In short
Since 23 October 2026, Article 41 of Italy's Legislative Decree 179/2026 prohibits final decisions on employment from being taken solely through automated processing.
The final decision rests with a natural person with real and autonomous authority; worker consent is not an exception and a dismissal in breach is null and void.
Searching for and screening applications is excluded from Article 41, but Article 22 of the GDPR and, for recruitment systems, the AI Act still apply.
Before use, the notice under Article 1-bis of Legislative Decree 152/1997 must be given, also to representatives; workers may request an intelligible explanation.
According to the Commission, AI Act obligations for high-risk HR systems (Annex III, point 4) apply from 2 December 2027.
Since 23 October 2026, Italy's Legislative Decree No. 179 of 7 October 2026 has been in force, after publication in Official Gazette No. 234 on 8 October. The decree aligns Italian law with the AI Act and, in Article 41, sets precise rules for employers that use artificial intelligence systems in decisions on the employment relationship. Article 42 brings AI into risk assessment and worker training.
For HR and management, the principle is easy to state: the final word belongs to a person with real and autonomous authority. Applying it well takes more work, because it adds to obligations that already exist: the information duty on automated decision-making systems introduced in 2022, Article 22 of the GDPR and, according to the European Commission from 2 December 2027, the AI Act rules on high-risk systems used in workforce management. In this guide we set out what the official texts say and what you can do now: map your tools, clarify who decides, inform workers and their representatives, and keep records. Where a law does not say something, we do not take it for granted.
What does Decree 179/2026 say about AI in HR decisions?
Article 41 requires that final decisions on the employment relationship are not taken solely on the basis of automated processing. The rule applies to employers that use AI systems, as defined in Article 3(1) of the AI Act, in decision-making processes concerning the employment relationship. The text refers to Article 11 of Law 132/2025, Italy's AI law, and is without prejudice to Article 22 of the GDPR.
The decisions covered are those on establishing, changing or ending the relationship, including disciplinary measures and performance evaluations. For all of them, the final decision is "in any case" reserved to a natural person exercising real and autonomous authority. A signature at the end of the process is not enough: whoever decides must be able to assess the system's output, depart from it and decide differently.
The decree adds three further elements. The use of these systems must respect dignity, privacy and the principle of non-discrimination (paragraph 2). Before processing starts, the employer must provide the information required by Article 1-bis of Legislative Decree 152/1997, and workers may request an explanation of a decision concerning them (paragraph 3). Finally, paragraph 4 states that a dismissal issued in breach of paragraph 1 is null and void, as are other decisions taken in breach of the same paragraph.
The scope depends on the AI Act's notion of an AI system, to which Article 41 refers. Not every form of automation falls within that definition: to understand whether an HR tool does, start from the EU definition and ask the vendor how it classifies its product. This check is the first practical step, because information notices, roles and records all depend on it.
Which HR decisions fall under Article 41, and which do not?
Article 41 concerns final decisions on the employment relationship, not every use of AI in HR. Reading the scope carefully avoids two opposite mistakes: underestimating tools that prepare important decisions, or treating every automation as a decision on the relationship.
Hiring, changes, termination, discipline and evaluations
The rule covers decisions through which the relationship begins, changes or ends, as well as disciplinary measures and performance evaluations. Think of a system that proposes the annual appraisal score, suggests a disciplinary measure based on productivity indicators or indicates which candidate to hire at the end of the process. In all these cases the system may propose, but the final decision stays with a person.
The delicate point is real and autonomous authority. A person who approves the system's proposals in bulk, without the time, information or authority to change them, is unlikely to exercise genuine control. It is therefore worth setting out in writing who decides, what information they receive beyond the system's output and when they must look more closely. This record will also help you answer requests for an explanation.
Searching for and screening applications
Paragraph 1 specifies that searching for and screening applications is not among the final decisions on establishing the relationship. The exclusion applies even when these activities mean a candidate is not admitted to later stages of the selection. CV screening therefore does not fall under this specific rule of the decree.
This does not mean screening is free of constraints. Article 22 of the GDPR on decisions based solely on automated processing still applies, as do the principles of Article 11 of Law 132/2025 on the use of AI at work and, for systems intended for recruitment, the AI Act's high-risk classification discussed below. If you use automated screening tools, check with your legal adviser how these texts apply to your case.
Worker consent is not enough
The last sentence of paragraph 1 closes a possible shortcut: worker consent is not an exception to the prohibition. This is a difference to keep in mind compared with the GDPR, where explicit consent is one of the exceptions in Article 22. For final decisions on the employment relationship, having a consent form signed does not allow the decision to be left to the system alone.
What information must you give workers and their representatives?
The duty to inform workers is not new. Article 1-bis of Legislative Decree 152/1997, introduced by Legislative Decree 104/2022, requires employers to inform workers about the use of fully automated decision-making or monitoring systems. These are systems that provide relevant input on hiring, management or termination of the relationship, task allocation, surveillance, evaluation and performance.
