When AI screens candidates, allocates shifts, scores performance, monitors staff or ranks redundancy pools in Australia, the employer stays fully accountable under the Fair Work Act 2009, federal and state anti-discrimination law, the Privacy Act 1988 and state workplace surveillance laws. Each use triggers different provisions, and each needs consultation, human review and decision logs that would survive a tribunal.
These features usually arrive inside platforms the People team already runs: applicant tracking systems, HRIS modules, workforce management suites and the AI assistant inside Microsoft 365 or Google Workspace. Most employers have not mapped which provision each feature triggers, who signs off, and what evidence would satisfy the Fair Work Commission or the Australian Human Rights Commission if something goes wrong.
This guide is for CHROs, general counsel, payroll leads and operations managers at multi-site Australian employers. Our AI change management guide covers getting employees to use AI. This one covers using AI on employees.
Key takeaways
- Workforce AI carries the highest discrimination, procedural fairness and surveillance risk of any AI a business runs.
- Indirect discrimination does not require intent. An algorithm is a "condition, requirement or practice", and vendor "bias-free" claims do not move the risk.
- Deploying AI that changes rostering, performance measurement or termination decisions is usually a "major change" requiring award consultation.
- Surveillance law differs by state: NSW and the ACT have dedicated workplace statutes; others do not.
- The Privacy Act employee records exemption does not cover candidates, contractors, labour hire or third parties.
Which HR and payroll decisions put AI in the legal loop?
Five decision classes come up again and again, each triggering different law.
| AI Use Case | Australian Provision Triggered | |
|---|---|---|
| Hiring and candidate screening | Resume parsing, candidate scoring, video-interview analysis, knock-out questions | Sex Discrimination Act 1984, Disability Discrimination Act 1992, Racial Discrimination Act 1975, Age Discrimination Act 2004, state equal opportunity and anti-discrimination Acts |
| Rostering and shift allocation | Algorithmic shift offers, predictive demand staffing, automated swap approvals | Modern award consultation clauses, FW Act s65 (flexible work requests), right to disconnect (s333M) |
| Performance, promotion and pay review | Productivity scoring, AI review summaries, attrition risk flags in talent calibration | FW Act s340 (general protections), Workplace Gender Equality Act 2012 reporting, AHRC guidance on algorithmic bias |
| Monitoring and productivity scoring | Keystroke and screen monitoring, location tracking, email and chat sentiment analysis | NSW Workplace Surveillance Act 2005, ACT Workplace Privacy Act 2011, VIC Surveillance Devices Act 1999, Privacy Act APP 5 and APP 11 |
| Termination and redundancy selection | AI-assisted ranking for redundancy pools, performance flags triggering PIPs, automated misconduct detection | FW Act s387 (unfair dismissal factors), s389 (genuine redundancy), s340 adverse action, anti-discrimination Acts |
Most employers run AI in at least three of these rows. Few have mapped the provisions, and fewer have the documented sign-off a Commission member would expect.
How does AI create discrimination risk in hiring?
Workforce AI can discriminate at scale without anyone deciding to. Models learn from historical hiring, promotion and termination data, which reflects past human choices, and reproduce them through proxies nobody thought to police.
International precedents are clear. In 2023 the US Equal Employment Opportunity Commission settled with iTutorGroup for US$365,000 after its recruitment software rejected female applicants aged 55 and over and male applicants aged 60 and over. Amazon abandoned an internal resume-screening tool in 2018 after it penalised resumes containing the word "women's", as reported by Reuters.
Australian indirect discrimination tests, in the Sex Discrimination Act (s5(2)), Disability Discrimination Act (s6), Racial Discrimination Act and Age Discrimination Act, do not require intent. They ask whether a condition, requirement or practice has a disproportionate effect on a protected group and is not reasonable in the circumstances. An algorithm is a practice. "We did not know the model was biased" is mitigation at best.
The Australian Human Rights Commission's Human Rights and Technology Final Report (2021) and later guidance are consistent: an entity using AI to make or materially influence decisions about people carries the same obligations as if a person had decided unaided. Vendor warranties are usually narrow, so use our AI vendor selection questions.
What does the Fair Work Act require when AI feeds a workforce decision?
Four provisions matter even where no protected attribute is involved.
