GASP AICF

Search controls and profiles

Search by control ID, name, domain or profile

AIG-044 Workplace AI Deployment Notification to Workers

Tier 2+AIhigh-risk-annex-iii

Description

For each AI system put into use at a workplace, a notification record exists that names the system, the work it is used for, the workers and worker groups within its reach and the date the notification was made. The record pre-dates the deployment record for that workplace. It shows the route the notification took to the workers' representatives recognised at that site and to the affected workers themselves, and that route is the information and consultation procedure the organisation's own agreements or the applicable employment rules set. A change that brings new workers or new work within the system's reach produces a further notification record before the change takes effect.

Rationale

The notice is owed before the system is applied to people, not after, because it is what lets a representative raise a point while the decision can still move. The route is the information and consultation machinery an employer already has, a works council, a recognition agreement or the national procedure, so the control asks for a record of that route being used rather than for a new channel. The record carries the route and the date because those are the two things an assessor cannot reconstruct later. Boundary with AIG-016: that control informs the person in front of the system and the person a decision is about, at the moment it happens. This one informs a workforce, including representatives who may never use the system, before it is put into use. Deployer seat (ADR-031). Where the description of the system in the notice comes from the provider, it is obtained with the instructions for use under AIG-032 and AIG-034.

Applicability (9 profiles)

SaaS AI Providerstablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

Enterprise AI Deployerstableconditionalrisk class duty

Condition: ai_risk_class in high-risk-annex-iii and the system is used at a workplace

Art.26(7) binds a deployer that is an employer, before the system is put into use at the workplace. The audience is the recognised representatives and the workers within the system's reach, through the information and consultation route the organisation's own agreements or the applicable employment rules set. Where the description of the system in the notice comes from the provider it is obtained under AIG-032 and AIG-034.

GPAI Model Providerstablenot-applicableout of scope

Deployer-seat duty (enterprise-ai-deployer).

High-Risk Provider (EU)stablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

Public Body Deployer (EU)stableconditionalrisk class duty

Condition: the system is used at a workplace

Art.26(7) binds a deployer that is an employer, before a high-risk system is put into use at the workplace: the workers' representatives recognised at that site and the affected workers are informed through the information and consultation route the organisation's agreements or the applicable employment rules set. A public authority is an employer like any other, so this clause binds neither of the two seats the profile is built on and the row stays conditional. The condition drops the risk-class clause the base carries, since every system in this profile is Annex III high-risk; the phrase left standing is the one the assess_scope evaluator reads.

Data Act Cloud Provider (EU)stablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

DORA ICT Provider (EU)stablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

HIPAA Business Associate (US)stablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

NIS2 Cloud Provider (EU)stablenot-applicableout of scope

Worker notification before a system is put into use at a workplace is an employer's duty under Art.26(7). A provider placing the system on the market owes it for its own workforce only where it is also the deployer, which is the enterprise-ai-deployer seat.

Framework Mappings (2)

EU-AI-Art.26.6Deployer Obligations — Worker Notificationfull
A.8.5Information for interested partiesinformative

Evidence (2)

recorddocumentmanual

Notification record for a named workplace deployment, giving the system, the work it is used for, the worker groups within its reach, the date and the route the notice took to representatives and to affected workers.

Example: Works council notification pack for the CV screening assistant at the Dublin site, issued 4 February 2026, with the consultation meeting minute of 18 February 2026 attached.

Test: Verify: (1) the notification date is earlier than the date the system was first used at that workplace, (2) the record names the worker groups within the system's reach rather than the organisation as a whole, (3) the route named is the procedure the organisation's agreements or the applicable employment rules set, and the record shows it was used rather than described, (4) both audiences are evidenced: a receipt, minute or acknowledgement from the representatives and the communication sent to affected workers.

system_exporttechnicalautomated

Export from the AI system inventory or the deployment register listing each workplace deployment with its first-use date, its notification date and the date of the last notification raised by a change of reach.

Example: Inventory export workplace-deployments-2026-06.csv, generated 30 June 2026, covering eleven deployments across four sites.

Test: Verify: (1) every workplace deployment in the export carries a notification date, (2) no notification date falls on or after its first-use date, (3) a deployment whose recorded reach changed since first use carries a later notification date than the change, (4) the deployments in the export reconcile to the sites and systems the inventory holds, with no site carrying deployments and no notification rows.

Questions (3)

boolean

Are workers notified before an AI system is put into use at their workplace?

Answer yes only where a dated record of the notification exists for every such deployment. A general staff announcement about AI adoption, or a notice sent once the system was already running, is a no. If the organisation operates no AI system that reaches workers at a workplace, the control does not apply to it and the profile condition says so.

multi

Which of the following does the notification record carry?

The system and the work it is used forThe worker groups within the system's reachThe date the notification was madeThe route it took to the workers' representativesEvidence that affected workers themselves received itA further notification when the system's reach changedNone of the above

Options follow the order the record is normally assembled in, not an order of importance. Tick an element only where it is in the record itself; a practice everyone follows but nothing captures does not count here.

select

What route does the notification take to workers' representatives?

The information and consultation procedure set by a works council or recognition agreement, with the outcome minutedThe information and consultation procedure required by applicable employment rules, with the notice acknowledgedA direct communication to named representatives, with a receipt keptA general staff communication with no representative stepRepresentatives are not notified

Options run from the most formal route to the least. Answer on what the last deployment actually used rather than on what the procedure describes. The first two options differ only in where the obligation comes from, an agreement or the law, and both are complete answers.