AI in the Workplace: Legal Risks and Compliance Obligations for Employers

Artificial intelligence is no longer a future consideration for employment lawyers — it is a live, urgent compliance challenge for every organisation that uses automated tools in hiring, performance management, workforce planning, or employee monitoring. The regulatory framework is crystallising rapidly, and enforcement is beginning.

From New York City's Local Law 144 — the world's first municipal law regulating automated employment decision tools — to the EU AI Act's specific requirements around high-risk AI systems in employment contexts, the legal obligations on employers are multiplying. This article maps the key risk areas and provides a framework for immediate action.

1. Automated Hiring Tools: The Bias and Discrimination Risk

AI-powered applicant tracking systems (ATS), resume screening tools, and video interview analysis software are now in widespread use. The legal risk crystallises in a single word: discrimination. If an AI system screens out applicants on the basis of characteristics that correlate with protected class membership — even unintentionally — the employer faces liability under anti-discrimination law.

Under US law (Title VII, the ADA, ADEA), this liability attaches through "disparate impact" — proof that a facially neutral practice has a disproportionate adverse effect on a protected group. The employer's defence is that the practice is "job related for the position in question and consistent with business necessity." Demonstrating this defence for an opaque AI system is extraordinarily difficult.

"The hiring manager who relies on an AI screening tool is legally responsible for the tool's outputs. 'The algorithm did it' is not a defence under employment discrimination law."

— Eleanor Vance, Senior Partner, Dominion Legal Chambers

2. The EU AI Act: High-Risk Classification and Its Consequences

The EU AI Act, now in its enforcement phase, classifies AI systems used in employment and workers management as high-risk. This classification triggers a comprehensive set of obligations for any organisation deploying such systems in the EU — including conformity assessment, technical documentation, human oversight requirements, and transparency obligations to workers.

Critically, the high-risk classification applies not just to the AI developer but also to the employer as the "deployer" of the system. This means that an employer using an off-the-shelf AI hiring tool is a regulated party under the AI Act — responsible for conducting fundamental rights impact assessments and ensuring the system is used in accordance with the provider's instructions.

3. Employee Monitoring: The Data Protection Minefield

The pandemic-driven shift to remote and hybrid work normalised a generation of employee monitoring tools — productivity tracking software, email analysis, keystroke logging, even AI-powered video monitoring. As employees have returned (partially) to offices, many of these tools remain deployed, creating ongoing legal exposure.

Under GDPR and the UK GDPR, employee monitoring is subject to stringent data protection requirements: a lawful basis must exist for each processing activity; monitoring must be necessary and proportionate; employees must be informed; and in many cases, a Data Protection Impact Assessment (DPIA) is mandatory. In France and Germany, Works Council consultation requirements add an additional layer of complexity for pan-European employers.

4. AI-Assisted Performance Management and Dismissal

Perhaps the most legally hazardous use of AI in the workplace is in performance evaluation and dismissal decisions. An employer who uses an AI system to identify underperforming employees and recommend dismissals is exposed to multiple vectors of legal challenge: unfair dismissal claims (where the employee challenges the fairness of the process); discrimination claims (where the AI's recommendations correlate with protected characteristics); and data subject rights claims under GDPR (where the employee challenges an automated decision that significantly affects them).

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on them. A dismissal plainly qualifies. Employers must ensure that a human decision-maker meaningfully reviews and takes responsibility for any AI-assisted dismissal recommendation — not simply rubber-stamps the algorithm's output.

Employer Action Plan

• Conduct an AI Inventory: Map every AI or automated decision-making tool used in any HR or employment context. Many organisations discover tools they had forgotten about or did not realise were AI-enabled.
• Conduct Bias Audits: Commission independent bias audits of all AI tools used in hiring or performance management. In NYC, this is now legally mandated annually.
• Update Employee-Facing Notices: Ensure all employees are informed of monitoring activities and AI-assisted decisions in language that satisfies applicable transparency requirements.
• Establish Human Oversight Protocols: Document the human review process for every AI-assisted decision that has significant employment consequences. Ensure the review is genuine, not perfunctory.
• Review Vendor Contracts: Ensure AI tool vendor contracts allocate responsibility for compliance obligations and require notification of material changes to the system.

Conclusion

AI in the workplace is not a technology issue that HR can defer to IT. It is a legal compliance issue requiring immediate attention from legal counsel, HR leadership, and the Board. The regulatory framework is live; enforcement is beginning; and the reputational consequences of getting it wrong — an AI discrimination claim or a GDPR enforcement action — are substantial. Dominion Legal Chambers advises employers across all aspects of AI employment compliance.