Algorithms and AI in HR: what Spanish employers must tell their staff from 5 October 2026

Since 5 October 2026, companies in Spain must put in writing what they tell staff about the algorithms that decide on their working conditions. Informing employees about algorithms is now an individual duty. It covers any algorithmic or automated system that decides on working time, shifts, tasks, pay, promotion, place of work or dismissal. Saying that the system exists is not enough: employers must also explain the guidelines, criteria and rules it follows. The source is Article 3.2(k) of Royal Decree 723/2026.

Employers must provide the information before employment starts. For existing contracts, the employer has 30 working days from the employee’s request. In addition, this individual duty sits on top of three other layers: works council information rights, the GDPR and the EU AI Act. So one point is worth making early: the delay of the AI Act’s high-risk obligations to 2027 does not delay any of the others.

What does Royal Decree 723/2026 require on algorithms?

Royal Decree 723/2026 requires employers to tell each employee, in writing, whether algorithmic or automated decision-making systems are in use. When those systems decide on working conditions, the information must explain how they work. The decree transposes Directive (EU) 2019/1152 on transparent and predictable working conditions. However, letter (k) does not come from that Directive. It is a Spanish addition that the preamble links to the EU AI Act.

What Article 3.2(k) says

In our translation, Article 3.2(k) requires information on:

“The existence of algorithmic or automated decision-making systems. This shall include the guidelines, criteria and operating rules of those systems when they are used to take decisions on determining, setting, varying or modifying working conditions, such as the duration and distribution of working time, task allocation, pay, career progression, place of work or termination of the contract.”

Two details matter. First, the text says “algorithmic or automated“, so the duty does not require artificial intelligence. Second, the list is open (“such as”), so it may also reach other working conditions.

When the information must be provided

• New hires: before employment starts (Article 7.1).
• Contracts in force on 5 October 2026: within 30 working days of the employee’s request, unless they already have it (sole transitional provision).
• Changes to the system: as soon as possible and no later than the day the change takes effect (Article 7.3).

That last point is easy to miss. Suppose that, after 5 October, you install shift-planning software or change its rules. In that case you must also inform existing staff. Moreover, you do not wait for a request: the transitional provision refers back to the Article 7.3 deadline.

Who it applies to and in what format

It applies to all employers, with no headcount threshold, for employment relationships longer than four weeks. Special rules apply to fishers, seafarers, special employment relationships and public employees (Article 2). The information can go in the contract or in a separate document. It may be on paper or electronic, as long as the employee can store and print it. The employer must also keep proof of delivery (Article 6).

What counts as an “algorithmic or automated system”?

For the purposes of Royal Decree 723/2026, an algorithmic or automated system is any tool that applies rules or models to set or change a working condition. The key is that no person works out the result case by case. What matters is whether the system decides or shapes the decision, not which technology it uses.

In practice, the line is not always obvious. This is the classification we use in our reviews. It is Auratech’s interpretation, not official guidance:

If you are unsure about a tool, ask one question: would anything change for the employee if the system produced a different result? If the answer is yes, informing is the prudent choice. For biometric clocking, see our analysis of fingerprint time tracking.

Four layers of transparency that apply at the same time

Informing employees about algorithms does not end with Royal Decree 723/2026. When a company uses an automated system to manage people, four different sets of rules meet. Each has its own audience, timing and content.

The collective layer: the works council

Article 64.4(d) of Spain’s Workers’ Statute comes from the so-called “Rider Law” (Royal Decree-law 9/2021, later passed as Law 12/2021). It gives the works council the right to know the parameters, rules and instructions behind algorithms or AI systems. This covers systems that affect working conditions and access to or retention of employment, including profiling.

This right is not theoretical. In judgment 101/2025 of 4 July, Spain’s National High Court found that a contact-centre company had breached freedom of association. The company had refused to explain to the union, through its delegates, the system it used to assign days off. The court ordered it to pay 6,250 euros and to provide the information. Note that union delegates have the same information rights as the works council.

The data protection layer

A system that decides on employees processes personal data. Therefore, the GDPR requires employers to disclose Article 22 automated decisions and give meaningful information about the logic involved (Articles 13.2(f) and 14.2(g)). Outside that case, explaining the logic is still good practice. In addition, Article 22 protects people from decisions based solely on automated processing. It applies when the decision has legal effects or similarly significant effects, such as a dismissal or a refused promotion.