Law 132/2025, in Article 11, refers to the same provision for the use of AI at work. Decree 179/2026 adds a precise moment: the information must be provided before processing starts. In practice, before switching on an AI tool that feeds into HR decisions, the notice must be ready and delivered.
What the information notice must contain
Article 1-bis lists very concrete content. The notice states which aspects of the relationship the system affects, its purposes, its logic and functioning, the categories of data and the main parameters used to programme or train it, including performance evaluation mechanisms. It also states the control measures for automated decisions, any correction processes and the person responsible for the quality management system.
The picture is completed by the level of accuracy, robustness and cybersecurity, the metrics used to measure them and the potentially discriminatory impacts of those metrics. The information must be provided transparently, in a structured, commonly used and machine-readable format. Any change affecting this information that alters working conditions must be notified in writing at least 24 hours in advance. Much of this data sits with the tool's vendor: ask for it before you buy, not afterwards.
Trade union representatives and right of access
The same information must be provided to the company trade union representatives (RSA or RSU) and, where there are none, to the local branches of the most representative trade unions. Workers, directly or through their representatives, may access the data and request further information: the employer must reply in writing within thirty days.
Article 1-bis also requires the notice to include instructions on data security, an update of the record of processing activities and a risk analysis and impact assessment, with prior consultation of the Italian data protection authority where the conditions of Article 36 of the GDPR are met. The Ministry of Labour and the National Labour Inspectorate may request the same information.
Explaining the decision
Paragraph 3 of Article 41 gives workers the right to obtain, on request and through the involvement of a natural person, an intelligible explanation of the decision concerning them. The explanation also states any influence of AI systems on the decision-making process and the main parameters considered. The right of access to the data and the rights under Articles 13, 15 and 22 of the GDPR remain unaffected. Answering well requires a process: who receives the request, who reconstructs the decision, where the evidence is kept.
What changes under the AI Act for systems used in HR?
The AI Act treats many systems used in workforce management as high-risk. Point 4 of Annex III covers two groups. The first concerns recruitment and selection: systems intended to place targeted job advertisements, analyse and filter applications and evaluate candidates. The second concerns systems intended to make decisions on the terms of work relationships, promotion or termination, allocate tasks based on individual behaviour or personal traits, or monitor and evaluate performance and behaviour.
Article 6 provides a limited derogation: an Annex III system is not considered high-risk if it does not pose a significant risk, for example because it performs a narrow procedural task or a preparatory task. The derogation never applies when the system performs profiling of natural persons: in that case it is always high-risk. Anyone relying on it must be able to justify it.
When the obligations apply
The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the deadlines. According to the European Commission, the Omnibus has been in force since 27 July 2026 and the rules for Annex III high-risk systems, including employment, apply from 2 December 2027. There is time, but the national obligations of Article 41 and the Article 1-bis information duty already apply today: it makes sense to build a single map that serves both.
The employer's obligations as a deployer
An organisation that uses a high-risk system in its activities is a deployer and has its own obligations under Article 26. It must use the system in line with the provider's instructions for use and assign human oversight to people with the necessary competence, training and authority. It must monitor the system's operation, suspend its use if it considers that it presents a risk, and keep the automatically generated logs under its control for at least six months, unless otherwise provided.
Two paragraphs speak directly to HR. Paragraph 7 requires employers to inform workers' representatives and the affected workers before putting into service or using a high-risk system at the workplace. Paragraph 11 requires them to inform people subject to decisions made or assisted by these systems. Paragraph 9 links the provider's information to the data protection impact assessment under Article 35 of the GDPR. Article 23 of Decree 179/2026 provides for administrative penalties, including for failure to comply with Article 26.
How it relates to Article 22 of the GDPR
Article 22 of the GDPR grants the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the person. The exceptions are contract, authorisation by law and explicit consent; in the contract and consent cases the controller must at least ensure human intervention and the possibility to express a view and contest the decision. Decree 179/2026 moves in the same direction and, for final decisions on the employment relationship, rules out consent as sufficient. For a refresher on the principles, read our guide on what the GDPR is.
AI, risk assessment and training: what does Article 42 require?
Article 42 brings AI into the risk assessment. The use of systems that affect work organisation, production pace, the way work is performed or safety-relevant decisions must be assessed in the risk assessment document (DVR) under Article 28 of Legislative Decree 81/2008. A system that assigns shifts, sets pace or distributes tasks can affect exactly these aspects: work with your health and safety manager (RSPP) on how to cover it in the DVR.
Paragraph 3 requires employers to provide adequate information and training to workers on the specific risks of AI systems and on the prevention and protection measures adopted. This adds to the AI literacy required by Article 4 of the AI Act, which we covered in our guide on AI training in companies. Involve the RSPP from the mapping stage: HR, safety and privacy need the same information.
