Are HR jobs being cut? Does AI decide alone? Is it only for corporations? Must everything change at once? Four myths checked against GDPR, the AI Act and 2026 data, for a Romanian SME.
Translated from Romanian. This article covers Romanian labour and tax law; the Romanian version is canonical and is updated first.
Two things are said about AI in human resources at the same time: that it will take your people, and that it will solve everything. Neither helps an owner or an HR manager in an SME, who has concrete decisions to make: which tool to choose, what to put it to work on, what data to give it and what it risks. Below we check four common claims against the law (GDPR and the European Regulation on artificial intelligence, known as the “AI Act”) and against data published in 2026. The difference between generative AI, classification and rule-based systems, and the questions to put to vendors, are covered in the guide to AI in HR; we do not repeat them here.
| The claim | Verdict | What remains true |
|---|---|---|
| “AI cuts HR jobs” | Mostly false, but the fear is real | Tasks shift; in a 2026 SHRM survey, only 7% of organisations report job cuts as a result of introducing AI |
| “AI decides on its own” | False if you configure it properly — and the law requires it | Human control does not appear by itself: it has to be real |
| “It’s only for corporations” | True in the statistics, false as a rule | Large firms use it more often, but the reasons given by those who held back (skills, legal clarity, data protection) can be addressed in a small company too |
| “Everything has to change at once” | False | One process, measured, then the next |
The fear exists here too. In a 2026 SD Worx study (16 European countries, 5,936 HR managers and 16,500 employees, surveyed between 27 January and 20 February), 30% of employees in Romania fear that AI could take over a significant part of their tasks, compared with about 25% on average in Europe. The figure rises to 38% among those who already use AI.
What organisations report is more nuanced. In a SHRM survey published in April 2026, answered by more than 1,900 HR professionals, 39% of organisations report that introducing AI has led to changes in job responsibilities, 24% to new roles, and 57% see more reskilling opportunities; only 7% report job cuts. These are self-reported answers, not measurements, and they are not representative of the Romanian market, but they show the direction: work is reorganised more often than it disappears.
In SMEs, the practical argument is even simpler. With 30–100 employees, HR is often a single person, who also does payroll and administration. There is no department to cut; there are hours lost on checking time records, on leave requests and on answering the same questions — exactly the tasks tools can take over. Exceptions, difficult conversations and decisions stay with a person.
What is true in the myth: roles change. Someone who used to enter data ends up checking exceptions and explaining results. That is why how you communicate matters: tell the team what is being automated, what is not and who stays responsible.
Here the law does not leave it up to you. But the myth also has a kernel of truth.
Article 22 of GDPR gives a person the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. In HR, for example: automatic rejection of a candidate, or a performance score that leads directly to a sanction.
There are exceptions (the decision is necessary for a contract, is authorised by law, or the person has given explicit consent), but with safeguards: for contract and consent, the person can ask for human intervention, express their point of view and contest the decision (Article 22(3)). They have the right to learn that an automated decision exists and to receive information about its logic (Article 15(1)(h)). And a systematic and extensive evaluation of personal aspects, based on automated processing (including profiling) and on which decisions with significant effects rest, requires a data protection impact assessment before you start (Article 35(3)(a)). More on employee data: GDPR in HR.
The Court of Justice of the EU ruled (7 December 2023, case C-634/21, SCHUFA) that if a bank relies heavily on a score produced automatically by a credit reference agency to grant or refuse a loan, the score itself is an “automated individual decision” within the meaning of Article 22. The judgment is not about HR, but the logic carries over: if a tool ranks candidates and the recruiter calls only the top five on the list, the ranking may be the real decision (a prudent interpretation, not a rule written specifically for employers).
Annex III, point 4, classes as high-risk the tools used for recruitment and selection (targeted job adverts, filtering applications, evaluating candidates) and for managing the employment relationship: decisions on terms of work, promotion or termination of the contract, allocating tasks based on behaviour or personal traits, monitoring and evaluating performance and behaviour (on the limits of monitoring: monitoring employees). There is an exception (Article 6(3)): an Annex III system is not considered high-risk if it does not pose a significant risk to health, safety or fundamental rights, for example because it only performs a narrow procedural or preparatory task; it does not apply, however, to systems that profile individuals.