Furthermore, using new systems to assess people at work will often require a data protection impact assessment (Article 35). The Spanish DPA’s list includes, among others, evaluating people (including work performance), automated decision-making and the use of new technologies. When two or more criteria apply, you will need a DPIA in most cases. In HR, several usually overlap. If you already have an employee privacy notice, review it: it probably does not mention these systems. Our data protection advisory service usually starts there.

The AI layer: what applies now and what arrives in 2027

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, changed the timetable. It moved the obligations for Annex III high-risk systems to 2 December 2027. Annex III covers systems used to recruit, decide on promotion or dismissal and assess performance. It also covers systems that allocate tasks based on individual behaviour or personal traits. From that date, Article 26.7 will require employers to inform representatives and affected staff before deploying such a system.

However, the delay does not cover everything. The Article 5 prohibitions already apply, including the ban on emotion recognition in the workplace except for medical or safety reasons. Article 4 also applies now. After the Omnibus, it requires providers and deployers to take measures to support the AI literacy of the staff who use these tools. It no longer requires a guaranteed level, but it does require action. Documented staff training is the simplest way to show it.

What did the Spanish DPA say about AI in recruitment?

On 23 September 2026, the Spanish Data Protection Agency (AEPD) publicised its warning AI-00009-2026. The AEPD addressed it to a company planning to use AI to screen and score CVs for recruitment and internal mobility. The system was not yet live. For that reason, the AEPD acted preventively under Article 58.2(a) GDPR.

The AEPD reminded the company of these safeguards:

• Data protection by design and by default, from the earliest stages.
• A data protection impact assessment where the processing could involve high risk.
• Clear information about the processing and the tool’s role.
• Effective human involvement: the decision-maker must critically assess the output and not simply adopt the score.
• Compliance with Article 22 GDPR and appropriate technical and organisational measures.

It is a warning, not a fine. Even so, it signals the standard the AEPD will apply. If your company uses AI with external candidates, see also our article on using LinkedIn CVs in recruitment.

Do you have to explain the whole algorithm?

No. When informing employees about algorithms, the decree asks for the “guidelines, criteria and operating rules”. It does not require source code or the internal parameters of a machine-learning model. Instead, you should explain which variables the system uses and their relative weight. The aim is for employees to understand what data is used, what factors count and what the result can mean for them.

The Spanish Ministry of Labour’s guide “Algorithmic information in the workplace” (May 2022, in Spanish) includes a useful questionnaire. For example, it asks which decisions are automated, which variables the system uses and how much weight each one has. It also asks about the rules and instructions and whether qualified human involvement exists. It is not binding, but it is the best benchmark for the level of detail.

The guide states that information under the GDPR and Article 64.4(d) does not mean handing over source code. It is reasonable to apply the same approach to Royal Decree 723/2026, which came later. Separately, trade secrets may limit disclosure of the technical implementation. By contrast, they do not justify withholding the logic of the decision.

What is “effective” human involvement and how do you prove it?

Human involvement is effective when the decision-maker can depart from the system’s output. That requires authority, information and time, and using them when appropriate. Someone signing off whatever the machine proposes is not enough.

To prove it, we recommend three simple pieces of evidence:

1. A written procedure stating who reviews, what they review and on what criteria they can override the result.
2. A log of decisions where the reviewer departed from the system’s proposal.
3. Specific training for reviewers on the tool’s limitations and biases.

A log with no overrides at all is a warning sign. It usually means the review is a formality rather than real.

What should you require from your HR software provider?

Very few small companies build their own algorithms. Most buy HR, rostering or recruitment software. Even so, the employer remains responsible for informing employees about algorithms. To do that, it needs information from the provider.

• A data processing agreement under Article 28 GDPR. If you do not have one, check what a data processing agreement must include.
• Functional documentation of the system: inputs, variables, decision logic and outputs.
• Advance notice of changes to rules or models, so you can meet the Article 7.3 deadline.
• Information on bias testing and on the human oversight features the tool supports.

This is where things usually get stuck. That is why the inventory and supplier review are often the first task for an external data protection officer. It happens almost every time a company brings AI into HR.

