AI for HR in Europe: employee data under European law

Why should HR's AI stay in Europe?

Because employee data is some of the most protected data a company holds, and a US company that processes it answers to US law wherever its servers are. HR files hold salaries, performance reviews, sickness absence, disciplinary records and restructuring plans. GDPR lets each Member State add employment rules on top, several of those data types are special categories, and in Germany, the Netherlands and France the employee representatives have a say before many HR systems go live.

Article 88 GDPR allows Member States, by law or collective agreement, to set more specific rules for processing employees' personal data, with particular regard to transparency, transfers within a group of companies and monitoring systems at the workplace. The EU Court of Justice ruled on 30 March 2023 that such national rules must add real safeguards rather than repeat GDPR, and that where they don't, GDPR applies directly (CJEU press release 54/23, Case C-34/21).

US law follows US companies, not servers. The CLOUD Act obliges a US provider to disclose data in its "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States" (18 U.S.C. § 2713). An EU region of a US cloud changes where a payroll file is stored, not which law the company answers to.

HR data is also strategy. Salaries, attrition risk, succession plans and reorganisation drafts together are a map of your company. Once that map sits with a US company, what happens to it is governed by that company's terms and by US law, and both can change without you having a say. Legal doubt is the brake on AI in Europe: among EU enterprises that considered using AI but don't, 53.6% name a lack of clarity about the legal consequences and 52.7% concerns about data protection and privacy (Eurostat, 2025 survey).

EUrouter keeps the whole chain European. EUrouter B.V. is an Amsterdam company under Dutch law, its DPA requires all processing of personal data to take place in the European Economic Area (section 5), it keeps no request content by default (section 10), and every request goes to EU-hosted model providers, 15 of its 17 providers being headquartered in the EU (EUrouter catalog, 27 October 2026).

What does EUrouter answer when your DPO and works council ask?

EUrouter answers the first questions a DPO or a works council asks about an HR tool in writing: which company processes employee data, where, what is kept, who trains on it and who can be ordered to hand it over. Each answer below is in a document your DPO can read on the DPA page or in the terms.

The question a works council asks most is what gets logged, and who can read it. EUrouter keeps no request content by default, so a record of who asked what exists only where your own tool keeps one, and that is the part a works agreement should define.

Every EUrouter request goes only to EU-hosted provider endpoints, from the Free plan up (routing docs, pricing). Set eu_owned: true on a request, or once for the whole account in a routing rule, and EUrouter uses only providers headquartered in the EEA, such as Mistral AI, Scaleway, OVHcloud, IONOS and Berget AI. On 27 October 2026, 101 of the 154 models in the catalog have at least one such provider (providers).

What can HR teams use AI for?

Five uses fit HR work today: writing, a policy helpdesk, interview and meeting notes, survey analysis and, with the most care, CV screening. The first four stay outside the AI Act's high-risk list as long as they don't filter, rank or evaluate people; CV screening is on it. The tables below read the live EUrouter catalog, show only providers headquartered in the EU, and list prices in EUR; the model catalog has the rest.

Job ads, letters and policies

AI drafting turns an HR officer's notes into job ads, offer letters, policy updates and translations, which HR then edits and signs off. Writing the text of a job ad is not on the AI Act's high-risk list; using AI to place targeted job advertisements is (Annex III, point 4(a)). Chat models from European labs, such as Mistral, Aleph Alpha and Apertus from the Swiss AI Initiative, write in the languages a European workforce speaks:

An HR helpdesk on your own policies

An HR helpdesk answers employees' questions about leave, benefits, expenses and working time from the company's own handbook and collective agreements, and quotes the passage it used. That is retrieval-augmented generation: an embedding model indexes the policies, and a chat model answers from the passages it retrieves. Since 2 August 2026, a chatbot that talks to employees must be built so that they know they are dealing with an AI (Article 50). Each of these embedding models is served by at least one provider headquartered in the EU:

The RAG chatbot guide builds the whole pipeline with code.

Interview and meeting notes

AI transcription turns job interviews, onboarding sessions and HR meetings into text that a chat model can summarise into notes. Tell candidates and employees before you record, and keep the summary to what was said. Since 2 February 2025, the AI Act bans AI systems that infer the emotions of people at work, except for medical or safety reasons (Article 5(1)(f)), and the Commission's guidelines on prohibited practices (29 July 2025) say the ban covers candidates during recruitment too. A tool that scores a candidate's voice or face for nerves or enthusiasm has no place in a European interview. Each of these speech-to-text models is served by at least one provider headquartered in the EU:

