Law & governance · From use to decision
Govern AI through what it actually changes.
Describe the use, identify applicable rules, involve the right people, and decide on a documented, reversible and monitored pilot.
The starting point is not the tool’s name. Duties depend on the task being changed, the people concerned, the data used and the possible consequences of a system output.
The Architect’s Dream · 1840
These architectures seem to form a stable whole, yet their equilibrium depends on how each part fits with the others. The work reminds us that governance holds only through clear responsibilities, effective routes for challenge and sustained attention to the system’s real effects. View the artwork ↗
01 / Qualify the use
Describe the system’s practical power before looking for the rule.
Qualification starts neither from the provider’s brand nor from the word “assistance”. It starts from the activity, the data and the actual reach of the output.
Which task is being changed?
Write, summarise, recommend, classify, recruit, assign a task, monitor or contribute to a decision.
Who is concerned?
Applicants, workers, professionals, patients or service users — and the data used to describe or evaluate them.
What reach does the output have?
A revisable draft, priority order, score, activity monitoring or a decision producing a significant effect.
How can human control be recovered?
The reviewer’s competence and authority, ability to challenge, fallback solution and suspension conditions.
02 / Identify the frameworks
Four sets of rules answering different questions.
Examining them separately avoids two errors: believing a system that is “not high-risk” presents no issue, or asking the DPO alone to decide the whole project.
EU Artificial Intelligence Act
Qualify the system, use, organisation’s role and corresponding duties.
For a high-risk system used at work, the deployer must in particular organise competent human oversight, monitor operation and inform worker representatives and affected workers.
GDPR & CNIL
Define the purpose, lawful basis, necessary data, retention period and people’s rights.
In particular, examine whether a DPIA is required and the safeguards around a decision based solely on automated processing that produces legal or similarly significant effects.
Labour Code & works council
Make consequences for employment, organisation, working conditions and activity monitoring visible.
The file must arrive early enough and contain sufficiently precise information for the opinion to still influence the project.
Prevention & occupational risk assessment
Assess the effects of change on physical and mental health in the work as it will actually be organised.
The assessment must lead to prevention measures and be reviewed when the project or conditions of use change.
GDPR compliance does not establish AI Act compliance; applying the AI Act removes neither social dialogue nor the duty to prevent occupational risks.
03 / Read by use case
The first useful document depends on what the system does.
This matrix guides analysis. It replaces neither precise project qualification nor legal advice tailored to the situation.
| Intended use | Questions to examine first | Effects on work to document | First deliverable |
|---|---|---|---|
| 01Monitoring, synthesis, rephrasing General assistance | Confidentiality, data sent to the provider, source reliability and transparency towards recipients. | Review time, new plausible errors, productivity expectations and maintaining the ability to work without the tool. | Use note, input rules and human review protocol. |
| 02Recruitment, screening, mobility Employment · potentially high-risk | Scope of Annex III, any exception, bias, personal data, the actual role of human intervention and information for applicants. | Hidden criteria, review workload, ability to challenge and responsibility for the decision. | AI Act qualification, data mapping, impact assessment and social dialogue file. |
| 03Scheduling and task allocation Work management | The system’s influence on access to tasks, schedules, assessment and decisions concerning workers. | Autonomy, intensification, fairness of allocation, workarounds and management discretion. | Before-and-after work mapping, challenge rules and pilot protocol. |
| 04Activity and performance monitoring Monitoring | Purpose, necessity, proportionality, prior information, data access and consequences of the score or alert. | Sense of surveillance, behavioural changes, unrealistic targets, relationships with management and psychosocial risks. | Necessity and proportionality test, DPIA where required, consultation and prevention measures. |
| 05Health, fitness for work or medical data Specialised analysis | Health data, professional secrecy, possible qualification as a medical device, separation of roles and security. | Clinical responsibility, trust, hard-to-detect errors, time pressure and recovery capacity during unavailability. | Legal, clinical, technical and organisational analysis before any pilot. |
Why “potentially high-risk”? Employment and worker-management uses are among the sensitive areas in the AI Act, but qualification depends on the system’s precise functions and the Regulation’s exceptions. The provider cannot decide this question alone for the deploying organisation.
04 / Start from your role
One project, different responsibilities.
Choose your role to display the first work to undertake. The aim is not to split the law into silos, but to know who contributes which part of the file.
This pathway indicates a starting point, not an exhaustive list of duties. Stakeholders must compare their analyses before the decision.
Start from the work need, not from a tool already selected.
Describe the problem to solve, alternatives considered, expected outcome and the person accountable for launching, modifying or stopping the pilot.
05 / Organise the decision
Governance that also names who can say no.
Each stakeholder examines one part of the project. The final decision must make trade-offs, disagreements, continuation conditions and the authority able to suspend use visible.
06 / Prepare social dialogue
A file that genuinely supports understanding and discussion of the project.
A commercial demonstration describes neither the new work organisation nor the constraints that arise when the tool is used in imperfect situations.
Make the project open to influence.
- need, uses and alternatives examined
- population and tasks concerned
- provider documentation and data used
- expected organisational change
Document trade-offs.
- human intervention and appeal rules
- review workload and production targets
- incidents, errors and workarounds
- conditions for immediate suspension
Return with evidence.
- gaps between planned and actual work
- effects on health, autonomy and skills
- corrections actually implemented
- reasoned decision to continue, modify or stop
Legal note. Precise duties depend in particular on workforce size, the nature of the project and its effects. This page offers a general preparation method; it does not replace analysis of applicable law or legal advice tailored to the organisation.
07 / Assemble the file
Eight concrete documents before authorising a pilot.
The list below helps identify what is missing. Completing it is neither certification nor proof of compliance.
08 / Verify sources
Official, dated texts linked to the question they inform.
AI law changes rapidly. Links lead to official texts and methods so the framework can be checked at the time of decision.