EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
sometimes described as a “right to explanation”, this entitlement is legally framed as a right of access and transparency rather than full algorithmic disclosure. The obligation concerns intelligibility and practical comprehensibility – not the disclosure of source code or proprietary model architecture. In algorithmic management systems, transparency cannot be reduced to a notice-layer exercise. Where automated or algorithmically influenced evaluations shape professional opportunities, remuneration, access or progression, explanations must enable indi - viduals to understand the rationale and, where appro - priate, to challenge it. Formal human oversight without informational clarity will not satisfy this standard. The AI Act reflects this heightened sensitivity. Its transparency provisions – including obligations to inform individuals when interacting with certain AI systems and to disclose specific high-risk techniques such as emotion recognition or biometric categori - sation – institutionalise a system-level expectation of intelligibility. However, these obligations supplement rather than displace the GDPR’s broader framework of transparency, fairness and proportionality. Where per - sonal data is processed, legitimacy remains anchored in the GDPR. Enterprise AI governance therefore requires dual atten - tion: ex ante risk assessment through robust DPIAs under Article 35, and ongoing compliance with trans - parency, accountability and proportionality principles under Articles 5 and 13–15. In European regulatory practice, transparency is inseparable from legitimacy. It is measured not by the presence of formal disclo - sures, but by whether individuals can meaningfully understand how automated systems structure deci - sions, opportunities and outcomes affecting them. Enterprise AI, algorithmic management and processor exposure The regulatory exposure of enterprise AI systems does not arise solely at the point of automated deci - sion-making. It emerges equally from the institution - al embedding of algorithmic evaluation and AI use across an organisation.
In workforce and enterprise environments, AI systems and agents are not discrete customer-facing tools but embedded components of organisational governance and managerial oversight. They structure recruitment pipelines, allocate tasks, monitor productivity, score performance, prioritise procurement flows and model workforce optimisation. Their function is managerial rather than transactional. Where personal data is processed in such environ - ments, the GDPR analysis extends beyond Article 22 and automated decision-making (as discussed above). Articles 5 and 6, GDPR govern lawfulness, purpose limitation and proportionality. More structur - ally, Article 35, GDPR requires controllers to conduct a data protection impact assessment (DPIA) where processing is likely to result in a high risk to the rights and freedoms of natural persons. Systematic and extensive evaluation of individuals based on automated processing – particularly where combined with large-scale monitoring – is expressly identified as a trigger for DPIA obligations. In work - force contexts, this threshold is frequently met. Con - tinuous monitoring, predictive analytics and perfor - mance modelling operate within an environment of institutional power asymmetry, amplifying the poten - tial impact on individuals’ rights. However, the shift in enterprise AI governance lies not only in Article 22 exposure, but in the scale, persis - tence and organisational centrality of algorithmic use – especially as organisations migrate toward agent- based architectures. What was previously episodic assessment becomes continuous evaluation. What was once advisory becomes embedded into mana - gerial infrastructure. Supervisory authorities have demonstrated particular sensitivity to such deployments. DPIAs in this context must go beyond formal documentation. They require substantive assessment of necessity, proportional - ity, data minimisation and the effectiveness of safe - guards – including meaningful human review mecha - nisms. Where residual high risk remains, Article 36 GDPR may require prior consultation with supervisory authorities before processing commences.
107 CHAMBERS.COM
Powered by FlippingBook