Occupational Safety, Equality Law and the Public Authority as Employer

Chapters 21 to 23 treated the instruments written with algorithms in mind. This chapter turns to three older bodies of law that bind every employer whatever technology it uses. Occupational safety and health law makes the employer answerable for the pace and strain that algorithmic direction produces. Equality law makes it answerable for the outcomes of its rules by group, including rules it never wrote down because a supplier configured them. And when the employer is a public authority, administrative law, the Charter and the law of public procurement add duties that a private employer does not carry. The chapter concerns M5 Care, because safety and health are the duty of care written into law, and M3 Consequence, because pay, promotion, hiring and access to work are where unequal treatment becomes harm; it touches M1 Direction wherever a schedule or an allocation rule sets the pace or distributes opportunity. It answers two open questions of the book: Q10, how a public authority remains a model employer when it procures the AI boss from a supplier it does not control, and Q11, what replaces the manager's judgement in the duty of care.

Figure 24.1: Safety, equality and public-employer duties around the five management functions, with procurement, the delegation profile, tests and records as the points of control.

Three duties that stay with the employer

The three fields share a structure. They are technology-neutral: a fixed rule in a rostering engine falls under them as fully as a learned model does. They attach to outcomes: an unhealthy pace, a disadvantage to a protected group or an unexplained decision is a breach whatever its cause. And they place the duty on the employer, who cannot pass it to a supplier by contract. The Framework Directive on safety and health at work says so in terms: enlisting external services or persons does not discharge the employer from its responsibility (Article 5(2)) (49, Council of the European Communities, 1989). Equality law reaches the same result through the burden of proof, which falls on the respondent employer once a worker shows facts from which discrimination may be presumed (54, Council of the European Union, 2000).

An employer therefore needs evidence it can produce itself: that the pace its systems set is safe, that its rules do not produce unjustified disparities by group, and, for a public authority, that each decision about a person can be explained and reviewed. Where the system is procured, that evidence exists only if the contract requires it, which is why procurement closes the chapter.

Occupational safety and health under algorithmic direction

Chapter 14 assembled the evidence on pace, strain and injury and set out the Framework Directive and national work-environment law in detail. This section does not repeat it. It reads the same provisions as organisational duties and asks what an employer must be able to show.

The Framework Directive as a list of things to show

Directive 89/391/EEC gives the employer "a duty to ensure the safety and health of workers in every aspect related to the work" (Article 5(1)) and keeps it there when external services are enlisted (Article 5(2)). Among the principles of prevention, it requires the work to be adapted to the individual, "in particular, to alleviating monotonous work and work at a predetermined work-rate" (Article 6(2)(d)), and the introduction of new technologies to be the subject of consultation as regards their consequences for safety and health (Article 6(3)(c)). The employer must possess a risk assessment, "including those facing groups of workers exposed to particular risks", and decide on protective measures (Article 9(1)(a) and (b)), and must consult the workers' safety representatives in advance and in good time on any measure which may substantially affect safety and health (Article 11(2)(a)) (49, Council of the European Communities, 1989).

Read as duties to show, these become four artefacts: a risk assessment that names the system, the work it directs and the groups exposed to particular risk, which in home care means part-time and hourly staff on the longest rural routes rather than an average worker; a record that the system's rate-setting choices are working methods the employer chose, not defaults it accepted; a record of consultation before introduction and before every substantial change; and evidence that the protective measures work.

The last is where algorithmic direction differs from a paper roster. A protective measure in a scheduling system is a constraint in an optimiser. If it is a penalty weighed against other objectives, the system can trade it away when demand is high; if it is a feasibility condition, no plan that breaches it can be produced. Only the second is a protective measure in the sense of Article 9(1)(b), and only a test that tries to break it shows which one the system implements. Chapter 14 wrote Nordvik's constraints as tests with seeded breaches; the point here is that the employer, not the supplier, must hold that evidence.

Working time and the Platform Work Directive

The Working Time Directive supplies constraints that are already numerical: 11 consecutive hours of daily rest per 24-hour period (Article 3), a rest break where the working day is longer than six hours (Article 4), a weekly rest period (Article 5) and an average of no more than 48 hours a week including overtime (Article 6(b)) (50, European Union, 2003); the Charter repeats the right to rest and to limited working hours in Article 31(2) (48, European Union, 2012). Enforced as feasibility conditions, they remove one class of breach entirely. They say nothing about whether a compliant roster is healthy: an optimiser rewarded for utilisation will plan to the minimum every time, so the employer's risk assessment, not the Directive's minimum, decides where a constraint sits.

Article 12 of the Platform Work Directive is the first provision of EU law to write the safety duty out for algorithmic management. Without prejudice to the Framework Directive, it requires digital labour platforms to evaluate the risks of automated monitoring and decision-making systems to safety and health, in particular the risks of work-related accidents and psychosocial and ergonomic risks, to assess whether the systems' safeguards are appropriate and to introduce preventive and protective measures (Article 12(1)), and not to use the systems in a manner that puts undue pressure on workers or otherwise puts their physical and mental health at risk (Article 12(3)) (47, European Union, 2024). Neither Nordvik Region nor Hansa Mutual is a platform; for them Article 12 is a reference standard that states what the general duties already imply. That labour inspectorates will read the Framework Directive in its light when they inspect algorithmic direction elsewhere is expected, given the transposition deadline of 2 December 2026.

National law: Sweden and Germany

The examples use Swedish law, the model for Nordvik Region's own, and German law for Hansa Mutual's headquarters. The Swedish Work Environment Act requires that technology, work organisation and job content be designed so that workers are not exposed to loads that can cause ill health, and that strongly controlled or restricted work be avoided or limited (Chapter 2, section 1); its safety representative may require measures or an investigation (Chapter 6, section 6a) (75, Sveriges riksdag, 1977). AFS 2023:2 requires resources to be adapted to demands and workers to know what to prioritise and whom to turn to for help (84, Arbetsmiljöverket, 2023). The organisational implication is that a change to a scheduling system's objectives or constraints is a change in the activity that needs a risk assessment before it takes effect, and that every route or queue the system produces must name a person a worker can call.

In Germany, section 5 of the Occupational Safety and Health Act requires the employer to assess hazards arising from the design of work processes, workflows and working time and from psychological stress at work (section 5(3), points 4 and 6) (227, Germany, 1996), and the works council co-determines rules on health protection under BetrVG §87(1) no. 7 (9, Germany, 2001). An allocation rule that sets how many claims reach a handler in an hour is such a workflow. ISO 45003:2021, which lists workload, work pace and job control among psychosocial hazards, gives safety, HR and AI governance a shared vocabulary (83, ISO/IEC, 2021).

Equality and non-discrimination: proxies and the burden of proof

Chapter 12 showed how bias enters management systems through the definition of good performance, proxies, historical decisions and feedback loops, and introduced the disparate-impact test (DIT-*) to find it. This section sets out the legal duty that makes the test necessary rather than merely good practice.

Indirect discrimination is the main risk

The equality directives prohibit direct and indirect discrimination in employment: Directive 2000/43/EC on racial or ethnic origin, Directive 2000/78/EC on religion or belief, disability, age and sexual orientation, and Directive 2006/54/EC on sex (55, Council of the European Union, 2000) (54, Council of the European Union, 2000) (56, European Union, 2006). Indirect discrimination occurs where "an apparently neutral provision, criterion or practice" would put persons with a protected characteristic at a particular disadvantage, unless it is objectively justified by a legitimate aim and the means of achieving it are appropriate and necessary (Directive 2000/78/EC, Article 2(2)(b); Directive 2006/54/EC, Article 2(1)(b)).

A management system that never sees a protected characteristic can still discriminate indirectly, because its rules are provisions, criteria and practices in the sense of the directives. Availability on two consecutive days correlates with part-time work and so, in most workforces, with sex. A gap of a year in a curriculum vitae correlates with parental leave. A complaints indicator correlates with market and shift; speed on a measured task can correlate with age or disability. None of these is unlawful in itself; each becomes a question the employer must answer once a disadvantage appears. And because the system applies a rule identically to every person, a disparity that would have been noise in one manager's decisions becomes a measurable pattern. For pay, Directive 2006/54/EC requires discrimination on grounds of sex "with regard to all aspects and conditions of remuneration" to be eliminated (Article 4), so a performance score that feeds variable pay falls within it.

The burden of proof turns a test into evidence

When persons who consider themselves wronged establish facts from which discrimination may be presumed, "it shall be for the respondent to prove that there has been no breach of the principle of equal treatment" (Directive 2000/78/EC, Article 10(1); Directive 2006/54/EC, Article 19(1)) (54, Council of the European Union, 2000) (56, European Union, 2006); in Germany the General Act on Equal Treatment carries the rule in § 22 (74, Germany, 2006).

A worker or a union can often show a disparity from what they know themselves: who received the open shifts, who was shortlisted, whose score fell. The employer must then justify the rule behind it, and can do so only with evidence it already holds: the rule in force at the time, its purpose, the outcomes by group, the alternatives considered. The disparate-impact test of Chapter 12, run on every release and kept with it, is therefore the employer's defence file, not an ethical extra.

