AI in performance assessment: what can be automated and what should remain human

Artificial intelligence can reduce the operational work of gathering goals, meeting records, indicators and feedback. The problem begins when this convenience turns, without warning, into a performance rating, a promotion recommendation, or a signal that someone should be warned or terminated.

The safest frontier is clear: AI can organize evidence; should not silently assume the manager's responsibility. The greater the effect on pay, career, reputation or continued employment, the more necessary it is to hold an identifiable person responsible for analyzing, justifying and correcting errors.

This separation does not eliminate all legal or organizational risk. It does, however, create a practical starting point for HR, managers, privacy, technology and legal to decide where automation helps and where it drives people decisions.

What really changed on August 2, 2026

On August 2, 2026, the European Commission and national authorities began monitoring new parts of the AI Act. On the same date, transparency obligations came into effect for certain interactive systems and content generated or altered by AI.

The timeline for the high-risk rules, however, has changed. The Digital Omnibus postponed until December 2, 2027 the application of specific obligations to systems classified as high risk — among them, certain uses of AI in recruitment, worker management, monitoring and performance evaluation. The change was adopted because technical standards and inspection structures were still under development.

This does not mean that companies should suspend governance until 2027. Prohibited practices and AI literacy obligations already began to be enforced on February 2, 2025. Furthermore, data protection, labor and non-discrimination standards remain valid regardless of the specific term of the AI Act.

There is also an essential territorial distinction: European regulations do not automatically apply to every Brazilian company. It can reach suppliers and organizations from outside the European Union when they place systems on the European market, use systems in the Union, or when system output is used in that territory. The analysis depends on the concrete operation, not just the location of the matrix.

Organizing information is not the same as evaluating a person

The AI Act classifies risk according to the purpose and actual use of the system. The vendor's trade label—“assistant,” “copilot,” or “productivity tool”—does not alone determine the category.

Systems designed to monitor or evaluate workers, distribute tasks based on individual behavior, or influence promotion, compensation, and termination of the employment relationship may be classified as high risk. The formal presence of a manager at the final stage does not resolve the issue when notes, rankings, alerts or machine recommendations materially influence the result.

On the other hand, the European guidelines present as examples of preparatory or support functions the consolidation of existing records and the revision of the language of assessments already completed by managers, as long as the AI does not alter grades, produce new judgments or influence the decision.

The matrix below is a governance recommendation, not a universal legal mandate. Each use still needs to be analyzed according to country, data processed, employment contract, purpose and impact.

Human supervision cannot be just a click away

Keeping one person on the last screen is not enough. Supervision needs to be effective: the person responsible must understand the role of the system, recognize its limitations, verify the evidence and have the authority to reject or stop its use.

The AI Act calls for high-risk systems to be designed to enable human oversight and reduce the risk of over-reliance on automated results. It also determines that the persons responsible for this supervision have adequate competence, training and authority.

In practice, a human review is meaningful when the manager:

• receives the original records, not just the AI synthesis;
• take the time to check for omissions and contradictions;
• you can disagree without having to justify the decision to the system itself;
• knows the criteria and data that influenced the exit;
• record why you accepted, adjusted or rejected the recommendation;
• personally responsible for the result communicated to the worker.

When the flow encourages automatic approval — for example, hundreds of pre-populated assessments with a “confirm” button — the responsibility remains human on paper, but the decision may have become automated in practice.

Eight controls before using AI in performance evaluation

1. Inventory the uses, not just the tools

The first step is to discover where AI is already present. Automated resources can be embedded in HR platforms, goal systems, productivity tools, video conferencing, internal service and applications contracted directly by managers.

For each use, record:

• declared purpose;
• affected people;
• input data;
• output produced;
• who receives this output;
• decision that she can influence;
• supplier, model and version;
• countries where the result will be used.

The classification must be redone when an originally administrative function starts to generate rankings, recommendations or alerts about people. NIST organizes AI risk management into four continuous functions — govern, map, measure, and manage — reinforcing that the context of use needs to be understood before measurement and control.

2. Define purpose, permitted data and prohibited inferences

Do not hand over all available data to the tool just because it can be processed. Define in advance which information is necessary for the purpose of the assessment and which should be left out of the system.

Private messages, medical records, biometric data, location, union activity, family information, and protected characteristics require rigorous analysis. Even seemingly neutral data can act as approximations of age, disability, gender, origin or health condition.

In the European Union, the use of AI to infer people's emotions in the workplace is prohibited, except for a narrow exception for medical or security purposes. Therefore, tools that promise to identify enthusiasm, stress, sincerity or engagement by voice, face or other biometric signals should not be treated as simple assessment resources.

In Brazil, the LGPD requires purpose, adequacy, necessity, transparency, non-discrimination, security and accountability. The existence of a legal hypothesis for treatment does not exempt compliance with these principles.

3. Establish a formal matrix of decision rights

Internal policy needs to say, in writing, who can:

• activate or suspend the system;
• validate input data;
• consult the original records;
• change an output;
• define the note;
• decide promotion, remuneration or disciplinary measure;
• respond to a dispute;
• authorize new purposes.

Notes, promotions, warnings, improvement plans and dismissals must have a nominal human person responsible. This person in charge needs to have competence and autonomy, not just technical access to the approval button.

The matrix should also prevent automated scoring from becoming an informal requirement. If the manager can theoretically disagree, but is held accountable whenever he disagrees, supervision may not be effective.