The AI Act does not ban these tools; it attaches conditions. The employer using them is a “deployer” (anyone who uses an AI system under their authority, other than in a personal non-professional activity) and must, under Article 26:
Article 86 adds the right of a person affected by such a decision, if they consider it detrimental to their health, safety or fundamental rights, to ask the employer for clear explanations of the role the system played in the decision.
The calendar has moved. The Article 26 obligations were due to apply from 2 August 2026, but Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”, in force since 27 July 2026) postponed them, for Annex III systems, until 2 December 2027. Article 86 was not postponed expressly, but it is tied to Annex III systems, whose high-risk classification applies from that date; in practice the right becomes relevant then. Other rules already apply: since 2 February 2025, using AI to infer employees’ emotions in the workplace is banned (according to the Commission’s guidelines, the ban targets systems based on biometric data, such as facial expression or voice), except for medical or safety purposes (Article 5(1)(f)).
What is true in the myth: human control is not automatic. It erodes when the person merely confirms what the tool proposed, has no time to check, or cannot change the outcome. The law does not guarantee it; it requires it. A practical test: can you explain to an employee, in two sentences, why a particular result came out the way it did? If not, you are not ready for the right to information in Article 15 of GDPR either.
The statistics show a real gap. According to Eurostat, in 2025, 20.0% of EU enterprises with at least 10 employees used AI technologies: 17% of small ones (10–49 employees), 30.36% of medium-sized ones (50–249) and 55.03% of large ones. Romania stood at 5.21%, the lowest share in the EU. So “large firms use it more often” is not a myth. Eurostat explains the gap, among other things, by the complexity of implementation, economies of scale and costs.
What is a myth is the idea that an SME has no access to AI. The reasons most often given by European firms that had considered AI but did not adopt it (figures for all firms, not broken down by size) were not “we are too small” but lack of expertise (70.89%), lack of clarity about the legal consequences (52.52%) and concerns about data protection (48.83%). The last two are the very subject of this article, and they are cleared up by information and the right questions, even in a small company.
An SME does not build a model: it uses functions included in tools it already has or subscribes to, switched on one at a time, for specific processes (see HR digitalisation and signs you have outgrown Excel).
What does not depend on size are the rules: an employer with 12 people who uses an AI assistant in the company’s work is a “deployer” under the AI Act, just like one with 1,200. And even if the company buys nothing, its people already use AI — 35% of employees in Romania, at least weekly, for work (the same SD Worx study). The company’s data can end up in tools nobody chose. A simple internal policy (step 5 below) matters more than a budget.
Neither the law nor the technology requires it. The AI Act judges a tool by the purpose it is used for: the same assistant is an ordinary tool when it drafts a job advert and can end up under Annex III when it classifies candidates. You start with what is simple and has clear rules. In five steps:
Preparing people belongs here too. Article 4 of the AI Act, applicable since 2 February 2025, requires those who use AI to take measures to develop AI literacy among their staff and those who use the systems on the company’s behalf. Since 27 July 2026 the text no longer requires a “sufficient level”, but measures supporting its development; no specific level has to be guaranteed for each person. A short session on what the tool does, where it goes wrong and which data is never entered is a reasonable start.
| From | What applies | What it means for an employer |
|---|---|---|
| 25 May 2018 | GDPR: Article 22 (automated decisions), Article 15 (information), Article 35 (impact assessment) | Already applies to any tool that processes personal data |
| 2 February 2025 | AI Act: prohibited practices (Article 5) and AI literacy (Article 4) | No inferring employees’ emotions; measures to prepare those who use AI |
| 2 August 2026 | AI Act: transparency obligations (Article 50) | A chatbot that talks directly to people, for example to candidates, must be designed so that the person learns they are talking to an AI system, unless it is obvious (the obligation is the provider’s; a company that builds its own chatbot becomes the provider) |
| 2 December 2027 | AI Act: high-risk systems in Annex III, including hiring and personnel management | The employer’s obligations under Article 26; the right to explanation under Article 86 (not postponed expressly) is tied to the same classification |
In Romania, ANCOM was proposed (memorandum approved by the Government on 12 March 2026) as the national market surveillance authority and single point of contact for the AI Act, but the competent authorities, their powers and the sanctions are to be set by the national implementing law, which was still being drafted; according to an ANCOM statement of 24 July 2026, checks and sanctions will be possible only after it enters into force. That does not cancel the obligations in the regulation and does not touch GDPR, which ANSPDCP, the data protection authority, already enforces. In May 2026 the European Commission published draft guidelines on classifying high-risk systems; they are not binding and may change.
Yes. The regulation also addresses deployers, regardless of size. The obligations differ by use: an assistant that drafts a job advert mainly triggers the literacy obligation (Article 4); one that classifies candidates can fall under Annex III. In addition, under Article 25(1)(c), a deployer who changes the purpose of an AI system, including a general-purpose one, so that it becomes high-risk becomes its provider and takes on the corresponding obligations. So check whether the purpose declared by the provider (in the instructions for use) covers selection or evaluation.
When you process personal data with a tool, GDPR requires you to inform people about the processing, and for automated decisions also about their logic. For Annex III systems, the AI Act additionally requires, from 2 December 2027, informing workers’ representatives and the affected workers before the system is put into service. In practice, it is simpler to announce it from the start.
Yes, with conditions: Article 22 of GDPR and, from December 2027, the high-risk regime (Annex III, point 4(a)). A person must be able to change the outcome and see how the ranking was reached, not just call the top of the list. A ranking built on past decisions can also reproduce their unfair patterns. And if you use a general-purpose assistant, not made for recruitment, to rank candidates, you risk becoming the provider of a high-risk system yourself (Article 25(1)(c)), with broader obligations than a deployer’s.
For infringing people’s rights (including Article 22), GDPR provides fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). The AI Act sets ceilings of 35 million euros or 7% for prohibited practices and of 15 million euros or 3% for breaching a range of other obligations, including those of deployers; for SMEs the lower of the two values applies (Article 99). These are ceilings, not usual fines: the amount depends on gravity and circumstances, and the sanctions in Romania are set by the national law, still being drafted in August 2026.
You do not need Workly to apply what you have read above, but the optional AI Agents module was built on the same principles:
Only the conversational assistant in the AI Agents module and the opening sentence of the daily summary use a language model; the leave and time tracking agents, like Modi, work without one. Classifying a specific system under the AI Act remains an assessment you make as an employer, based on how you use it. Likewise, if the leave agent rejects a request automatically, the Article 22(2) GDPR basis for that is yours to establish as the employer (the contest route to a person is the Article 22(3) safeguard, not a basis). You can also ask the vendor for the documentation. Details: AI Agents and Modi.
Informational article, accurate at the date of publication. Not legal advice. The framework applicable to AI in employment relationships is evolving quickly: the AI Act calendar was amended in July 2026, Romania’s national implementing law was still being drafted, and the Commission’s guidelines on high-risk systems were at draft stage — check the current position or consult a specialist. The statistics quoted come from the SD Worx (2026), SHRM (April 2026) and Eurostat (2025) studies.
PNRR no longer takes applications, and digitalisation grants have moved to the 2021–2027 regional programmes. Which calls are announced, what they cover and where a project can go wrong.
Six motivation levers ordered by cost, from clarity and fairness to benefits: what the law requires, what doesn't work, how to measure the effect, and a 90-day plan for an SME.
Recruitment agency, temporary work agent, your own job ad or referrals: when each makes sense, the rules for job ads, GDPR for CVs and the steps from offer to the first day of work.
Workly newsletter
Get Workly news (new features and modules), the legislative changes that matter for HR and payroll, new document templates and the practical guides we publish on the blog, by email.
We'll show you how time tracking, payroll and the rest of the modules work for your company, in a short demo.
Request a demo