Swedish law adds a duty to look before anyone complains. The Discrimination Act requires employers to carry out active measures covering working conditions, pay, recruitment and promotion, and training (Chapter 3, sections 4 and 5), and to survey and analyse pay differences between women and men every year (Chapter 3, section 8) (76, Sveriges riksdag, 2008). A system that allocates open shifts or shortlists applicants falls within that annual work.

What the AI Act adds, and pay transparency

Article 10(2)(f) of the AI Act requires providers of high-risk systems to examine their data "in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations", and Article 10(2)(g) requires measures to detect, prevent and mitigate them (1, European Union, 2024). The duty falls on the provider and its data; it does not test the deployer's workforce, rules or configuration, where Chapter 12 found most disparities, and it does not lift the burden of proof from the employer. The deployer's answer is to require the provider's Article 10 evidence by contract and to test its own outcomes. The clause on outputs that influence inputs names the feedback loop of allocation and gives a deployer a ready basis for asking how it is controlled.

Directive (EU) 2023/970 on pay transparency, with a transposition deadline of 7 June 2026 (Article 34), requires employers to make the criteria for pay, pay levels and pay progression easily accessible, and those criteria "shall be objective and gender neutral" (Article 6(1)). Employers with 250 workers or more report the gender pay gap, including in variable components, by 7 June 2027 and yearly after (Article 9(1) and (2)), and an employer that has not implemented the transparency obligations must prove there was no pay discrimination (Article 18(2)) (57, European Union, 2023). Whether every member state has transposed on time must be checked per state. A score that feeds variable pay is a pay criterion: an employer that cannot state it in terms a worker can read, and show that it is gender neutral, fails Article 6 before any claim is made.

The public authority as employer

A public authority employs people under the same labour law as a private employer, and in addition under rules that bind it because it is public. Four differences matter for the AI boss.

Legality, objectivity and reasons

In Swedish law, the Instrument of Government requires administrative authorities to observe the equality of all before the law and to act with objectivity and impartiality (Chapter 1, section 9) (240, Sveriges riksdag, 1974), and the Administrative Procedure Act states the principles of legality, objectivity and proportionality in section 5, which applies to all of an authority's administrative activity, not only to case handling (section 1) (239, Sveriges riksdag, 2017).

Reasons and appeal reach less far, and a public employer should not overstate them. The same Act requires a decision that may affect someone's situation in a not insignificant way to state clear reasons, but allows them to be omitted where the decision concerns the employment of someone (section 32), and governs appeal to the administrative courts (sections 40 to 42) (239, Sveriges riksdag, 2017). Much of what a public employer decides about its staff, a roster, an allocation of work, an individual pay rise under a collective agreement, is employer action governed by labour law and the agreements rather than an appealable administrative decision, and the arrangements differ between member states. The Charter binds member-state authorities only when they implement Union law (Article 51(1)) (48, European Union, 2012), as they do when they apply the equality, working-time and safety directives.

Legality and objectivity therefore cover the whole of a public employer's use of an AI boss, formal reasons and appeal only part of it. A model employer closes the gap by choice: it gives reasons for every M3 Consequence decision and every contested M1 Direction decision in a Management Decision Record, and offers review by a person who can change the outcome, whether or not the law requires it. AI Governance, Chapter 17, concluded that in public authorities legality comes before capability and every case has a reasons log (F31) (41, Nordqvist, 2026); for the authority as employer, the reasons log is the MDR.

The AI Act's public-body duties

Article 27(1) of the AI Act requires deployers that are bodies governed by public law to carry out a fundamental rights impact assessment before deploying a high-risk Annex III system, covering the processes, period and frequency of use, the persons affected, the specific risks of harm, the oversight measures and the measures if risks materialise, including complaint mechanisms (1, European Union, 2024); the Digital Omnibus lets it cross-refer to the data protection impact assessment (Article 27(4) as amended) (2, European Union, 2026). Article 49(3) requires public-authority deployers to register their use in the EU database before using an Annex III system, and Article 26(8) forbids them to use a system the provider has not registered (1, European Union, 2024). Chapter 21 treated both duties and showed part of Nordvik's FRIA-2026-007.

The timing matters for procurement. The Omnibus moved the high-risk requirements and deployer obligations for Annex III systems to 2 December 2027 and amended Article 111(2): systems put into service before then fall under the Regulation only if their design changes significantly, while providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case (2, European Union, 2026). A major release of a management system may be the change that brings it into scope, and the contract must already provide what compliance needs.

