EDPB and EDPS flag gaps in AI omnibus for employment AI

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) published a joint opinion in January 2026 that raises substantive questions about proposed ‘digital omnibus’ amendments and how high‑risk AI rules will be implemented for employment uses.

Dated 28 January 2026, the joint opinion evaluates the European Commission’s draft changes and highlights gaps and ambiguities in the proposal’s treatment of systems listed in Annex III — explicitly naming employment, hiring and workplace monitoring as categories that should be subject to robust risk‑mitigation and enforcement. The regulators press for clearer definitions, stronger oversight mechanisms and better alignment with existing data‑protection obligations.

The opinion pinpoints several recurring issues for employers and HR technology vendors. The EDPB and EDPS ask how national data protection authorities will interpret the scope of “high‑risk” when people‑analytics, automated CV screening and continuous workplace surveillance are involved, and whether the proposed text provides sufficient clarity on which actor (vendor, controller, or processor) carries responsibility for compliance steps such as data‑protection impact assessments (DPIAs), record keeping and demonstrable accuracy testing.

The regulators also call for concrete guidance on enforcement tools and sanctions. The joint document stresses that simply labelling a system as high‑risk is insufficient without clear procedures for market surveillance, coordinated supervisory action and proportionate penalties where obligations are breached. That point matters to HR teams because the practical difference between advisory guidance and enforceable requirements will shape procurement decisions and rollout timetables for screening and monitoring technologies.

Contextually, the opinion lands amid growing scrutiny across Europe of automated decision‑making at work. Employers have accelerated use of people analytics, automated résumé screeners and remote‑monitoring software since the pandemic, while national data protection authorities and courts have been incrementally tightening expectations for transparency, fairness and data‑minimisation. The EDPB and EDPS note that inconsistent interpretation across Member States risks fragmenting the single market for HR technology and creating legal uncertainty for pan‑European deployments.

For vendors that sell applicant‑tracking systems, scheduling algorithms or productivity monitoring suites, the opinion signals tougher documentation and audit demands. The regulators emphasise the need for standardised metrics for accuracy and bias testing, clear human‑in‑the‑loop requirements, and obligations to provide meaningful explanations to data subjects — elements that will reverberate through sales contracts, SLAs and compliance checklists.

What the joint opinion does not provide is a timetable or binding checklist for suppliers and employers to follow. It proposes remedies and asks questions but stops short of prescribing detailed technical standards, specifying how supervisory cooperation must be operationalised, or setting transitional periods for already deployed systems. The paper also leaves open how its recommendations will be reconciled with the EU AI Act and with national labour and equality law enforcement priorities.

Looking ahead, HR leaders and vendor product teams should expect follow‑up consultations and likely amendments to the omnibus text as the Commission and Member States respond to the regulators’ comments. The joint opinion makes clear that future compliance will demand greater evidentiary discipline from both vendors and employers: documented DPIAs, independent bias audits and clearer contractual allocation of responsibilities will increasingly be business as usual rather than optional extras.