Smartflow for HR governs AI agents that work with employee data. Agents answer questions and prepare changes. Updates to employee records and compensation pause for an HR approver, personal identifiers are redacted before they reach a model, and every step lands in a tamper-evident record that supports the notice and retention rules now in force.
Two kinds of HR agent work
HR agents do two kinds of work, and each carries different obligations.
Changes to records. Updating a title, an address, a manager, a pay rate or a bank account. These are transactions. The risk is an unauthorized or mistaken change, and the control is approval by the person responsible for the record.
Decisions about people. Screening candidates, ranking applicants, allocating work, recommending promotion or termination. These are the uses that AI employment laws target. The risk is a decision no person reviewed, and the controls are notice, human review and records.
What do the rules require?
Each item below is enforceable. Dates are verified as of September 25, 2026.
- EU AI Act, Annex III. AI used in recruitment, promotion and termination decisions, task allocation and monitoring is high-risk. The Digital Omnibus, Regulation (EU) 2026/1744, moved these obligations from August 2, 2026 to December 2, 2027. The ban on emotion recognition in the workplace has applied since February 2, 2025.
- California CPPA regulations on automated decisionmaking technology. For significant decisions, including hiring, allocation of work, compensation, promotion, demotion and termination, the duties apply from January 1, 2027. In some cases an employer can offer a human appeal instead of an opt-out, if the reviewer can interpret the output and has authority to change the decision.
- California Civil Rights Council regulations under FEHA. In effect since October 1, 2025. Discrimination through an automated-decision system violates FEHA, and automated-decision data must be kept for at least four years.
- Illinois Human Rights Act, as amended by HB 3773. In effect since January 1, 2026. Prohibits discriminatory use of AI in employment decisions and requires notice to employees.
- New York City Local Law 144. Enforced since July 5, 2023. Automated employment decision tools require a bias audit and advance notice to candidates and employees.
- Colorado SB 26-189. Replaces the repealed SB 24-205 and takes effect January 1, 2027: notice before use, notice after an adverse decision, three-year record retention, and human review where commercially reasonable.
Across these jurisdictions the requirements converge on three things: a person with authority who reviews, notice to the employee or candidate, and records kept for years.
How does Smartflow apply it?
- Record changes pause for approval. An agent prepares the update. It pauses as an approval ticket, and an HR business partner or compensation owner with approval rights decides, stepping up to re-verify their identity where you require it. Bank and tax changes pause for payroll; the payroll guide covers that flow.
- Decisions keep a reviewer. Smartflow records the input and output of each model call that produces a ranking or recommendation about a person. When the agent then acts on it, advancing or rejecting a candidate through a tool call, the action pauses for a recruiter's approval, so the reviewer's decision sits in the same record as the output they reviewed.
- Personal identifiers stay out of the model. Social Security numbers and other identifiers, such as dates of birth, home addresses and passport numbers, are redacted before a prompt reaches a model. Content that looks like health information can be blocked.
- Records you control. Every decision is hash-chained, time-stamped under RFC 3161, and kept on your infrastructure. You set retention. The audit default is 365 days, so raise it to cover the rules that apply to you, and turn on the WORM archive to write records to Azure immutable blob storage in your account.
| Action the agent prepares | The record captures |
|---|---|
| Change a title, manager or department | Employee, field, before and after, approver |
| Change base pay, bonus or equity | Employee, amount, effective date, approver |
| Change bank or tax details | Employee, change, payroll approver |
| Issue an offer letter | Candidate, role, terms, approver |
| Advance or reject a candidate | Candidate, the agent's output, the recruiter's decision |
| Recommend termination or a performance action | Employee, recommendation, reviewer's decision |
| Export employee data outside HR systems | Dataset, destination, fields, approver |
Answering policy questions, drafting job descriptions and scheduling interviews pass through and are recorded.
What to avoid
Do not let an agent infer emotion or sentiment from employees' messages, voice or video; in the EU that has been prohibited in the workplace since February 2025. Do not let an agent reject a candidate without a recorded human decision. Do not send unredacted employee data to a public model endpoint.
Rollout
- Separate the two kinds of work. List the agent tasks that change records and the tasks that inform decisions about people.
- Redact first. Turn on redaction for employee identifiers before any other policy.
- Choose approvers. Grant approval rights to the HR business partners, compensation owners and recruiters who decide these changes.
- Turn on approvals. Start with compensation and bank details.
- Set retention. Raise Smartflow's audit retention from the 365-day default to the strictest rule that applies to you, four years under California's FEHA regulations, and confirm the period with counsel.
Quick answers
When do the EU AI Act's employment rules apply?
The high-risk obligations for employment uses listed in Annex III apply from December 2, 2027, under Regulation (EU) 2026/1744. The Article 5 prohibitions, including emotion recognition in the workplace, have applied since February 2, 2025.
What counts as human review?
California's ADMT regulations describe a reviewer who can interpret the system's output and has authority to change the decision. Record that person, the output they saw and what they decided. A rubber stamp with no authority does not meet that description.
Can an agent update employee records?
Yes, with approval. The agent prepares the change, an HR business partner or compensation owner approves it, and the record shows both.
Download the full guide
The PDF adds a requirement-by-requirement map across the EU, California, Illinois, New York City and Colorado, the full decision map for HR actions, a rollout checklist, and the questions to ask any vendor that proposes to govern HR agents.
Sources
Verified as of September 25, 2026.
- Regulation (EU) 2026/1744, Digital Omnibus on AI, July 8, 2026; European Parliament legislative train.
- California Privacy Protection Agency, ADMT regulations approved, September 23, 2025.
- California Civil Rights Council, automated-decision systems regulations, June 30, 2025.
- Seyfarth Shaw, Illinois IDHR withdraws proposed AI rules, June 2026.
- NYC Department of Consumer and Worker Protection, automated employment decision tools.
- Colorado Governor's Office, SB 26-189 signing, May 14, 2026; Holland & Knight, SB 189 summary, May 2026.
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs