AI in HR: What AI May Do, Prepare and Never Do

In short: AI in HR pays off where routine piles up: drafting job ads, acknowledging applications and scheduling interviews, running onboarding checklists, answering employee questions, preparing reference letters and certificates, and tracking deadlines. Decisions about people (selection, rejection, appraisal, dismissal) stay with people. That is not just good practice: under the EU AI Act, AI used for hiring and employment decisions is high-risk, Article 22 GDPR protects against purely automated decisions, and in Germany the works council has a say.

In small and mid-sized companies, HR is often one person, or someone who does HR "on the side". Few areas are this full of forms, deadlines and recurring questions. That makes HR an obvious candidate for AI, and a delicate one. In Bitkom's latest survey of German companies, firms not yet using AI cite legal uncertainty (66 %) as a barrier; firms already using it name data protection (66 %) and employee acceptance (42 %) as their biggest hurdles. In HR, all three collide.

This article therefore walks through the HR function the way we approach an org chart with AI agents: task by task. For each task we clarify what AI can take over, what it may only prepare and what it should never do. We then cover the legal framework as of October 2026.

Why AI in HR is a "sensitive field"

In HR, "Is the result correct?" is not enough. It also has to be fair and explainable to the person affected. A wrongly booked invoice can be reversed; an applicant screened out by a system may never find out.

Three characteristics make HR a sensitive field:

Special data: health data (sick notes), marital status, religious affiliation via payroll tax data, severe disability. Much of this falls under the special categories of personal data in Article 9 GDPR.
Power imbalance: employees and applicants find it hard to push back against an employer's decision.
Life-changing consequences: hiring, a formal warning or a promotion changes lives; mistakes are not simply "fixable".

In mysoftwarelab's specialist pool, HR therefore has its own tier: "sensitive field". Specialists in this tier only advise and prepare. A human approves every document that goes to employees or applicants. By contrast, in "standard operation" (for example incoming invoices) an agent works independently under fixed rules and spot checks.

AI in HR: HR tasks in the org chart, AI prepares and a human approves — HR task by task: AI prepares, a human decides and approves.

The HR department in the org chart: task by task

Instead of asking "Can we use AI in HR?", break HR work down into individual tasks. Each task gets one of three levels: fully AI, AI + human (AI prepares, a human approves) or human. The following eight tasks exist in almost every company from around five employees.

1. Writing job ads

An AI agent turns your requirement profile into a draft job ad, adapts it for your careers page and job boards, and checks the wording for potential discrimination: "young, dynamic team", missing gender-neutral wording, unnecessary native-speaker requirements. In Germany, the General Equal Treatment Act (AGG) applies here. A human approves the ad. Level: AI + human.

Be careful with distribution: Annex III of the EU AI Act explicitly lists AI systems used "to place targeted job advertisements" as high-risk. Drafting the text of an ad is different from a system that decides on its own who gets to see it.

2. Incoming applications and scheduling

This is where you save the most time at the lowest risk. The agent acknowledges every application within minutes, checks whether documents are complete, politely requests missing ones and proposes interview slots that are booked straight into the calendars of everyone involved. It files everything in a structured way and flags retention deadlines. Level: largely fully AI, using standard texts you have approved in advance.

3. Pre-screening: the most delicate task

An AI that "filters" or "evaluates" applications falls into the high-risk category under Annex III point 4 of the EU AI Act. And under Article 22 GDPR, people have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. An automatic rejection is exactly that kind of decision.

The Court of Justice of the EU's SCHUFA ruling (C-634/21, December 2023) also matters: even an automatically calculated score can count as an automated decision if it plays a determining role in a person's later decision. Applied to recruiting: a ranking that HR simply follows in practice offers no protection just because a human clicks "reject" at the end. How employment courts will assess this is not yet settled.

What AI can sensibly and defensibly do here:

Summarise documents in a consistent format (qualifications, positions, certificates) so the human reads faster and more consistently.
Map the must-have criteria from the ad ("HGV licence: mentioned / not mentioned in the CV"), without a score and without sorting.
Flag missing information and suggest follow-up questions.

