The EU AI Act enters full enforcement on August 2, 2026. AI systems used in HR and employment are classified as high-risk under Annex III, Point 4. This includes recruitment, task allocation, performance monitoring, and team development tools. Only 6% of EU organizations consider themselves fully prepared (KPMG). 78% of German companies use or plan to use AI, but fewer than 30% have conducted an AI-specific risk assessment (Bitkom). 52% of German works councils report being uninformed about AI tools in their organization (Hans-Bockler-Stiftung). This guide provides a practical 15-point compliance checklist covering both GDPR/DSGVO and the EU AI Act, with specific guidance for Betriebsrat alignment in DACH markets.
Key deadline: August 2, 2026. High-risk AI rules (Annex III) become enforceable. Penalties: up to 35M EUR or 7% of global annual turnover. AI used for recruitment, task allocation, performance monitoring, or team evaluation falls under high-risk classification.

What the EU AI Act Means for Your Organization

The EU AI Act creates a risk-based classification system. Not all AI is regulated equally: Prohibited AI (banned since Feb 2025): Social scoring, real-time biometric surveillance, emotion recognition in workplaces. High-risk AI (enforceable Aug 2026): AI used in employment and HR. Specifically Annex III, Point 4 covers: recruitment and CV screening, task allocation based on individual traits, monitoring and evaluation of work performance, decisions on promotion, termination, or contract terms. Limited-risk AI: Chatbots, content generation. Must disclose AI nature to users. Minimal-risk AI: Spam filters, AI in games. No specific obligations. If your team uses an AI assistant for any HR-adjacent function (team analytics, pulse surveys, coaching, scheduling, performance insights), it likely falls under high-risk. This does not mean you cannot use it. It means you must comply with specific requirements.

GDPR + AI Act: Two Regulations, One Strategy

A common question: "We are already GDPR-compliant. Is that enough?" No. GDPR and the AI Act overlap but have distinct requirements: GDPR covers: Personal data processing, legal basis (Art. 6), data minimization, DPIA for high-risk processing (Art. 35), automated decision-making safeguards (Art. 22), right to explanation. AI Act adds: Risk management system (Art. 9), technical documentation (Art. 11), automatic logging of AI decisions (Art. 12), transparency requirements (Art. 13), mandatory human oversight roles (Art. 14), accuracy and bias monitoring (Art. 15). Both require: Data protection impact assessment, transparency about AI usage, human oversight for significant decisions, documentation and audit trails. The practical impact: if your AI team assistant processes employee data (pulse surveys, assessments, feedback, coaching), you need compliance with both regulations simultaneously. Fines can stack: GDPR fines up to 20M EUR / 4% turnover PLUS AI Act fines up to 35M EUR / 7% turnover.

Works Council & AI: Co-Determination Under BetrVG Paragraph 87 (DACH)

For German and Austrian organizations, the Betriebsrat (works council) has co-determination rights under BetrVG Paragraph 87(1)(6) for the introduction of technical systems that monitor employee behavior or performance. The Federal Labour Court (BAG) confirmed in 2023 that this applies to AI-based software (BAG 1 ABR 14/22). Practical requirements: - Negotiate a Betriebsvereinbarung (works agreement) covering: AI system scope, data processed, employee rights, review cycles - Under Paragraph 80(3), works councils can consult external AI experts at the employer's cost - Assessment participation must be voluntary - Individual coaching data must not be visible to management - Works council must be informed before deploying any new AI tool 52% of German works councils report being uninformed about AI tools in their organization. Proactive engagement prevents conflicts and delays.