Consultation under modern awards
Most modern awards contain a consultation clause requiring the employer to consult affected employees and representatives before a major change to production, organisation, structure or technology likely to have significant effects. AI that materially changes how shifts are allocated, performance is measured or terminations are decided almost always meets that threshold. The usual Commission remedy is an order to consult, sometimes with decisions made in the unconsulted period reconsidered. Undoing months of AI-influenced decisions is the part that hurts.
Section 387: procedural fairness in dismissal
Section 387 lists what the Commission considers in unfair dismissal, including whether the person was told the reason and given a chance to respond. Where AI flagged the concern or summarised the evidence, the employer must explain what the AI did, why its output was relied on, and what human verification happened. "The system flagged them as bottom decile" is not enough.
Section 340: adverse action
Section 340 prohibits adverse action because an employee has a workplace right. Under the reverse onus in s361, the employer must prove the real reason. Opaque model reasoning makes that harder.
Section 333M: right to disconnect
The Closing Loopholes No. 2 Act 2024 inserted s333M, giving employees a right to refuse to monitor, read or respond to contact outside working hours unless the refusal is unreasonable. Always-on status tracking and sentiment analysis that flags slow after-hours replies sit in tension with it. See our guide to the right to disconnect and AI.
How do workplace surveillance laws differ by state?
There is no national workplace surveillance statute. Getting it wrong risks penalties and can make monitoring evidence unusable in later dismissal proceedings.
| Jurisdiction and Statute | Core Obligation | |
|---|---|---|
| NSW: Workplace Surveillance Act 2005 | Camera, computer and tracking surveillance of employees at work | Written notice at least 14 days before surveillance starts (or at start of employment); covert surveillance only with magistrate authority |
| ACT: Workplace Privacy Act 2011 | Data, camera, optical, tracking and listening surveillance | Notice requirements broadly similar to NSW, with a stronger consultation overlay and limits on certain monitoring locations |
| VIC: Surveillance Devices Act 1999 | Listening, optical, tracking and data surveillance devices generally | No dedicated workplace statute; private conversations cannot be recorded without consent; employer monitoring relies on policy, contract and privacy compliance |
| QLD, WA, SA, TAS, NT | No dedicated workplace surveillance Acts | State surveillance devices Acts on recording conversations, privacy law and contractual notice; monitoring generally needs informed notice and a reasonable purpose |
| Commonwealth: Privacy Act 1988 | Applies to APP entities nationally | APP 5 (notice of collection), APP 6 (use and disclosure), APP 11 (security); 2024 amendments add privacy policy disclosure for substantially automated decisions |
A national rollout cannot rely on one generic policy. Calibrate notices and policy to the highest-bar jurisdiction where you employ people. The 2024 Privacy Act amendments also require APP entities to disclose in their privacy policies when substantially automated decisions significantly affect individuals, with those obligations commencing in December 2026. See our guide to automated decisions under the Privacy Act.
What does the employee records exemption cover for AI?
Many employers assume the Privacy Act employee records exemption gives broad freedom to use workforce data for AI. It does not. It applies only to an employee record of a current or former employee where the act or practice is directly related to the employment relationship, and it has been interpreted narrowly.
It does not cover:
- Candidates. Resumes, video interviews, assessments and AI scores sit outside it, so the APPs apply in full to recruitment AI.
- Contractors and labour hire workers, who are not employees.
- Third parties collected incidentally: a colleague named in a 360 review, a customer on a monitored call, a family member in a leave request.
- Uses not directly related to employment. Feeding employee records into a vendor's training corpus rarely qualifies.
The Attorney-General's Department's Privacy Act Review (2023) proposed further changes to the exemption. Prudent employers already assume it will not defend AI-related complaints. See our GDPR vs Privacy Act comparison.
How does a workforce AI decision become litigation?
- AI OutputModel scores, ranks or flags a worker or candidate
- Adverse ActionNon-hire, no promotion, PIP, pay decision, redundancy, dismissal
- ComplaintEmployee or candidate raises an internal or external complaint
- Forum TriageFair Work Commission, AHRC, state tribunal, OAIC or court
- Evidence PhaseEmployer produces model documentation, data lineage, decision logs, consultation records
- RemedyReinstatement, compensation, civil penalty, injunction or undertaking
Map this before deployment so the evidence exists at each stage. The most common gap is no documented human sign-off on the AI output behind the adverse action, which makes s340 and s387 arguments very hard to defend.
