A tool that scores staff performance, suggests whom to promote or flags whose pay to review is not governed by one law but by three. Each has its own addressee, its own moment and its own date. This piece puts them in one table.
The figure highlights point 4 of Annex III: employment, workers' management and access to self-employment. That is where performance evaluation falls.
The table
| Law | When the case is caught | What it requires | Who it binds | From when |
|---|---|---|---|---|
| Regulation (EU) 2024/1689, Annex III, point 4(b) | The system is intended to "monitor and evaluate the performance and behaviour of persons" in the context of the employment relationship, or to take decisions on its terms, promotion or termination | It is a high-risk system. Whoever deploys it takes on Article 26: among other things, informing workers' representatives and the affected workers before use (Article 26(7)) and informing the persons it decides on that they are subject to the system (Article 26(11)) | The deployer; Article 26(7), if they are an employer | See below the table |
| Real Decreto 723/2026, Article 3(2)(k) (Spanish law — unofficial English summary) | The company uses algorithmic or automated decision-making systems; their rules are required where they decide on working conditions such as working time, tasks, pay, career progression, place of work or termination | Inform each worker in writing of the system's existence and, in that case, of its guidelines, criteria and operating rules | The employer, whether or not they deploy an AI system | 5 October 2026 |
| GDPR, Article 22 | The decision is based solely on automated processing and produces legal effects concerning the person or similarly significantly affects them | Right not to be subject to that decision, save for three exceptions; in two of them, safeguards including at least human intervention, expressing a point of view and contesting the decision | The controller | Already applies |
Article 26 applies from 2 December 2027 for high-risk systems under Annex III and from 2 August 2028 for those under Annex I; it does not reach products under Annex I, Section B.
A performance evaluation system is an Annex III system, so its date is the first one.
How they read together
They do not exclude each other: they add up. The same system can sit in all three rows at once. RD 723/2026 already applies, whether the system is high-risk or not, and it also reaches systems that are not artificial intelligence. Article 22 GDPR depends on how the decision is made: if a person genuinely intervenes, there is no decision based solely on automated processing. Annex III depends on what the system is used for.
Three different recipients of information. RD 723/2026 speaks to each worker. Article 26(7) speaks to their representatives and to the affected workers, before the system is put into service. Article 64(4)(d) of the Spanish Estatuto de los Trabajadores already gave workers' representatives the right to know the parameters of algorithms. None of the three documents replaces the others.
Human intervention has to be real. Article 22 protects against "a decision based solely on automated processing". In its note of 7 October 2026 on algorithmic systems in the workplace, the Spanish data protection authority (AEPD) says that the formal presence of a person does not rule out Article 22: the reviewer must be able to assess the score critically and depart from it without being bound in practice by the automated result. That is the supervisory authority's reading, not a legal text.
What to do, in order
- Inventory the system and write down what it is used for: information only, or decisions on pay, progression, tasks or termination.
- Draft the RD 723/2026 information for each worker. It already applies. How to do it is in this guide.
- Document who decides and how. If a person reviews, record what they see, on what basis they can depart from the score and when they have done so. That is what separates a decision with human intervention from one Article 22 treats as automated.
- Prepare Article 26 for 2 December 2027: the prior information to representatives and affected workers (26(7)) and the information to the persons the system decides on (26(11)). The rest of the deployer's obligations are paragraph by paragraph here.
What the table does not cover
The impact assessment under Article 35 GDPR. A system that evaluates staff may require one regardless of the AI Act timeline. That is another piece.
The FRIA under Article 27. Its scope is different: bodies governed by public law, private entities providing public services, and systems in Annex III, point 5(b) and (c). A private company evaluating its staff is not usually in any of those cases.
Content in accordance with Annex III, point 4, and Article 26(7) and (11) of Regulation (EU) 2024/1689, with Article 113 as amended by Regulation (EU) 2026/1744; with Article 3(2)(k) of Spain's Real Decreto 723/2026; and with Article 22 of Regulation (EU) 2016/679. The AEPD's reading is guidance, not an obligation.
This article is for information purposes only and does not constitute legal advice.