What AI should not do here: rank applicants, reject automatically, infer personality from photos, language or CV gaps, or use criteria that may correlate with age, gender, origin or disability. Level: AI prepares, a human reads every application and decides.

4. Onboarding checklists

Between contract signature and the first working day, many small tasks pile up: workstation, accounts, keys, payroll documents, safety briefing, buddy, training plan. An agent runs this checklist, reminds the people responsible, collects documents and answers new hires' questions from your handbook. Level: largely fully AI; a human checks the documents.

5. Employee questions: leave, certificates, policies

"How many days of leave do I have left?", "How do I apply for parental leave?", "I need an employment certificate for a flat application." An agent with access to your works agreements, your handbook and (strictly limited) leave balances answers standard questions instantly and prepares certificates from templates. Level: information fully AI, documents AI + human. Anything that sounds like legal advice ("Is my employer allowed to do that?") goes to a human.

6. Reference letter drafts

In Germany, employment references must be favourable and truthful at the same time, and reference language is highly formalised, which AI handles well. The agent drafts the reference from the job description, career stages and the manager's input. The assessment of performance and conduct, however, is made by the manager, not the AI, and a human signs. Level: AI + human.

7. Deadlines and contracts

End of probation, fixed-term contracts, notice periods, expiring work permits, follow-ups for mandatory training and safety briefings: a missed deadline can, for example, turn a fixed-term contract into a permanent one by accident. An agent tracks all deadlines, warns in good time and prepares contracts or extensions from templates your lawyer has approved. Level: deadline tracking fully AI, contract documents AI + human, employment-law questions external (lawyer).

8. Payroll preparation

Payroll is closely tied to HR: joiners and leavers, sick days, leave, overtime, supplements. An AI payroll specialist collects this data, compares it with the previous month and flags anomalies. Your payroll team or tax office always approves the payroll run and filings. We describe this in detail in our article on AI in accounting. Level: AI + human, approved by payroll or tax office.

What AI in HR may do, may only prepare and should never do

This overview is practical guidance, not legal advice. Check your specific use with your data protection officer, works council and, where needed, an employment lawyer.

Task	AI may do independently	AI may only prepare	Never by AI
Job ads	Format variants for channels	Draft text, discrimination check	Decide on its own who sees the ad
Incoming applications	Acknowledge, check completeness, request missing documents	Filing, propose retention periods	Automatically screen out applicants for missing documents
Scheduling	Propose and book slots, send reminders	Interview guide from requirement profile	Conduct or evaluate interviews
Pre-screening	Nothing	Summarise documents, map must-have criteria	Ranking, scoring, rejection, personality analysis
Onboarding	Run checklist, remind, answer questions from the handbook	Training plan	Assess the probation period
Employee questions	Standard answers from policies and handbook	Certificates from templates	Legal advice, information on other people's health data
Reference letters	Nothing	Draft in reference language	Performance assessment, signature
Deadlines and contracts	Track and report deadlines	Contracts from approved templates	Dismissal, formal warning, contract change
Payroll preparation	Collect data, month-on-month comparison	Comment on anomalies	Trigger a payroll run or payment
Performance and conduct	Nothing	Anonymised, aggregated analyses	Monitoring individuals, emotion recognition at work

The last row is deliberate: under Article 5 of the EU AI Act, systems that infer people's emotions in the workplace are prohibited (with exceptions only for medical or safety reasons). This ban has applied since February 2025.

Legal framework for AI in HR (as of October 2026)

Four sets of rules matter, the last two specifically if you employ people in Germany. This overview is not legal advice, but it shows where the boundaries lie.

EU AI Act: HR is high-risk, the deadlines have moved

Annex III point 4 of the AI Regulation (EU) 2024/1689 classifies two groups of HR applications as high-risk: first, AI for the recruitment or selection of people, in particular to place targeted job ads, analyse and filter applications and evaluate candidates; second, AI that makes decisions on terms of employment, promotion or termination, allocates tasks based on behaviour or personal traits, or monitors and evaluates performance and behaviour.