Step by step: informing employees about algorithms

1. Build an inventory of tools involved in working time, tasks, pay, promotion, place of work or dismissal.
2. Prepare a sheet for each system: purpose, inputs, criteria, output and who reviews.
3. Draft the clause or annex for new hires.
4. Set up a procedure to answer existing staff within 30 working days.
5. Inform the works council, if there is one, under Article 64.4(d).
6. Update your privacy notice and your record of processing activities.
7. Decide and document whether a DPIA is needed.
8. Review your contracts with software providers.
9. Set the human review protocol and its log.
10. Train the team that uses the tools (Article 4 of the AI Act).
11. Keep proof of delivery: who received which version and when.

Three practical cases

A restaurant chain that builds rotas with software

The program allocates shifts based on forecast sales, declared availability and hours worked. In this case, the employer must tell each new hire about those three criteria and how the system breaks ties. If the provider adds a new variable, the employer must tell all staff and the works council as soon as possible, and no later than the day it applies. Be careful with variables such as absenteeism: if it includes sick leave, the system may be discriminatory.

A consultancy using a scoring tool in recruitment

For external candidates, the GDPR and the AEPD’s position apply. In addition, the AI Act will apply from December 2027. However, if the company uses the same tool for internal mobility, Article 3.2(k) also applies, because it affects the career progression of someone who is already an employee.

A sales company that calculates commissions in a spreadsheet

There is no AI, but there is an automated system setting variable pay. Moreover, Article 3.2(f) already requires explaining how variable pay is calculated. Therefore, the rules must appear in the written information. Usually, describing the formula in plain language is enough.

Frequently asked questions

Since when must employers inform employees about algorithms?

The individual duty has applied since 5 October 2026, when Royal Decree 723/2026 came into force. The works council’s right to information has existed since 2021 under Article 64.4(d) of the Workers’ Statute.

Does it apply if there is no works council?

Yes. Royal Decree 723/2026 creates an individual duty, which does not depend on worker representation. Only the collective layer under Article 64.4(d) needs a works council or delegates.

Does it apply to small businesses?

Yes. The decree sets no headcount threshold. It is enough to have employment relationships longer than four weeks and an automated system that decides on working conditions.

What about employees hired before 5 October 2026?

If they ask, the employer must provide the information within 30 working days. In addition, the employer must communicate any change made after 5 October 2026 without waiting for a request.

Has AI regulation in HR been postponed to 2027?

Only partly. The AI Omnibus moved Annex III high-risk obligations, including employment systems, to 2 December 2027. By contrast, the GDPR, the Workers’ Statute and Royal Decree 723/2026 already apply. Within the AI Act, Article 4 and the Article 5 prohibitions, such as emotion recognition at work, also apply now.

Do I need employee consent to use these systems?

Usually not. At work, consent is rarely freely given and is seldom the right legal basis. What you need is clear information and a valid legal basis. If a decision is fully automated and significantly affects the employee, it is only allowed under the exceptions in Article 22.2 GDPR. You must also guarantee human involvement and the right to contest the decision.

What is the penalty for not informing?

Failing to inform in writing about the essential terms of employment is a minor offence under Article 6.4 of the Spanish Labour Offences and Penalties Act (LISOS), with fines of 70 to 750 euros. Breaching worker representatives’ information rights is a serious offence (Article 7.7), with fines of 751 to 7,500 euros. GDPR fines can come on top, as can compensation for breaching freedom of association, as the National High Court showed.

Who should prepare the information: HR, the DPO or the provider?

Ideally, all three together. HR knows the decisions, the provider knows the system and the data protection officer links both to the GDPR. Without the provider’s documentation, explaining the rules accurately is almost impossible.

In short

Informing employees about algorithms is no longer optional good practice. It is a written, individual duty with deadlines. If your company uses software to decide shifts, pay or promotions, the first step is to know exactly which tools you have and what they decide. From there, the clause, the DPIA and the supplier review become an orderly piece of work. If you want help with that inventory, Auratech does it as part of our external DPO service.

For a broader look at the limits of technological monitoring at work, see our article on workplace monitoring technologies.

Last legal review: 5 October 2026.

This article provides general information and is not a substitute for legal advice on a specific case.