Lessons of the automated state

AI Threat, Chapter 11, examined SyRI, the childcare-benefits affair and Robodebt and found four recurring mechanisms: a reversed burden of proof, opacity, scale and institutional denial, with correction coming each time from outside (44, Nordqvist, 2026). The District Court of The Hague struck down the SyRI legislation in February 2020 (192, District Court of The Hague, 2020), and the Dutch parliamentary inquiry called its report on childcare benefits Ongekend onrecht, unprecedented injustice (191, Tweede Kamer, 2020). Those cases concerned citizens; each mechanism has an employer form. A low score becomes a presumption a worker must rebut; neither worker nor manager can see why a route was planned; one rule touches a thousand staff before anyone notices; and contests and safety representatives' requests are handled as resistance to change rather than as monitoring data.

Research on officials adds a caution. In three experiments in the Netherlands, Alon-Barkat and Busuioc found no evidence of general automation bias, but found that participants adhered more readily to advice, algorithmic or human, that matched group stereotypes; in a study of civil servants run shortly after the childcare-benefits scandal the pattern did not appear, which the authors attribute to heightened awareness of algorithmic bias (179, Alon-Barkat & Busuioc, 2023). Awareness shaped oversight, which favours training and outcome monitoring over a person in the loop alone.

Accountable to elected bodies

A public authority answers to politicians and the public as well as to courts, and at Nordvik Region, whose law follows the Swedish pattern of a principle of public access to official documents, its delegation profiles and equality tests are official documents that the public may ask to see. A model employer writes its records for an outside reader, and its register of algorithms covers the systems that manage its staff as well as those used in decisions about residents.

Procurement as the decisive moment

A public authority rarely builds its AI boss. It buys it, and the procurement fixes, for the life of the contract, what the authority will be able to show. Directive 2014/24/EU gives it four instruments (8, European Union, 2014). Technical specifications may refer to "the specific process or method of production or provision" of a service where linked to the subject-matter and proportionate, and must take accessibility into account where staff will use the system (Article 42(1)); a specification can require constraints enforced as feasibility conditions, logs and a stop path outside the supplier's system. Award criteria may include qualitative and social aspects in the best price-quality ratio (Article 67(2)), but must allow the information tenderers give to be effectively verified (Article 67(4)), so quality of explanation and constraint enforcement should be scored from a demonstration, not a description. Contract performance conditions may include "employment-related considerations" (Article 70). Review clauses allow later modification without a new procedure only where the initial documents provided for it in clear, precise and unequivocal terms (Article 72(1)(a)); a contract without them leaves the authority to choose between accepting a release as offered and re-tendering.

Article 18(2) requires member states to ensure that contractors comply with social and labour law in performing public contracts, which supports requirements drawn from working-time and equality law. The Commission's model contractual AI clauses offer a high-risk version that public buyers may adapt and invite them to extend the clauses to simpler rule-based systems where the impact on individuals justifies it (39, European Commission, 2023), which matters for scheduling engines that may not meet the AI Act's definition. AI Red Team, Chapters 8 and 28, concluded that vendor AI may already act at an autonomy nobody decided, so its use must be established and required by contract before it is relied on (F57) (43, Nordqvist, 2026); a supplier release that adds a feature which assigns, scores or flags staff is that case.

Nordvik Region's tender NR-2025-089 asked for compliance with working-time rules and a rest-rule check. It did not ask how constraints are enforced, whether they could be traded against other objectives, or how the Region would show that they hold. CNT-NR-0001 exposed the gap with a route that complied with every working-time rule and could not be worked (Chapter 14), and AI Governance, Chapter 13, had concluded that a stop path running inside the system it stops fails when it is needed (F19) (41, Nordqvist, 2026).

Practical guide: Tender requirements for an AI system that performs management functions in a public authority

Purpose. Write specifications, award criteria and contract conditions that let a public employer meet its safety, equality and public-law duties for a management system it buys, and verify them before acceptance.

Roles. The function owner (the HR director or equivalent), the procurement lead, the AI governance lead, the data protection officer, the chair of the central work-environment committee and safety representatives, the unions or works council, and the line managers who will oversee the system.

Steps.

