Your employer and AI: what the European law now prohibits.

What the AI Act prohibits for your employer since 2025

The AI Act introduced six strictly prohibited practices for employers. These rules, applicable since February 2025, aim to protect employees from abusive uses of AI.

Among the most relevant prohibitions for the workplace:

These prohibitions apply regardless of the company's size or sector. Employers must audit their existing tools to ensure compliance with these rules. Article 5 of the AI Act details all prohibited practices.

Mandatory transparency since 2 August 2026

Article 50 of the AI Act now requires employers to clearly inform employees when AI systems are used in their work environment.

This transparency obligation covers several aspects:

• The identification of AI systems used, including a description of their purpose.
• The methods of interaction between employees and these systems.
• Employees' rights regarding these tools, particularly in terms of data protection.

For generative AI systems, such as chatbots or content generation tools, the employer must also clearly indicate when content has been generated or modified by AI. This obligation applies even if the tool is integrated into broader software, such as a CRM or productivity tool.

Employers must also implement mechanisms allowing employees to report issues or concerns related to AI use. The AI Office provides guidelines to help businesses comply with these requirements.

HR tools and AI: legal limits

AI systems used in HR processes are particularly regulated by the AI Act due to their potential impact on employees' rights.

Key tools affected include:

Employers must also ensure these tools comply with the GDPR, particularly regarding personal data protection. The CNIL has published specific recommendations for AI use in HR processes.

How to check your company's compliance

Employees can play an active role in verifying their employer's compliance with AI Act obligations.

Here are some steps to assess the situation:

1. Identify AI tools used: Request a list of AI systems deployed in the company, including their purpose and provider.
2. Verify transparency: Ensure the employer has informed employees about the use of these tools and that AI-generated content is clearly identified.
3. Review HR processes: Check that AI tools used in HR processes meet transparency and non-discrimination criteria.
4. Consult documentation: Request access to technical documentation and risk assessments for the AI systems used.

Employers must also designate an AI Act compliance officer, who may be the Data Protection Officer (DPO) or another competent person. This officer must be accessible to employees to address their questions and concerns.

For further guidance, employees can use tools such as the AiActo assessment to quickly evaluate their company's compliance.

What to do in case of non-compliance

If an employee finds that their employer is not complying with AI Act obligations, several courses of action are available.

First, it is recommended to alert the AI Act compliance officer or the company's DPO. These individuals are responsible for addressing reports and taking necessary corrective measures.

If this internal approach yields no results, the employee may:

• Contact the competent authorities, such as the CNIL in France or the AI Office at EU level.
• Consult a solicitor specialising in employment law or data protection to explore potential legal remedies.
• Use internal or external reporting mechanisms established by the company, in line with GDPR obligations.

Fines for non-compliance with the AI Act can reach up to €35 million or 7% of the company's global turnover, whichever is higher. These penalties aim to ensure respect for employees' rights and the protection of personal data.