The invisible threat of digital compliance

There's no awareness among companies that this modern, seemingly innocuous personnel management software is putting them in the crosshairs of the Spanish Agency for the Supervision of Artificial Intelligence (AESIA).

The newly created AESIA, hidden behind seemingly laudable objectives—thanks to extensive marketing—is patiently preparing to begin its hunt.

We saw this before with the Spanish Data Protection Agency (AEPD), which started out as that clueless kid in school you could ignore and slap simultaneously without the paradox shattering your childish logic, and ended up becoming the neighborhood bully who made your knees tremble when you crossed paths with him, forcing you to hand over your lunch and the few coins your mother gave you as your weekly allowance for a donut after school.

With AESIA, history is repeating itself. It's there. Almost no one knows it, but it's there. Hidden away in Galicia, and waiting to find a permanent headquarters, it's gradually dedicating its small budget to increasing its staff and producing informational articles on its website. At least, that's what it shows… for now. Because there will come a time when, as happened with the Spanish Data Protection Agency (AEPD), it will have to survive thanks to the revenue from the fines it imposes, and there will be a new bully in the neighborhood.

And the victims? Well, there will be all kinds: AI system developers, companies that internally implement AI-based software, manufacturers that incorporate AI into their products… It doesn't matter if they are large entities or small startups.

Very likely, developers will become aware sooner rather than later of the tsunami of obligations imposed on them by the European AI Regulation (AI Act) and will end up incorporating it into their production processes, as it is essential for their business and survival. However, companies planning to implement AI in their internal processes, especially in human resource management, are more concerned with not falling behind and jumping on the bandwagon of this new technology so they can boast on LinkedIn that they are modern, disruptive, and innovative, than with complying with any obligations or regulations.

And the truth is, companies are unaware that this modern and seemingly innocuous personnel management software is putting them in the crosshairs of the Spanish Agency for International Cooperation in Information Society (AESIA). It doesn't matter if the tool is designed to improve employees' working conditions, enable fairer decision-making, facilitate personal recognition, or improve the work environment. Because for the European AI Regulation, and for AESIA as the body responsible for ensuring its compliance in Spain, AI is perceived as a danger. It's irrelevant whether its use is intended for a laudable and plausible purpose; it is always, without exception, a risk.

It's undeniable that the trend of using AI-based technology programs is here to stay in businesses. We can talk about tools designed for recruitment processes, which facilitate the analysis of resumes to select or reject candidates. We can talk about systems for monitoring and managing employee emotions, aiming to improve their well-being at work. We can talk about programs that help middle and upper management organize shifts and work rhythms. We can talk about software that facilitates decision-making for human resources managers on sensitive and important issues such as promotions and salary increases.