1. Map the functions. List the management functions the system performs, with the intended degree of delegation for each; no requirement may allow Level 4 Autonomous for M3 Consequence.
2. Derive constraints from the risk assessment. Specify every working-time rule and every control in the work-environment risk assessment as a feasibility condition, with seeded-breach tests the authority runs on every release.
3. Specify records. Require logs of every output, override and offer with rule and model version, kept for at least the six months of AI Act Article 26(6) and longer where archives law and limitation periods require, in a documented export format.
4. Specify a stop path outside the system. The authority holds it; state the time to effect, the manual fallback and the drill.
5. Specify explanation and access. Require what a manager needs to give reasons in an MDR and a person needs under AI Act Article 86, and read-only, aggregated access to agreed indicators for safety representatives and unions.
6. Specify equality evidence. Require the provider's examination under Article 10(2)(f) and (g) and an export of outcomes by the groups the authority tests.
7. Make delegation configurable. The authority sets and logs each function's degree; new features that assign, score or flag people arrive switched off.
8. Test the award criteria. Score constraint enforcement, explanation and access from a demonstration on the authority's data.
9. Add conditions and review clauses. Notice before each release, a right to audit, Article 49 registration evidence, and review clauses under Article 72(1)(a) for foreseeable changes.
10. Negotiate before publication. Negotiate with the unions, consult the safety representatives and record the decision.

Definition of done. Every M3 Consequence function has a named human decider; every protective constraint has a test the authority runs; the authority holds the stop path; the representatives saw the requirement set before publication; and the decision is recorded.

Worked example: Nordvik Region's management-function requirement set for the next ShiftWise release

Illustrative. After the revised risk assessment WRA-NR-HC-01 and the decision-rights file DRF-NR-01, Ingrid Halvorsen and the head of procurement adopt a requirement set for management functions. It applies first as the Region's conditions for accepting the next major ShiftWise release, which the supplier offers under the existing contract before the second home-care wave, and then as the annex to the follow-on tender when the contract under NR-2025-089 ends. Requirements the supplier will not meet under the existing contract, because the contract has no review clause that covers them, move to the follow-on tender. AIDR-0628 records the decision.

# procurement/NR-PRQ-MGT-01.yaml (illustrative)
id: NR-PRQ-MGT-01
version: 1.0.0
decision_record: AIDR-0628
date: 2027-05-20
owner: Ingrid Halvorsen, HR director
co_owners: [head of procurement, AI governance lead]
negotiated_with: [union for nurses and midwives, union for municipal and care workers]
consulted: [central work-environment committee, data protection officer]
applies_to:
  - acceptance of next major ShiftWise release under NR-2025-089
  - annex to follow-on tender
delegation_profile: DLG-NR-ROS-01
requirements:
  - {id: R1, type: specification, basis: "Dir 2014/24 Art 42; Dir 89/391 Art 9(1)(b)",
     text: "WRA-NR-HC-01 constraints C1 to C4 and weekly rest enforced as feasibility conditions, never as penalties",
     verify: "Region seeded-breach suite, 12 breaches per release, zero may reach a manager"}
  - {id: R2, type: specification, basis: "AI Act Art 14(4)(e); F19",
     text: "Technical stop held by the Region, effect within 1 hour, manual fallback",
     verify: "quarterly stop drill with supplier participation"}
  - {id: R3, type: specification, basis: "AI Act Art 26(6)",
     text: "Log every roster, route, offer and override with rule and model version; retain 24 months; export in documented open format",
     verify: "export test at acceptance"}
  - {id: R4, type: specification, basis: "AI Act Art 86; F31",
     text: "Per roster and offer, main factors and constraints applied, readable by unit manager for the MDR",
     verify: "five contested rosters explained at acceptance"}
  - {id: R5, type: specification, basis: "Dir 2000/78 Art 10; Dir 2006/54 Art 19; AI Act Art 10(2)(f)",
     text: "Outcome export by contract type, sex and age band for DIT-NR-ROS-01; provider bias examination delivered",
     verify: "test run on Region data"}
  - {id: R6, type: specification, basis: "Work Environment Act ch 6 s 6a",
     text: "Read-only unit-level strain indicators for safety representatives and unions",
     verify: "access granted before go-live"}
  - {id: R7, type: specification, basis: "DLG-NR-ROS-01",
     text: "Degree of delegation per function set by the Region and logged; new features that assign, score or flag people arrive disabled",
     verify: "configuration audit per release"}
  - {id: R8, type: award_criterion, basis: "Dir 2014/24 Art 67(2) and (4)",
     weight_percent: 30, text: "Quality of R1, R4 and R6 scored from demonstration on Region test data"}
  - {id: R9, type: contract_condition, basis: "Dir 2014/24 Art 70",
     text: "60 days notice of release with change log of objectives and constraints; right to audit; Art 49 registration evidence"}
  - {id: R10, type: review_clause, basis: "Dir 2014/24 Art 72(1)(a)",
     text: "Defined procedure for adding or changing management functions, with Region approval and union negotiation"}
excluded: [Level 4 Autonomous for any M3 Consequence function, emotion inference, individual ranking of staff]

R1 answers, with a test result rather than a supplier statement, the question tender NR-2025-089 did not ask. R2 puts the stop path where F19 says it must be. R10 makes the next change to the system a contract procedure that includes the unions, not a release note. The weight and the retention period are illustrative and should follow the authority's procurement practice and archives law.