The 15-Point Compliance Checklist

1

AI System Inventory

Catalog all AI systems in use. Classify each by risk level per Annex III. Include shadow AI tools employees may be using without IT approval.
2

High-Risk Assessment

Determine if any HR/team AI use case falls under Annex III, Point 4 (recruitment, task allocation, monitoring, evaluation, team analytics).
3

Dual Legal Basis

Establish legal basis under both DSGVO (Art. 6) AND AI Act simultaneously. Document why processing is necessary and proportionate.
4

Data Protection Impact Assessment

Conduct DSGVO Art. 35 DPIA for each AI system processing employee data. Include AI-specific risks (bias, opacity, automated decisions).
5

Data Minimization

Verify AI processes only necessary data (Art. 5(1)(c) DSGVO). No excessive profiling. Assessment results anonymized by default.
6

EU Data Residency

Confirm all AI processing and data storage occurs within EU/EEA. No US transfers without adequate safeguards post-Schrems II.
7

Automated Decision Safeguards

Implement DSGVO Art. 22 protections: human oversight for significant decisions, right to explanation, right to contest AI-assisted outcomes.
8

Risk Management System

Implement ongoing AI risk identification and mitigation per AI Act Art. 9. Document risk assessment methodology and review schedule.
9

Technical Documentation

Maintain system documentation per AI Act Art. 11: architecture, training data sources, performance metrics, known limitations.
10

Audit Logging and Transparency

Automatic audit logging of all AI decisions, accessible for regulatory review (AI Act Art. 12, 13). Logs must be searchable and exportable.
11

Human Oversight Roles

Designate human oversight roles with authority to override AI outputs (AI Act Art. 14). Document escalation procedures.
12

Bias Monitoring

Regular accuracy testing and bias monitoring across protected characteristics: gender, age, ethnicity (AI Act Art. 15). Document testing methodology.
13

Betriebsvereinbarung (DACH)

Negotiate works agreement with Betriebsrat covering: AI scope, data usage, employee rights, review cycles (BetrVG Paragraph 87(1)(6)).
14

Employee Notification

Inform all affected employees about AI use, data processed, and their rights (DSGVO Art. 13/14 + AI Act Art. 52). Participation must be voluntary.
15

Ongoing Monitoring and Review

Establish regular compliance reviews, incident reporting, and annual audit cycle. Update documentation when AI systems change.

Penalties: What Non-Compliance Costs

ViolationFineRegulation
Prohibited AI practicesUp to 35M EUR or 7% global turnoverAI Act Art. 99(3)
High-risk non-complianceUp to 15M EUR or 3% turnoverAI Act Art. 99(4)
Incorrect informationUp to 7.5M EUR or 1.5% turnoverAI Act Art. 99(5)
GDPR data protection violationUp to 20M EUR or 4% turnoverGDPR Art. 83
Fines can stack. A single AI system violating both GDPR and the AI Act could face penalties under both regulations. GDPR fines since 2018 have exceeded 2.1 billion EUR cumulative (GDPR Enforcement Tracker).

How Teamo AI Implements Compliance

Teamo AI is designed for EU AI Act and GDPR compliance from the ground up: - EU Data Residency: All data hosted in EU data centers. No US transfers. - Audit Logging: Every AI action logged, timestamped, attributed to user and session. Searchable and exportable for regulatory review. - Role-Based Access Control: 4-tier permission system (member/observer/admin/super admin). AI capabilities scoped per role. - Tool Execution Policies: 4 profiles (minimal/standard/admin/full). Dangerous actions require human confirmation. - Anonymization by Default: Individual assessment results and coaching conversations anonymized. Only aggregated team-level insights visible to management. - Betriebsrat Compatible: Voluntary participation, data separation between coaching and performance, works council information rights supported. - Human Oversight: Tool confirmation system provides preview + approve for outbound actions. No automated decisions without human review for significant outcomes. For the full enterprise security comparison, see our Enterprise AI Agent Security guide.

Measure Your Compliance Readiness

Our free AI governance assessment maps 15 questions to EU AI Act, NIST AI RMF, and ISO 42001 requirements. Get your maturity score in 5 minutes.

Start Governance Assessment

Compliance-Ready AI for Your Team

Teamo AI provides GDPR + EU AI Act compliance out of the box. EU hosting, audit logging, Betriebsrat-compatible, role-based access. Start free.

Explore Teamo AI