Abstract
Artificial intelligence is already being used in recruitment, employee assessment and workforce management. But how far can it influence an employer’s decisions?
From employee training and algorithmic recruitment to performance assessments, hiring, disciplinary measures and dismissals, one principle is becoming increasingly clear in light of the amendments to the AI Act and the new Italian rules on automated decision-making: responsibility must remain genuinely human, even when a decision is developed with the assistance of an algorithm.
AI Act and worker protection: what changed in summer 2026
The AI Act’s regulatory framework requires companies not only to consider the timeline for compliance but also to initiate a series of organizational activities well in advance: from mapping the AI systems in use to defining internal policies and responsibilities, and ensuring that staff are equipped with AI literacy.
To understand the developments examined in this article, it is useful to begin with the main AI Act deadlines that also affect the employment sector:
- from 2 February 2025, the first obligations under the AI Act became applicable, including those concerning AI literacy – namely, the training and awareness of staff who use artificial intelligence systems – as well as the provisions relating to prohibited AI practices.
- 2 August 2026 marked the beginning of supervision and enforcement of the AI Regulation, except for provisions subject to a specific timetable.
- For systems classified as high-risk under Annex III – a category that includes many systems used in recruitment and workforce management – the main provisions will apply from 2 December 2027.
- Finally, for high-risk systems connected with the products listed in Annex I, the relevant deadline is 2 August 2028.
The timetable was definitively consolidated by Regulation (EU) 2026/1744 of 8 July 2026 – Digital Omnibus on AI, which entered into force on 27 July 2026 and, among its many changes, also amended certain provisions of the AI Act.
In particular, Article 1(5) of the Digital Omnibus replaces Article 4 of the AI Act with the following wording:
“Providers and deployers of AI systems shall take measures to support the development of AI literacy among their staff as well as any other persons dealing with the operation and use of AI systems on their behalf*, taking into account their technical knowledge, experience, education and training, as well as the context in which the AI systems are to be used, and considering the persons or groups of persons on whom the AI systems are to be used.
This obligation does not require providers or deployers to ensure a specific level of AI literacy for any person. […]. For this purpose, the Commission shall publish practical examples of how to comply with the AI literacy obligation on the single information platform.”
The wording has therefore been made more proportionate: companies are not required to “guarantee” that each worker reaches a specific level of competence. Instead, they must tailor the measures adopted to the person’s technical knowledge, experience and training and, above all, to the context in which the system is used.
The European Commission, in its FAQs updated on 27 July 2026, also clarified that, from the beginning of August, the rules on supervision and enforcement relating to this obligation are also operational.
At the same time, however, the Italian employment-law framework is becoming increasingly concrete.
Automated decisions in employment: how far can an algorithm go?
On 4 August, the Government gave final approval to the national decree adapting Italian law to the AI Act, introducing specific limits on the use of so-called automated decisions in the establishment, management and termination of employment relationships.
Pending publication in the Official Gazette, the official press release of the Council of Ministers states that decisions concerning the establishment, modification or termination of an employment relationship, including disciplinary measures and dismissals, may not be taken solely on the basis of automated processing.
The new measure also builds on national legislation that is already in force. Article 11 of Law No. 132 of 23 September 2025 provides that the use of artificial intelligence in the workplace must be safe, reliable and transparent, must respect workers’ dignity and privacy, and must not result in discrimination.
Already during the examination of the draft submitted for parliamentary opinion – Government Act No. 421, Article 40 provided that, where an employer uses AI systems, “the decisions concerning the establishment, modification or termination of the employment relationship, including disciplinary measures, must not be taken solely on the basis of automated processing, in accordance with Article 11 of the AI Law. The final decision shall in all cases be reserved for a natural person who exercises genuine and autonomous decision-making authority”.
What happens if the safeguards laid down in Article 40 are breached? The dismissal is null and void.
A merely formal human intervention that simply endorses the outcome produced by the system is therefore not enough. The same article requires AI to be used in a manner that respects workers’ dignity and privacy and the principle of non-discrimination. By referring to Legislative Decree No. 152 of 26 May 1997, it also reaffirms the worker’s right to receive an intelligible explanation, setting out the criteria applied and the decision-making process.
The issue was also addressed by the Italian Data Protection Authority in its Opinion No. 532 of 14 July 2026. Although its overall assessment of the draft Decree was favourable, the Authority suggested extending the prohibition on fully automated decisions to include evaluative decisions capable of having significant consequences for the employment relationship.
For example, AI might not directly decide whether an employee should be promoted or dismissed, but it could assign a performance, reliability or productivity score. If that score were then to have a meaningful influence on the employer’s decision, the Data Protection Authority considers that the assessment itself should not be left exclusively to automation.
The draft Decree also contains another provision that deserves attention.
Article 49 – amending Article 98 of the Italian Industrial Property Code – expressly includes among the information eligible for protection as trade secrets data, algorithms, mathematical methods, model architectures and AI system training procedures.
This raises a very practical question for employment law: how can a worker’s right to understand and challenge a decision affecting them be reconciled with the need of the company – or the system provider – to protect algorithms and confidential information?
Algorithmic recruitment: can AI exclude a candidate?
The official press release of the Council of Ministers of 4 August 2026 highlights a significant change from the initial draft: candidate sourcing and selection activities, even where they result in a candidate being excluded from subsequent stages, are not regarded as “final decisions” concerning the establishment of an employment relationship.
In practical terms, for the purposes of the specific rules laid down in Article 40, an AI system may therefore play a decisive role in the screening and selection process, even to the point of excluding a candidate without that outcome being treated as equivalent to the final decision on whether or not to hire them.
This legislative choice is likely to prompt considerable debate. For the excluded candidate, failure to progress to the next stage has an essentially final effect, even if it is not formally classified as a “final decision” for the purposes of Article 40.
It is true that, even in traditional recruitment processes, assessment criteria may involve a degree of discretion and may not always be fully transparent. Precisely for this reason, however, when an exclusion is determined by an AI system, transparency, the ability to verify the criteria used and oversight of possible discriminatory effects become even more important.
This does not mean, however, that algorithmic recruitment is free from legal constraints.
First, the AI Act continues to include in Annex III, among uses normally classified as high-risk, systems used to analyse and filter job applications and evaluate candidates. Once the relevant regime becomes fully applicable – from 2 December 2027 – companies using these systems will also have to comply with the specific obligations set out in Article 26 of the AI Act.
In particular, human oversight must be entrusted to people with the necessary competence, training and authority. In addition, where an Annex III system makes or assists in making decisions concerning natural persons – as may happen in recruitment – the person concerned must be informed that a high-risk AI system is being used in relation to them.
In the employment context, Article 26 also requires workers’ representatives and the workers concerned to be informed before a high-risk AI system is used in the workplace.
The GDPR also remains fully applicable. Article 22 gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning them or otherwise significantly affects them in a similar way.
This is complemented by anti-discrimination law. The fact that recruitment is entrusted, in whole or in part, to an algorithm does not weaken the prohibitions already established by law. Selection criteria may not result in direct or indirect discrimination based, among other things, on sex, ethnic origin, religion or personal beliefs, disability, age or sexual orientation.
These prohibitions expressly apply from the stage of access to employment and the application of selection criteria. As a result, a candidate excluded on the basis of a discriminatory algorithmic criterion retains the remedies available under anti-discrimination law, even where the bias was not intentionally introduced by the employer.
When AI evaluates employees: what limits apply to emotions, performance and monitoring?
As early as 14 May 2026, the Italian Data Protection Authority intervened in relation to an Italian start-up offering an AI-based service capable of analysing employee communications and producing reports on their stress levels.
The employer did not have access to individual conversations or individual results, but could receive a report containing aggregated information on the psychological state of its employees.
According to the Authority, even this type of arrangement required particular caution. Information concerning a worker’s emotional sphere cannot be freely collected by the employer, both under the GDPR and under the Workers’ Statute, while the AI Act prohibits the use in the workplace of systems designed to infer people’s emotions.
In the related Press Release, the Authority also highlighted the risk that language models and semantic analysis systems may produce results that are not transparent, cannot be adequately explained or may be discriminatory.
This is a useful example because it shows that the problem can arise long before a dismissal takes place.
Software may identify employees who are supposedly “at risk of leaving” or suggest who is “less productive”. It may assign scores, organise shifts, or monitor the timing and manner in which work is performed.
This is not, moreover, entirely unexplored territory.
Italian courts had already addressed the use of algorithms in the workplace. One of the best-known examples is the Deliveroo case, decided by the Court of Bologna on 31 December 2020, in which the ranking system was found to be discriminatory because it was unable to distinguish between the different reasons for a rider’s unavailability.
More recently, the issue was considered in judgment No. 9135 of the Court of Rome of 19 November 2025. As already discussed in the article “Replaced by AI? The Court of Rome clarifies the limits of dismissal”, the judgment did not create a new form of “dismissal due to replacement by artificial intelligence”. It simply confirmed that technological innovation must also comply with the traditional requirements governing dismissal for justified objective reasons and repêchage.
Pending their entry into force, the new rules introduced in summer 2026 will undoubtedly add a further layer of protection: the process through which a decision is reached must itself remain subject to control and attributable to human responsibility.
Revisionato da: Arlo Canella
Data di pubblicazione: 9 Settembre 2026
© Canella Camaiora S.t.A. S.r.l. - Tutti i diritti riservati.
È consentita la riproduzione testuale dell’articolo, anche a fini commerciali, nei limiti del 15% della sua totalità a condizione che venga indicata chiaramente la fonte. In caso di riproduzione online, deve essere inserito un link all’articolo originale. La riproduzione o la parafrasi non autorizzata e senza indicazione della fonte sarà perseguita legalmente.
Debora Teruggia
Graduated in Law with experience assisting companies and employees (employment law), commercial contracts and intellectual property (IP)