The Invisible Decision-Maker

The Invisible Decision-Maker

What every leader should know about their company’s artificial intelligence – before the new EU rules take full effect in the summer of 2026

Ask yourself one question: exactly how many pieces of software in your company today make – or prepare – decisions about people using artificial intelligence? Most executives don’t know the answer. And that, in itself, is the risk.

AI is no longer the future. It sits inside the recruitment tool that pre-screens CVs, the system that ranks candidates, the performance-review module, the shift-scheduling algorithm. These are often not introduced by a deliberate leadership decision – a single department simply “tries something” that works and saves time. The problem surfaces later, when it turns out that a decision made in the company’s name was actually produced by a tool no one reviewed – yet the liability still rests with the company.

From the summer of 2026, the core provisions of the EU’s artificial-intelligence regulation (widely known as the AI Act) become fully applicable. This is not an IT matter. It is a leadership matter – and worth addressing now, while it can still be fixed cheaply.

Why is HR the most sensitive point?

AI used in recruitment and people management draws particular scrutiny, because it decides directly about people’s lives: who is invited to interview, who is promoted, whose contract is renewed. For exactly that reason, the rules place such systems in the most tightly governed, high-risk category.

And the stakes are not merely a potential regulatory fine. A poorly configured screening model can quietly, systematically exclude candidates – by gender, age or some other characteristic – without anyone noticing the bias. If that comes to light later, it is not just a legal dispute: it becomes an employer-brand-damaging story that is hard to repair.

“We just bought it from a vendor” – that won’t protect you

A common misconception is that if the company uses an off-the-shelf product from an external developer, liability also rests with that developer. The reality is more nuanced: responsibility is shared, and the chain is long. The developer is responsible for how the system was built; the company using it is responsible for how it fits into and is used within its own processes.

After a faulty decision, the company may be able to turn to its vendor – but towards the affected employee or candidate, it is typically the company that answers first. That is why it becomes a key question what the vendor contracts actually contain: who guarantees transparency, who is liable for biased outcomes, and what documentation the vendor provides so that the system’s operation can be reviewed at all.

“AI literacy” is already expected today

An often-overlooked point: buying the technology is not enough – the people using it also have to understand what it does. The expectation is that staff, especially those who make AI-assisted decisions, are aware of the system’s limitations and can recognise when the machine’s suggestion needs to be overridden.

In practice this is a training and internal-communication task, and its responsibility ultimately rests with leadership. An organisation where colleagues blindly trust the algorithm’s output is just as vulnerable as one where no one understands how a decision was reached.

Human review is not a formality

“There’s a human in the loop” is not enough on its own. If the machine effectively makes the decision and the person merely clicks to approve it, that is not meaningful control. Real review means the responsible person has visibility into the basis of the decision, the professional competence to judge it, and the actual authority to override the machine’s recommendation.

What should a leader do now? – a quick test

Six questions a prepared executive should be able to answer:
1. Inventory – Is there an overview of where the company uses AI to make or prepare decisions?
2. Owner – Is there a named, designated person inside the company who owns the AI systems?
3. Data basis – Do we know what data these systems decide on, and where it comes from?
4. Control – Is there meaningful, not merely formal, human review at critical decision points?
5. Contracts – Do vendor contracts address liability, warranties and transparency?
6. Readiness – Have the people who use these systems day to day received training?

The bottom line

The 2026 deadline is not about compliance paperwork. It is about whether the company knows – and controls – the decisions being made in its name. Those who put their AI systems in order now gain a competitive edge: more predictable operations, a stronger employer brand and calmer decision-making. Those who wait simply accumulate risk.