Employee survey analysis

Survey analysis sorts the free-text answers of engagement and exit surveys into themes, so HR reads patterns instead of hundreds of comments. The AI Act defines an emotion recognition system as one that infers emotions or intentions on the basis of biometric data (Article 3(39)), and the Commission's guidelines give inferring emotions from written text as an example outside the ban, while inferring them from keystrokes, faces or voices is inside it. Grouping written answers by theme is fine on that count. GDPR and works council rights still apply, so report only on groups large enough that nobody can be singled out. EUrouter's decision models classify each answer against the themes you define and return a probability for every option, so unclear answers go to a person (decisions guide):

CV screening and candidate ranking

AI that analyses and filters job applications or evaluates candidates is high-risk under the AI Act (Annex III, point 4(a)), and so is AI that decides on promotion or termination, allocates tasks based on personal traits, or monitors and evaluates performance (point 4(b)). After the Digital Omnibus on AI, these rules apply from 2 December 2027 (AI Act Service Desk timeline).

An employer that uses such a system must assign human oversight to people with the competence, training and authority to exercise it, inform workers' representatives and the affected workers before using it at the workplace, and tell the people it is used on (Article 26, paragraphs 2, 7 and 11). Under GDPR, candidates have the right, with narrow exceptions, not to be subject to a decision based solely on automated processing (Article 22), and in Germany the works council must agree to selection guidelines even when AI helps draw them up (§ 95(2a) BetrVG). EUrouter supplies the models; the team that builds or deploys a screening tool carries these duties, so plan for them before the first pilot.

Can HR teams use ChatGPT or Copilot with employee data?

Not through employees' own consumer accounts, and a company plan from a US provider still leaves employee data with a US company. Personal accounts sit outside the employer's contracts: no data processing agreement between the employer and the provider covers what an HR officer pastes in, and the employer cannot see or delete it.

A company plan fixes the contract, not the jurisdiction. Azure OpenAI and Amazon Bedrock can process requests in EU regions, but Microsoft and Amazon are US companies: EUrouter's own providers page lists Microsoft Foundry and AWS Bedrock with US headquarters, and eu_owned: true excludes them. The CLOUD Act reaches data such a company controls, wherever it is stored. Running open-weight models on your own servers also keeps data in-house, at the cost of operating GPUs and models yourself.

The European way is to give HR an approved tool that runs on European models from European providers, and to make it the easy option. A chat interface or helpdesk on EUrouter keeps every request in the EEA with a European company, and the RAG chatbot guide shows how to build one on your own documents.

Which rules apply to AI in HR in Europe?

Three layers of rules apply to AI in HR in Europe: GDPR with national employment data rules, the EU AI Act, and works council rights. Sending employee data to a company outside the EEA adds a fourth question: whether that transfer has a legal basis and who else can reach the data.

GDPR and employee data

GDPR applies to every HR document that names a person, and it sets these duties for AI on employee data:

• National rules on top. Under Article 88, Member States can set more specific rules for employee data, and the Court of Justice held in Case C-34/21 that they must add real safeguards to count (CJEU, 30 March 2023).
• Special categories. Health data such as sick notes, trade union membership, religious beliefs and biometric data are special categories under Article 9, which allows processing only on narrow grounds, such as obligations under employment law (Article 9(2)(b)).
• No decisions by machine alone. Article 22 gives people the right, with narrow exceptions, not to be subject to a decision based solely on automated processing that significantly affects them, such as a rejection or a dismissal.
• A DPIA first. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk, in particular for systematic evaluation of people based on automated processing and for large-scale processing of special categories.
• Transfers need a basis. Making personal data available to an organisation outside the EEA is a transfer that must meet Chapter V of GDPR on top of every other rule (EDPB). For the US, the EU Court of Justice struck that basis down twice, in 2015 (Schrems I, C-362/14) and 2020 (Schrems II, C-311/18). Processing the model call in the EEA with a European provider keeps that hop out of Chapter V.

The GDPR text is on EUR-Lex. For DPAs, transfers and the questions to ask any AI provider, read the GDPR-compliant AI explainer.

The EU AI Act

The AI Act bans emotion recognition at work and treats AI in hiring and worker management as high-risk. These are the rules that matter for HR, with the date each applies:

The dates come from the Commission's AI Act Service Desk timeline, which marks 2 December 2027 for Annex III as amended by the Digital Omnibus on AI. The Commission announced that the Omnibus entered into force on 27 July 2026 (Apply AI Alliance, 28 July 2026). The article texts are on the Service Desk: Article 5, Article 26, Article 50 and Annex III.

Works councils in Germany, the Netherlands and France

In Germany, the Netherlands and France, employee representatives must agree to or be consulted on many HR AI tools before they go live, and a French court has stopped a rollout that skipped them.

Sources: § 87 BetrVG, § 90 BetrVG, § 80 BetrVG, § 95 BetrVG, WOR (version in force from 18 February 2023) and CMS on the Nanterre order (no. 24/01457).

Not every AI use triggers German co-determination. The Hamburg labour court held on 16 January 2024, in interim proceedings (24 BVGa 1/24), that letting staff use ChatGPT in the browser with their own accounts did not, because the employer received no data about their use. Commentators warn that the result can differ when a company runs its own AI system (Gleiss Lutz, 27 March 2024). An HR assistant you build is such a system, so agree with the works council what it logs and who can see it. Since EUrouter keeps no request content by default (DPA, section 10), that agreement only has to cover the logs your own tool keeps.

How do you build an HR assistant on EUrouter?

EUrouter is OpenAI-compatible: point the OpenAI SDK at https://api.eurouter.ai/api/v1, pick a model, and add a provider object that keeps the request on EU-headquartered providers with zero data retention. This example answers an employee's leave question from a policy excerpt with Mistral Small 3.2 24B, which Berget AI, GreenPT, OVHcloud and Scaleway serve (EUrouter catalog, 27 October 2026). The question carries no name or employee number: the assistant needs the policy, not the person.

import os

from openai import OpenAI

client = OpenAI(
    api_key=os.environ["EUROUTER_API_KEY"],
    base_url="https://api.eurouter.ai/api/v1",
)

policy = (
    "Parental leave: employees can take up to 16 weeks of paid parental leave "
    "within 12 months of a birth or adoption. Request it in the HR portal "
    "at least 8 weeks before the first day of leave."
)

raw = client.chat.completions.with_raw_response.create(
    model="mistral-small-3.2-24b",
    messages=[
        {
            "role": "system",
            "content": "You answer employees' questions about HR policy. "
            "Use only the policy below, quote the sentence you rely on, "
            "and say so when the policy does not answer the question.\n\n" + policy,
        },
        {"role": "user", "content": "How early do I have to request parental leave?"},
    ],
    extra_body={
        "provider": {
            "eu_owned": True,
            "zdr": True,
            "data_collection": "deny",
        }
    },
)

completion = raw.parse()
print(completion.choices[0].message.content)
print("Served by:", raw.headers.get("x-provider-slug"))

The x-provider-slug response header names the provider that served each request, so your DPIA and your works council get a per-request record of which company processed it. To make these settings the default for every key, save them in a routing rule: a request can never loosen a rule's retention limit. To answer from a whole handbook, follow the RAG chatbot guide. The quickstart covers API keys.

What to check before going live

Before an AI tool touches employee data, HR should be able to answer each of these with a document, not an assumption. Where EUrouter has an answer, it is in the item.

1. Classify the use case. Check it against Article 5 and Annex III, point 4 of the AI Act: emotion recognition at work is banned, and screening, ranking, promotion, termination and performance monitoring are high-risk from 2 December 2027.
2. Keep special categories out. Remove health data, union membership and similar data from prompts unless you have a ground under Article 9 GDPR. EUrouter's DPA (Annex 1) requires a written agreement before such data is sent, so raise it in a DPA review.
3. Pseudonymise first. Replace names and employee numbers with IDs before a model sees the text, and keep the key in your HR system.
4. Involve employee representatives before the pilot. In France a pilot already counted as implementation. Agree what the tool logs, who can read it and for how long.
5. Map every hop. Write down the app, the router, the model provider, logging and monitoring, with the country and the owner of each. EUrouter's DPA lists each sub-processor and model provider with its location, and the x-provider-slug header names the provider of each request.
6. Sign the contracts. Put a data processing agreement in place with each processor under Article 28 GDPR. EUrouter's DPA covers Article 28, confidentiality (section 8) and EEA-only processing (section 5).
7. Lock the routing. On EUrouter, set eu_owned: true, zdr: true and data_collection: "deny", and save them in a routing rule that is the default rule of every API key your HR tool uses; a request can never loosen the rule's retention limit.
8. Keep traces in the EU. EUrouter's Broadcast sends request and response content to the observability tool you choose. Leave it off for employee data, or send it only to a destination hosted in the EU.
9. Run a DPIA. Record the risks, the safeguards and the decision, and review them when the tool or the provider changes. EUrouter assists with a data protection impact assessment on request (DPA section 6).
10. Keep a person in charge. No decision about a candidate or an employee should rest solely on AI output (Article 22 GDPR), and for high-risk systems the people overseeing the tool need the competence, training and authority to overrule it (Article 26(2) AI Act).

Start building HR's AI in Europe

Create a free account, point your HR tool at https://api.eurouter.ai/api/v1, and your next request runs in Europe with a European company. Create a free account, compare plans, read the routing docs, or talk to us about a DPA review, including any special-category data your use case needs.