The obligations for these systems were originally due to apply from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the application date for Annex III high-risk systems to 2 December 2027. Postponed does not mean removed: if you introduce AI in recruiting today, design it for these obligations now. For companies using such systems (deployers), they include human oversight by competent people and informing workers' representatives and affected employees before use in the workplace (Article 26). More on the timeline in our article on the EU AI Act.

Article 6(3) provides an exception: an Annex III system is not high-risk if, for example, it only performs a narrow procedural task or a preparatory task. This exception never applies where the system profiles natural persons, and it must be documented. An agent that books interviews is different from a system that evaluates applicants; classification remains a case-by-case assessment.

GDPR: no purely automated individual decisions

Article 22(1) GDPR gives people the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them. Where exceptions apply, people must at least have the right to obtain human intervention, to express their point of view and to contest the decision. In practice, for HR: human review must be real, not a click. Add a legal basis, transparency towards those affected, retention periods, data processing agreements and, where risk is high, a data protection impact assessment.

German Works Constitution Act: the works council co-determines

Under Section 87(1) no. 6 of the Works Constitution Act (BetrVG), the works council has co-determination rights over the introduction and use of technical systems designed to monitor employees' behaviour or performance. German courts interpret this broadly: it is generally enough that a system is objectively capable of such monitoring, which applies to most AI systems working with employee data. The employer must also inform the works council about planned work processes including the use of artificial intelligence (Section 90(1) no. 3), and selection guidelines for hiring remain subject to co-determination even when AI is used to draw them up (Section 95(2a)). A works agreement that records which agent sees which data and what it may not do has proven useful in practice.

German General Equal Treatment Act: discrimination is discrimination

The AGG prohibits discrimination on grounds of race or ethnic origin, gender, religion or belief, disability, age or sexual identity. It makes no difference whether a person or a system discriminates. Applicants who are discriminated against can claim compensation; if they would not have been hired even in a non-discriminatory selection, it is capped at three months' salary (Section 15(2) AGG). The claim must be made in writing within two months of receiving the rejection. AI models learn from data that may contain bias, so every recruiting checklist needs explicit bans on such criteria.

Which AI specialists for the HR department?

A general-purpose chatbot knows neither your works agreements nor the limits that apply in HR. In mysoftwarelab's specialist pool, you therefore choose an AI specialist for each role based on a real job profile. Each comes with expertise, working rules, checklists, limits and a fixed approval rule. These are the most relevant for HR:

Specialist	Tasks	Limits	Approval
HR officer (sensitive field)	Personnel files, contracts, certificates, employee questions, onboarding and offboarding	No employment-law advice; no warnings, dismissals or assessments of people; no automated personnel decisions	A human approves every document addressed to employees.
Recruiter (sensitive field)	Job ads, structuring applications, coordinating interviews	No selection or rejection decision without a human; no ranking as the sole basis; interviews are led by people	Your team always decides on selection, offers and rejections.
Learning & development specialist (standard operation)	Training plans, learning material, onboarding plans	No performance assessment of individuals; no personnel decisions	HR management approves the training plan.
Payroll accountant (standard operation)	Prepare payroll, month-on-month comparison	Never triggers a payroll run or payment; special cases such as garnishments or severance go to a human	Payroll runs and filings are approved by your payroll team or tax office.
Occupational safety specialist (preparatory) (regulated profession)	Prepare safety briefings, inspection deadlines, risk assessments	Does not replace the appointed safety specialist	Your appointed safety specialist is responsible for assessments and measures.

Fixed working rules come on top, for the recruiter for example: sorts by requirement profile, never by age, gender or origin; deletes data after the retention period. All profiles are on the specialist pool and positions page.

Steer, approve, monitor: the cockpit for HR work

"A human approves" only works if approval is easy; otherwise it turns into rubber-stamping. In mysoftwarelab's company cockpit, the person responsible for HR therefore sees in one place:

Approval queue: drafts of references, certificates and contracts, with the sources the agent used.
Deadline overview: probation periods, fixed terms and safety briefings for the next 90 days.
Log: which agent accessed which data when and what it did; the basis for works council discussions and documentation.
Exceptions: questions the agent deliberately passed to a human, such as employment-law questions or anything health-related.