What controls should employers put around workforce AI?
The audit trail must satisfy a Commission member, AHRC officer or litigant, not just an internal risk team.
- Weeks 1-2Privacy and Equality Impact AssessmentCombined PIA and equality impact assessment. Identify protected attributes, proxies and groups most exposed to disproportionate impact.
- Weeks 3-4Award and Enterprise Agreement ConsultationWhere deployment is a major change under the applicable award or agreement, run formal consultation and document it.
- Weeks 5-6Vendor Due DiligenceGet warranties on training data lineage, bias testing and indemnity for discrimination claims, not just IP indemnity.
- Weeks 7-9Human Review DesignDocument where a person sits between model output and any material workforce decision, and the standard they apply.
- Weeks 10-12Logging and RetentionDecision logs retaining model version, inputs, output, reviewer identity, reasoning and final decision for at least seven years.
- Weeks 13-14Disparate Impact AuditCompare outputs across protected groups. Document method and findings. Repeat quarterly or after retraining.
- Weeks 15-16Review ChannelA published channel for employees and candidates to request human review of an AI-influenced decision.
These mirror our AI agent governance framework, with a higher evidence standard: workforce AI logs must survive cross-examination.
Where is your workforce AI exposure?
Run each AI feature through this triage.
Does the AI feature make or materially influence a decision affecting hiring, pay, promotion, monitoring or termination?
- No, the AI is purely informational and a person decides independentlyLower risk: confirm informational status in writing, watch for scope creep, light logging
- Yes, and the AI uses protected attributes directly or via proxies (postcode, name, education, career gaps, voice tone)HIGH RISK: PIA plus equality impact assessment, disparate impact audit before go-live, legal sign-off, mandatory human review
- Yes, and the rollout has not been consulted under the applicable award or agreementConsultation gap: pause, consult formally, document outcomes
- Yes, and there is no documented human sign-off between output and decisionProcedural fairness gap: insert a reviewer with a documented standard and keep their reasoning
- Yes, and no disparate impact audit in 12 months or since retrainingAudit gap: commission an audit, document remediation, repeat quarterly
- Yes, and the data includes candidate, contractor or third-party dataEmployee records exemption does not apply: confirm full APP compliance, notice and retention
What should the CHRO and general counsel check before go-live?
- Which workforce decision class does this feature influence?
- Which Fair Work, anti-discrimination, surveillance and Privacy Act provisions does it trigger?
- Is a combined PIA and equality impact assessment complete?
- If it is a major change, is award or agreement consultation complete and documented?
- Can it use or derive any protected attribute directly or by proxy?
- Has a disparate impact audit run in the last 12 months and since the last retrain?
- Is there a documented human reviewer with a review standard and recorded reasoning?
- Do decision logs keep model version, inputs, output, reviewer, reasoning and decision for at least seven years?
- For monitoring, has the required written notice been given in each state, calibrated to the highest bar?
- Is candidate, contractor and third-party data handled under full APP compliance?
- Do vendor warranties and indemnities cover discrimination and Fair Work claims?
- Is there a published channel to request human review?
None is expensive alone. The expensive failure is having none when the first complaint arrives. See also our 50-point AI security checklist and Fair Work compliance automation guide.
What does this look like in practice?
For example, a professional services firm with staff across several states rolls out AI recruitment screening, an AI productivity overlay on Microsoft 365 and an AI performance review summariser. It should expect a PIA and equality impact assessment per feature, award consultation for the productivity overlay, surveillance notices calibrated to NSW for NSW staff with ACT, VIC and other-state coverage, quarterly disparate impact audits, reviewer protocols so nobody is rejected or rated below expectations on AI output alone, and a published review pathway.
Start with an inventory, not another policy. List every AI feature touching workforce decisions, run each through the triage, and score gaps against the checklist.
How Solve8 can help
Our consultants map your workforce AI features against your award coverage, state footprint and HR systems, then design the review steps and decision logs that make them defensible. See our AI strategy service and team augmentation, or contact us to scope an inventory.
