificial intelligence tools and the Human Resources processes in which they are used. Our aim is to identify the obligations applicable to your company and the measures that will enable each solution to be implemented or used with legal certainty.

We analyse the impact of these tools on recruitment, assessment, promotion, remuneration and other working conditions; review information and consultation obligations; and prepare the necessary employment-related communications and documents. We also help establish human oversight protocols and usage guidelines for Human Resources teams.