How approval levels work in detail is explained in steering and approving AI agents.

Example calculation: how much time goes into incoming applications?

A purely illustrative calculation with stated assumptions, not a measurement at a client. Assume a company with 60 employees receives 80 applications a month. Acknowledgement, completeness check, requesting missing documents, filing and scheduling take 12 minutes per application on average. That is 80 × 12 = 960 minutes, or 16 hours a month, before anyone reads a single application for content. If an agent handles these steps and 2 minutes per application remain for checks and exceptions, the effort drops to about 2.7 hours. Human review of each application's content is deliberately not cut. Plug in your own numbers.

Step by step: introducing AI in HR

List the tasks: all recurring HR tasks with rough monthly hours, including those done "on the side".
Set a level per task: guided by the table above. Decisions about people stay human.
Involve the works council and data protection early: present the plan before any system goes live; clarify access rights, retention periods and impact assessment.
Have templates approved: your lawyer reviews contract clauses, reference, certificate and rejection templates once; the agent uses only these.
Choose and limit specialists: each specialist gets only the data it needs for its task.
Start with low-risk tasks: acknowledgements, scheduling, onboarding, deadlines. Pre-screening support later and only without ranking.
Inform and train staff: people working with agents need AI literacy; those affected should know what AI is used for.
Spot checks and review: check drafts and answers regularly; reassess the EU AI Act classification before December 2027 at the latest.

FAQ: AI in HR

What can AI in HR actually take over?

AI in HR mainly takes over routine: acknowledging applications and scheduling interviews, onboarding checklists, standard answers on leave and policies, deadline tracking, and drafts of job ads, references, certificates and contracts. Decisions about people stay with people.

Is AI recruiting allowed under the EU AI Act?

Yes, but AI used to select candidates, filter applications or place targeted job ads is high-risk under Annex III. Following the Digital Omnibus, Regulation (EU) 2026/1744, these obligations apply from 2 December 2027. Purely organisational tasks such as booking interviews are generally not covered, but classification is a case-by-case assessment.

Can AI reject applicants automatically?

This is not advisable. Article 22 GDPR protects against decisions based solely on automated processing with significant effects, and a rejection is such a decision. AI can prepare the rejection letter; a human makes and owns the decision.

Does the works council have to agree to AI in HR?

In Germany, usually yes. Under Section 87(1) no. 6 BetrVG, the works council co-determines the use of technical systems capable of monitoring behaviour or performance. It also has information rights on the use of AI (Section 90) and co-determination on selection guidelines (Section 95). Involve it early.

Can AI write employment references?

AI can draft references in the correct formal language. The manager assesses performance and conduct, and a human reviews and signs the reference.

Will an AI HR assistant replace the HR officer?

No. An AI specialist handles routine and preparation; the HR officer gains time for conversations, development and decisions. In the specialist pool, HR is therefore a sensitive field: advisory and preparatory, always approved by a human.

Which data may an AI agent in HR access?

Only the data it needs for its task. Health data and other special categories under Article 9 GDPR only where strictly necessary and with tight access control. Every access should be logged.

Conclusion: AI relieves HR, people decide about people

AI in HR is not all or nothing. The biggest benefit lies in the many small tasks that cost hours today: incoming applications, scheduling, checklists, deadlines, drafts. The boundary is clear: as soon as a decision about a person is involved, AI only prepares. Going task by task, involving the works council early and using specialists with fixed limits brings relief and keeps you on safe ground with December 2027 in view. Our packages are on the AI consulting page.

AI in HR

Your HR department in the org chart: what AI prepares, what your team decides.

Callback within 24 hours. Then you go through your org chart role by role with Andreas Indorf, HR included, and see a clickable prototype of your cockpit with clear approval rules.

Request a callback → Browse the specialist pool