4. Control the quality and representativeness of evidence

An accurate summary does not correct an incomplete record. Before using AI, examine whether the data represents the work actually performed and whether all groups are observed under comparable conditions.

Some recurring problems are:

• goals changed without system update;
• collective results attributed to a single person;
• invisible tasks, such as support and mentoring, outside of indicators;
• periods of absence interpreted as low productivity;
• greater volume of records for digitally monitored teams;
• punctual feedback treated as a permanent standard;
• previous evaluations contaminating all subsequent cycles.

The system must show the source and period of each piece of evidence. When there is not enough information, the correct solution is to declare insufficiency — not fill the gap with an inference.

5. Inform workers and managers clearly

Transparency must occur before the relevant use of the tool, and not just after an unfavorable decision.

Communication needs to explain:

• what AI will be used for;
• what data goes into the process;
• what outputs does it produce;
• which decisions can be influenced;
• who accesses the results;
• how long records are kept;
• how to correct data;
• how to ask for clarification or review;
• who remains responsible for the decision.

The AI Act provides, for high-risk systems used at work, prior information to affected workers and their representatives. It also provides clear and meaningful explanations in certain individual decisions based on the output of these systems. The application dates of these specific obligations must be verified according to the updated schedule.

6. Create dispute and review by a different person

The dispute channel must not return the worker to the same automated exit. The review needs to allow:

• correct incomplete or erroneous data;
• present context and additional evidence;
• know which criteria were relevant;
• receive a reasoned response;
• escalate the case to someone else;
• suspend serious effects when there is material doubt.

In Brazil, article 20 of the LGPD guarantees the holder the right to request a review of decisions made solely based on automated processing that affect their interests. The controller must, when requested, provide clear and adequate information about the criteria and procedures used, respecting commercial and industrial secrets. Current law does not expressly state that every review must be carried out by a natural person; therefore, maintaining an independent human review is a more protective governance recommendation, not a verbatim transcription of the article.

7. Audit errors, disparities and real results

The audit should not be limited to the technical accuracy of the model. It is necessary to check how the system changes decisions and opportunities.

Useful indicators include:

• frequency with which managers accept or reject the exit;
• differences in grades before and after adoption;
• promotion, bonus, warning and termination fees;
• disparities between groups, teams, work regimes and locations;
• volume and result of challenges;
• errors of association, omission and duplicity;
• cases in which sufficient evidence was lacking;
• time spent on human review;
• changes after model update.

Law nº 9,029/1995 prohibits discriminatory and limiting practices in access to or maintenance of the employment relationship. A tool does not transfer this responsibility to the provider or make a discriminatory result legitimate.

When there is disparity, the organization needs to investigate data, criteria, weights, context and human use. Correcting the model alone may not resolve management processes that were already unequal.

8. Maintain records, change control and supplier accountability

The company must be able to reconstruct an assessment: which version of the system was used, what data came in, what output was produced, who reviewed it, and why the final decision was made.

The contract with the supplier must address:

• authorized purpose;
• categories and location of data;
• suboperators;
• retention and deletion;
• security and incident response;
• technical documentation available;
• quality tests and biases;
• model changes;
• support for explanations and disputes;
• export of records;
• suspension and termination of service.

Business descriptions like “responsible AI” or “unbiased” are no substitute for evidence. The organization using the tool needs to test its behavior in a real context, monitor changes and prevent new functions from being activated without evaluation.

A safer AI-supported assessment flow

A controlled process can work like this:

1. The worker and manager record goals, deliverables and context throughout the cycle.
2. AI organizes records, identifies conflicting dates and points out fields without evidence.
3. The manager consults the original documents, corrects omissions and adds verifiable facts.
4. AI suggests questions, without attributing intent, blame or personality traits.
5. The manager carries out the assessment and defines its conclusion, applying known criteria.
6. Calibration is conducted by people, with attention to discrepant patterns between teams.
7. The worker receives the justification, knows that there was AI support and can challenge data or conclusions.
8. The organization audits the cycle, records divergences and decides whether use should continue, be changed or suspended.

In this model, records of 1:1 meetings can contribute as evidence, but the 1:1 meeting does not automatically turn into a performance review. Follow-up conversations have their own context and should not be silently reused for disciplinary purposes incompatible with what was reported.

Governance checklist to save

Before starting a pilot, confirm:

• Use and decision influenced are described in writing.

• There is one person responsible for the note and its effects.

• The data is necessary, relevant and verifiable.

• Sensitive features and improper approximations were evaluated.

• The tool does not infer emotion, loyalty, personality or intent.

• Workers and managers received understandable information.

• You can consult the original evidence.

• Dispute exists with independent human review.

• Results and disparities will be audited periodically.

• Vendor or purpose changes require new approval.

• Logs, versions and justifications will be preserved for the defined period.

• HR, privacy and employment law reviewed pilot.

If any essential item cannot be met, the prudent decision is to limit use to administrative tasks or suspend deployment.

The responsibility remains with the organization

The discussion about AI in performance assessment is not limited to asking whether the model “gets it right”. It is necessary to know what data it privileges, what behaviors it induces, who can challenge it and who assumes the consequences when it makes a mistake.

Automation is most defensible when it reduces mechanical labor without reducing rights. It is most dangerous when it converts incomplete records into a semblance of objectivity and hands out serious decisions without anyone being able to explain where they came from.

Use AI to organize the process, not hide who is responsible. Save this governance checklist and also read the guide on recording 1:1 meetings before connecting these conversations to the formal performance cycle.