What to do now: a checklist for HR and management
The first step is knowing which tools you actually use. AI features are often built into software already used for recruitment, attendance, appraisals or shift planning, and nobody has ever listed them. Here is a practical order of work for the coming weeks.
Map your tools: list the software and services used in recruitment, appraisal, shifts, monitoring and discipline, and ask vendors which features use AI.
Classify the uses: for each tool, record whether it falls under Annex III of the AI Act, whether it performs profiling and whether it prepares final decisions covered by Article 41.
Name who decides: for each final decision, identify the responsible person, the information they receive and their power to depart from the output.
Update your notices: check that the Article 1-bis notice contains all required elements and is delivered before processing starts.
Involve representatives: prepare the communication to the RSA or RSU and a channel for access requests, with a written reply within thirty days.
Align privacy and safety: update the record of processing and the impact assessment, and bring systems that affect work organisation and pace into the DVR.
Prepare explanations: define who answers workers' requests and what evidence to keep to reconstruct each decision.
You do not need to start from scratch. If you already have a GDPR record of processing or an IT asset inventory, use it as a base and add a column for AI. What matters is that there is one up-to-date map, shared by HR, IT, privacy and safety.
What to do in the coming months: AI governance and ISO/IEC 42001
The checklist deals with what is urgent; AI governance avoids starting over with every new tool. An internal AI policy states who can introduce new systems, who assesses them before purchase, which uses are allowed in HR decisions and how changes are managed. Vendor contracts become part of the control: instructions for use, information for the notice, logs, updates and incidents should be covered in writing.
The ISO/IEC 42001 standard offers a method to put things in order: it is the international standard for AI management systems. It is voluntary and does not replace legal obligations, but it helps define roles, assess risks and impacts, document decisions and check over time that controls work. For a company using AI in workforce management, it is a way to hold the AI Act, Decree 179/2026 and the GDPR together in a single system.
Finally, remember that AI in HR is not only about decisions. If a virtual assistant answers candidates or you use AI-generated content in job adverts, also consider the Article 50 transparency obligations. Keeping everything in the same map lets you respond in an orderly way to workers, representatives and authorities.
How Complaion helps you with the AI Act and ISO/IEC 42001
Complaion supports companies on their compliance journeys for the AI Act, ISO/IEC 42001, the GDPR and the other main standards and certifications. A dedicated Lead Auditor follows your company over time and proposes the path that best fits your needs.
The Complaion platform collects evidence, manages documents, keeps the schedule of activities and prepares the audit. The internal audit is carried out by the Lead Auditor, so you reach external assessments with a system that has already been checked. More than 1,000 clients have chosen Complaion for their compliance journeys: if you want to understand where to start, contact us.
Frequently asked questions about AI in HR decisions
Can I use AI to evaluate employee performance?
Decree 179/2026 does not ban the use of AI in appraisals. Article 41 requires that the final evaluation is not taken solely on the basis of automated processing and that the final decision rests with a person with real and autonomous authority. Before use, the notice under Article 1-bis of Legislative Decree 152/1997 must be provided.
Is automated CV screening prohibited?
No. Article 41 excludes searching for and screening applications from final decisions on establishing the relationship, even when they lead to a candidate not being admitted to later stages. However, Article 22 of the GDPR still applies and, for systems intended for recruitment, so does the AI Act's high-risk classification.
What happens if a dismissal is decided by an AI system alone?
Paragraph 4 of Article 41 states that a dismissal issued in breach of paragraph 1 is null and void. Other decisions taken in breach of the same paragraph are also null. This is why it is worth documenting who took the decision and on what basis.
Does worker consent allow an automated decision?
No, not for final decisions on the employment relationship. Article 41 states that worker consent is not an exception to the prohibition. This differs from Article 22 of the GDPR, which lists explicit consent among its exceptions.
When do AI Act obligations for HR systems apply?
According to the European Commission, after the Digital Omnibus the rules for Annex III high-risk systems, including employment, apply from 2 December 2027. The national obligations of Article 41 of Decree 179/2026, by contrast, have been in force since 23 October 2026.
Do I need to inform trade unions if I introduce an AI system in HR?
Yes, in the cases provided for. Article 1-bis of Legislative Decree 152/1997 requires the information to be given to the company union representatives (RSA or RSU) and, where there are none, to local branches of the most representative unions. For high-risk systems, from 2 December 2027 Article 26 of the AI Act requires informing representatives and workers before use.
Is ISO/IEC 42001 mandatory to use AI in HR?
No, ISO/IEC 42001 is a voluntary standard. It does, however, offer a structured method to manage roles, risks, documentation and controls on AI systems, useful to hold together the obligations of the AI Act, Decree 179/2026 and the GDPR.