Equality testing as a duty written into the delegation profile

A private employer has no procurement law to fix its requirements, but it carries the same burden of proof and can write the duty to test into the artefact that governs the system. Hansa Mutual's TalentLens, used in Poland and Germany at Level 1 Assisted, already monitored selection rates by sex and age band quarterly under version 1.3 of its delegation profile (Chapter 7). Monitoring is not testing: it showed rates, but set no threshold, named no owner of a finding and required no cause, justification or correction. Version 1.4 makes the equality test an obligation of the profile, so that no release of the model and no change of selection criteria can take effect without it.

Worked example: The equality-test obligation in DLG-HM-REC-01

Illustrative. The excerpt shows the block added to the delegation profile in version 1.4; the rest of the profile is unchanged from version 1.3. AIDR-0678 records the chief HR officer's decision, with the group data protection officer and the Konzernbetriebsrat's IT committee as reviewers.

id: DLG-HM-REC-01
system: TalentLens
version: 1.4
changed_by: AIDR-0678
change_date: 2027-03-31
change_summary: equality testing made a release condition; proxy checks added
equality_testing:
  test_id: DIT-HM-REC-01
  owner: Group chief HR officer
  operator: Group HR analytics
  reviewers: [Konzernbetriebsrat IT committee, group data protection officer]
  legal_basis:
    - "Directive 2000/78/EC Articles 2(2)(b) and 10"
    - "Directive 2006/54/EC Articles 2(1)(b) and 19"
    - "AGG sections 3(2) and 22"
    - "AI Act Article 10(2)(f) and (g), provider evidence required by contract"
  stages: [cv_ranking, shortlist, interview_score, offer]
  markets: [PL, DE]
  groups:
    attributes: [sex, age_band]
    proxy_checks: [cv_gap_over_12_months, part_time_preference_stated]
    special_categories: none collected for testing
    min_cell_size: 30
  metric: selection_rate_ratio
  trigger_if_lower_bound_below: 0.80
  run_on: [new model version, change of HR-REC-CRIT-2026-01, quarterly]
  release_condition: no release or criteria change takes effect until the test has run and every trigger has a recorded cause and decision
  on_trigger:
    - suspend use of the affected ranking stage in the market within 5 working days
    - recruiters read all affected applications without the ranking
    - cause and justification assessed by owner; Konzernbetriebsrat informed within 10 working days
  provider_evidence: Article 10 bias examination per model version, delivered before release
  retention_years: 3
  reporting:
    works_bodies: full results to Konzernbetriebsrat and, in PL, company trade union organisation and employee council
    applicants: annual summary on careers site

A gap of more than twelve months in a curriculum vitae and a stated preference for part-time work are not protected characteristics, but either can put women at a particular disadvantage, and a ranking that penalises them must be justified as appropriate and necessary or changed. The release condition gives the burden of proof something to rest on: the group can produce the test that ran on the version in force and the decision taken on its result. The threshold, cell size and retention period are illustrative and belong in the selection-criteria guideline the Konzernbetriebsrat co-determines under BetrVG § 95.

Q10 and Q11

Q10. A public authority remains a model employer when it procures the AI boss by securing in the procurement the means to meet duties it cannot hand over, and by using them afterwards. Legality and objectivity bind everything it does, the equality and safety directives bind it as any employer, and the AI Act adds an impact assessment and registration. None of these can be met with a supplier's assurance, because each needs evidence the authority itself can produce for a worker, a union, a court or an elected committee. The answer is a requirement set, tested at acceptance and on every release, that keeps the logs, the stop path, the constraint tests, the outcome data and the configuration of delegation in the authority's hands, together with a practice of reasons and review that goes beyond what administrative law strictly requires of an employer. This is the chapter's conclusion from the duties set out above.

Q11. Nothing replaces the manager's judgement in the duty of care, and the law does not ask anything to. Safety law requires the employer to assess risks, take measures and consult; it does not require a system to notice a person in difficulty. A system can carry the protective part of M5 Care: hard constraints at Level 3 Bounded, flags at Level 1 Assisted to a named person, and strain indicators at team level for the manager and the safety representative. It cannot carry the attention of a manager who knows the team and has time to use it. The duty of care therefore becomes a requirement on the organisation: spans of control that let managers see their people, safety representatives with access to the indicators and the right to require an investigation, and a stop path someone can use when a pace is wrong. Delegating nothing in M5 Care to AI is not the same as meeting the duty, because a system that directs work under M1 Direction sets a pace the duty of care must assess.

