Onboarding and offboarding
Documents, task lists, information gathering, access, communication and progress tracking, with owners and exceptions clearly defined.
Human Resources · GDPR · EU AI Act
AI for Human Resources with GDPR and the EU AI Act
Automate repetitive HR work without automating judgement about people. We design useful, explainable and supervised systems for Portuguese SMEs, with data protection from the start.
Start where AI removes administrative work, not where it decides about people
There is immediate value in organising information, preparing work and responding faster. The greater the impact on candidates or workers, the greater the scrutiny should be.
Internal HR assistant
Search across approved policies on benefits, leave, expenses or procedures, citing the source and escalating sensitive questions to the team.
Documents and administration
Classification, extraction, checking and preparation of documents; request triage; scheduling; system updates and reports with human review.
Training and development
Role-based content, learning paths, internal knowledge search and AI literacy, without turning opaque inferences into evaluations of people.
In HR, efficiency and power over people are not the same thing
A system that prepares a document or finds an internal policy removes work. A system that filters applications, ranks candidates, recommends promotion, allocates tasks based on personal traits or influences dismissal can change someone's professional life. Before selecting a tool, we define its purpose, who is affected, what data enters, what decision may come out and what happens when the system is wrong.
The EU AI Act treats employment and worker management as sensitive areas
Systems intended to analyse or filter applications, evaluate candidates and support certain employment or worker-management decisions may fall into the high-risk category. This brings requirements for risk management, data, documentation, records, transparency, human oversight, robustness, accuracy and cybersecurity.
Emotion recognition in the workplace is generally prohibited, subject to narrow medical or safety exceptions. Implementation of the EU AI Act is phased, so the calendar and requirements applicable to each system should be checked before production.
GDPR applies to the data and to the way decisions are made
CVs, evaluations, absences, pay, communications and health information may contain personal or special-category data. Design should minimise collection, define purpose and legal basis, control access, retention and transfers, and assess whether a data protection impact assessment is required.
GDPR Article 22 protects people from decisions based solely on automated processing that produce legal or similarly significant effects, subject to specific conditions and safeguards. Adding a decorative human approval at the end does not solve the issue.
Genuine human oversight means the power to understand and disagree
The responsible person should understand the purpose and limits of the system, see the relevant information, recognise error or bias, and have the authority and time to change the outcome. If every machine recommendation is approved automatically, there is no effective oversight.
We design review points, intelligible reasons, records proportionate to risk, contestability and escalation. The system should support the HR professional, not hide an automated decision behind their name.
From use case to production: technology, governance and people
1. Assessment and classification
We map purpose, users, affected people, data, decisions, impact and applicable law. If risk is unacceptable, the case is redesigned or does not proceed.
2. Data and vendors
We assess quality, bias, minimisation, access, retention, location, subprocessors, training use and the ability to delete or export information.
3. PoC and validation
We test the riskiest assumption with appropriate data, technical metrics and business criteria, including false positives, false negatives and relevant group differences.
4. Governance and handover
We deliver ownership, documentation, limits, controls, monitoring, incident procedures, training and handover so the organisation can operate and scrutinise the system.
An integrated approach to AI and Human Resources
HR process automation
Administrative workflows, integrations, internal assistants and review points connected to existing systems.
Explore automationMarket or bespoke solutions
We select established tools where they fit and build bespoke systems where the data, workflow or risk requires it.
Explore our AI boutiqueAI training and literacy
Role-based training on safe use, data governance, human oversight, GDPR, the EU AI Act and handover.
Explore trainingFrequently asked questions
Which Human Resources processes can be automated with AI?
Onboarding, document preparation and classification, internal policy search, frequently asked questions, scheduling, training and administrative work are useful starting points. Recruitment, evaluation, monitoring and decisions about workers require enhanced legal and risk assessment.
Can AI be used to select candidates?
This is not a purely technical decision. Systems intended to analyse or filter applications and evaluate candidates may be classified as high-risk under the EU AI Act. GDPR, employment and anti-discrimination rules also apply. The use case should be assessed before purchase or implementation, with effective human oversight and appropriate safeguards.
Does human oversight make any HR system compliant?
No. Oversight must be genuine: the person must understand the information, be able to disagree with the system, and have the time and authority to change the outcome. Purpose, data, risk, transparency, discrimination, security and the rights of affected people still require assessment.
Does BigLearn guarantee legal compliance with GDPR and the EU AI Act?
BigLearn designs technology, documentation, controls and training to support compliance. The legal conclusion depends on the use case, data, the organisation's role and applicable law, and should involve the data protection officer and legal advice where necessary.
Official references for an informed decision
See the European Commission's official overview of the EU AI Act and its risk-based approach, its guidance on AI literacy, and GDPR Article 22 on EUR-Lex. The legal framework should be checked for the use case and implementation date.