Compliance is often a source of concern, and it’s the first objection we hear from HR directors: “And when it comes to the GDPR, are we allowed to do that?”
The short answer: yes, as long as you put a few simple safeguards in place.
AI in HR isn't a lawless zone, but it isn't a minefield either.
Most of the rules are just common sense, and the majority boil down to an idea you’re already familiar with if you’ve read the previous content: a clean, well-managed data foundation is also the basis for your compliance.
This content is not legal advice (consult your DPO and legal department regarding your specific situation). It serves as a guide to help you determine where to look and what to secure before deploying an agent.
The key takeaway. The golden rule of this entire series—“the system suggests, the human decides”—is not just a best practice. It is a legal requirement. The GDPR prohibits any decision that has a significant impact on an individual from being made solely on the basis of automated processing. Human oversight is not an option—it is the law.
AI and HR: 6 Key Areas to Address
Here are the six topics to discuss before assigning an agent to your teams.
For everyone: the principle, and what it means in practice.
1. Human supervision (non-negotiable)
The principle: No decision affecting an individual (rejecting an application, imposing a disciplinary action, denying a promotion) should be made by AI alone. A human retains control, understands the recommendation, and makes the final decision.
In practical terms: the agent prepares, summarizes, and alerts. The agent never automatically approves or rejects anything. You document the fact that a human is indeed involved in the process.
2. Data Privacy and Security
The principle: HR data is sensitive by nature. It must never be fed into a tool intended for the general public or used to train a model.
In practical terms: a professional or corporate plan is required (training features disabled, contractual security framework), caution regarding data hosting and transfers outside the European Union, and strict access management. This point has already been addressed in the setup section.
3. Transparency
The principle: Data subjects have the right to know that AI is involved in the processing of their personal data.
In practical terms: Inform applicants and employees about the use of an AI assistant (for example, in the HR privacy policy or in the disclaimer on your job postings), and clearly explain the tool’s role and how human decision-making remains central.
4. Data Minimization and Purpose
The principle: an agent is given only the data strictly necessary for their mission, and for that mission alone.
In practical terms: a pre-screening agent does not need to know a candidate’s family situation. An onboarding agent does not need to know the candidate’s disciplinary history. You will specify in their instructions what they are authorized to handle—and, more importantly, what they are not authorized to handle.
5. Combating Bias and Promoting Non-Discrimination
The principle: an improperly trained employee can perpetuate or exacerbate biases. The law prohibits all forms of discrimination, whether direct or indirect.
In practical terms: neutralize sensitive criteria, have risky practices reviewed (especially in recruitment), and keep human oversight as the final filter. Human oversight is also your best protection against bias.
6. Social Dialogue
The principle is that, in France, implementing a measure that affects the organization or working conditions requires informing and consulting with employee representatives (CSE).
In practical terms: Incorporate the introduction of AI agents into your social calendar, and outline their objectives and safeguards. A transparent rollout is also one that is more readily accepted.
The European regulation on artificial intelligence (the “AI Act”) sets out the framework for the use of AI in the European Union.
2 Things Every HR Director Should Keep in Mind.
The timeline now applies to you. The requirements for high-risk systems, including HR systems, will take effect in 2026.
This isn't something to put off until tomorrow: now is the right time to get your practices in order—but don't rush it.
The correct interpretation is not “AI in HR is getting complicated,” but “AI in HR is becoming more regulated.”
Stakeholders who have a solid foundation and well-defined practices will navigate this transition smoothly.
Here's the key point that ties everything together. Compliance isn't just about the AI tool—it starts with your data. And that's precisely where HRIS comes in.
A well-maintained HRIS provides you with what compliance requires:
In other words, integrating an agent with a dedicated HRIS platform like quarksUp doesn’t just make it more useful (as we’ve seen in previous posts)—it also makes it more compliant.
The foundation is the backbone of your data governance.
Without it, compliance relies on goodwill; with it, it relies on a structure.
A simple checklist to review with your DPO before any deployment:
1. Does a human being approve every decision that affects a person?
2. Is the tool an enterprise offering (no training, security, managed hosting)?
3. Are the individuals concerned informed about the use of AI?
4. Does the agent process only the data that is strictly necessary for his or her duties?
5. Are high-risk practices (recruitment) reviewed to eliminate any bias?
6. Was the CSE informed and consulted?
7. Are access, retention periods, and purposes defined within the HRIS?
If you check these 7 boxes, you're off to a good start. And most of them are already taken care of if your data foundation is clean.
Compliance with AI in HR depends primarily on common-sense safeguards, not on an overly complicated system. “The system makes the recommendation; the human makes the decision” is both a best practice and a legal requirement.
The AI Act classifies certain HR uses as high-risk: transparency, human oversight, and data quality become requirements, effective in 2026.
Your greatest asset for compliance is a governed data foundation: the HRIS. Quarksup provides you with this structure.
This content is for informational purposes only and does not constitute legal advice. Please verify your practices with your DPO and your legal department.
1. The Catalog of AI Tools for HR.
2. Set up your first HR AI agent.
3. 10 use cases for Claude integrated with your HRIS.
4. You are here: Regulations and Compliance, AI Act, and GDPR.
5. Next: Integration—connect AI to your HR software simply and securely.