What is observable and what is expected

The directives and national acts cited here are observable law; the transposition deadlines of the Pay Transparency Directive (7 June 2026) and the Platform Work Directive (2 December 2026) are fixed, but the state of transposition must be checked per member state before relying on a national act. That labour inspectorates will inspect algorithmic direction as a work-environment risk is expected. That discrimination claims about management systems will turn on the employer's own outcome data is expected on the logic of the burden of proof; how often such claims will be brought is not yet observable. That public buyers will converge on common requirement sets for management systems is speculation.

Across the degrees of delegation

Degree of delegation	Safety and health	Equality	Public employer and procurement
Level 0 Advisory	Manager sets pace; risk assessment covers the advice	Score frames judgement; test outcomes of decisions taken	Register the system; reasons given by the manager
Level 1 Assisted	Flags go to a named person with a time limit	Record departures from the recommendation	MDR with the manager's own reasons; internal review
Level 2 Supervised	Approver sees which constraints bind	Test approvals by group, not only outputs	Explanation per output required in the contract
Level 3 Bounded	Protective rules as feasibility conditions with seeded tests	Disparate-impact test on every release	Bounds set by the authority, logged, changeable only by review clause
Level 4 Autonomous	Not used; protective blocks stay at Level 3 Bounded	Not used for M3 Consequence	Excluded in the requirement set

The usage mode decides where the evidence comes from: for a procured Mode 4 Built AI applications system such as ShiftWise, only from the contract; for a built one, from the employer's repository; for a feature in licensed software, Mode 0 Ambient AI, only once someone has found and registered it.

Nordvik Region and Hansa Mutual

Nordvik Region is a public employer accountable to elected politicians, and its ShiftWise contract predates the questions of this book. Its central work-environment committee treats every change to ShiftWise routes as a change in the activity that needs a risk assessment, and NR-PRQ-MGT-01 under AIDR-0628 carries the resulting constraints, the stop path, logs, explanation, union access and equality evidence into the acceptance of the next release and the follow-on tender. For Nordvik, M5 Care is the job itself: a home-care route that cannot be worked harms the resident as well as the assistant nurse. Its equality question, access to open shifts by contract type, is answered by the review DIT-NR-ROS-01 of Chapter 12 as part of the Region's active measures.

Hansa Mutual is a private employer in seven jurisdictions. It writes the equality duty into DLG-HM-REC-01 version 1.4 under AIDR-0678 and extends the same discipline to the sales-performance score, which feeds variable pay and so falls within the pay-transparency reporting that its EU entities with 250 or more workers owe from 7 June 2027 under national acts transposing Directive (EU) 2023/970. The complaints indicator that CNT-HM-0001 exposed differs by market and may disadvantage part-time sales staff, so it must be stated as a criterion workers can read and shown to be gender neutral. Hansa has delegated nothing in M5 Care to AI, but the claims-triage agent sets the pace of Jana Petersen's team at Level 3 Bounded, so its allocation rules need the assessment of psychological stress under section 5 of the Occupational Safety and Health Act, with health-protection rules co-determined under BetrVG §87(1) no. 7. Nordvik must buy its evidence; Hansa must build it.

Summary

Three bodies of law older than the algorithms bind the employer that uses an AI boss. Safety and health law keeps the duty with the employer whatever it procures, requires risk assessment and consultation before every material change to algorithmic direction, and turns working-time rules and risk-assessment findings into constraints that must hold as feasibility conditions, not penalties. Equality law prohibits indirect discrimination through apparently neutral rules, the main risk of proxies, and shifts the burden of proof to the employer once a disparity is shown, so a disparate-impact test on every release becomes the employer's evidence; the Pay Transparency Directive makes any score that feeds pay a criterion that must be stated and gender neutral.

The chapter concerned M5 Care, where the duty of care is written into law and cannot be delegated, and M3 Consequence, where pay, promotion, hiring and access to work turn unequal treatment into harm, and touched M1 Direction wherever a schedule or allocation rule sets the pace.

A public authority carries further duties: legality and objectivity throughout, reasons and appeal for part of what it decides, an impact assessment and registration under the AI Act, and accountability to elected bodies; the mechanisms of the automated state have employer forms. Procurement under Directive 2014/24/EU is the decisive moment, because specifications, tested award criteria, performance conditions and review clauses decide whether the authority will hold the evidence its duties require. The answer to Q10 is to keep that evidence in the authority's hands and to give reasons beyond the legal minimum; the answer to Q11 is that systems can carry protective constraints and flags, while managers and safety representatives need the time and access to exercise the rest.

Chapter 25 opens Part VI by turning these duties into the book's central artefacts: the Management Decision Record and the delegation register of management functions.

Sources

1. Council of the European Communities (1989). Council Directive 89/391/EEC on the introduction of measures to encourage improvements in the safety and health of workers at work. Official Journal of the European Communities. (49, Council of the European Communities, 1989)
2. Council of the European Union (2000). Council Directive 2000/78/EC establishing a general framework for equal treatment in employment and occupation. Official Journal of the European Communities. (54, Council of the European Union, 2000)
3. European Parliament and Council of the European Union (2003). Directive 2003/88/EC concerning certain aspects of the organisation of working time. Official Journal of the European Union. (50, European Union, 2003)
4. European Union (2012). Charter of Fundamental Rights of the European Union. Official Journal of the European Union. (48, European Union, 2012)
5. European Parliament and Council of the European Union (2024). Directive (EU) 2024/2831 on improving working conditions in platform work. Official Journal of the European Union. (47, European Union, 2024)
6. Sveriges riksdag (1977). Arbetsmiljölag (1977:1160). (75, Sveriges riksdag, 1977)
7. Arbetsmiljöverket (2023). AFS 2023:2 Planering och organisering av arbetsmiljöarbete – grundläggande skyldigheter för dig med arbetsgivaransvar. Swedish Work Environment Authority. (84, Arbetsmiljöverket, 2023)
8. Federal Republic of Germany (1996). Arbeitsschutzgesetz (ArbSchG) (Occupational Safety and Health Act), § 5. Gesetze im Internet. (227, Germany, 1996)
9. Federal Republic of Germany (2001). Betriebsverfassungsgesetz (BetrVG) (Works Constitution Act). Gesetze im Internet. (9, Germany, 2001)
10. International Organization for Standardization (2021). ISO 45003:2021 Occupational health and safety management – Psychological health and safety at work – Guidelines for managing psychosocial risks. ISO. (83, ISO/IEC, 2021)
11. Council of the European Union (2000). Council Directive 2000/43/EC implementing the principle of equal treatment between persons irrespective of racial or ethnic origin. Official Journal of the European Communities. (55, Council of the European Union, 2000)
12. European Parliament and Council of the European Union (2006). Directive 2006/54/EC on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation (recast). Official Journal of the European Union. (56, European Union, 2006)
13. Federal Republic of Germany (2006). Allgemeines Gleichbehandlungsgesetz (AGG) (General Act on Equal Treatment). (74, Germany, 2006)
14. Sveriges riksdag (2008). Diskrimineringslag (2008:567) (Discrimination Act). (76, Sveriges riksdag, 2008)
15. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (1, European Union, 2024)
16. European Parliament and Council of the European Union (2023). Directive (EU) 2023/970 to strengthen the application of the principle of equal pay for equal work or work of equal value between men and women through pay transparency and enforcement mechanisms. Official Journal of the European Union. (57, European Union, 2023)
17. Sveriges riksdag (1974). Regeringsformen (Instrument of Government), SFS 1974:152, Chapter 1, section 9. (240, Sveriges riksdag, 1974)
18. Sveriges riksdag (2017). Förvaltningslag (2017:900) (Administrative Procedure Act). (239, Sveriges riksdag, 2017)
19. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (41, Nordqvist, 2026)
20. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI). Official Journal of the European Union. (2, European Union, 2026)
21. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (44, Nordqvist, 2026)
22. District Court of The Hague (2020). Judgment of 5 February 2020, NJCM et al. v. the State of the Netherlands (SyRI), ECLI:NL:RBDHA:2020:1878. (192, District Court of The Hague, 2020)
23. Tweede Kamer der Staten-Generaal, Parlementaire ondervragingscommissie Kinderopvangtoeslag (2020). Ongekend onrecht. (191, Tweede Kamer, 2020)
24. Alon-Barkat, S. & Busuioc, M. (2023). Human–AI Interactions in Public Sector Decision Making: "Automation Bias" and "Selective Adherence" to Algorithmic Advice. Journal of Public Administration Research and Theory. (179, Alon-Barkat & Busuioc, 2023)
25. European Parliament and Council of the European Union (2014). Directive 2014/24/EU on public procurement. Official Journal of the European Union. (8, European Union, 2014)
26. European Commission (2023). EU model contractual AI clauses to pilot in procurements of AI. Public Buyers Community. (39, European Commission, 2023)
27. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (43, Nordqvist, 2026)