Uber Fined €825M. Algorithmic Management Is HR’s Problem Now.

In 2019, Brahim Ben Ali was driving for Uber in France. Then his account was deactivated. Drivers like him went from earning to nothing overnight. He wanted to understand how such a big decision was made, and his search led him to algorithmic management.

So what is algorithmic management in the gig economy? It’s software that takes on parts of a manager’s job. Apps assign work, track performance through customer ratings, and can suspend or deactivate workers’ accounts. At Uber, that meant the system could determine who kept earning.

Getting answers wasn’t easy. With help from PersonalData.io, a Swiss digital-rights nonprofit, Ben Ali and other drivers requested the data behind their deactivations and took their complaint to the Netherlands, where Uber has its European headquarters. It took seven years, 170 other drivers, and a regulator in another country to get an answer.

In August 2026, the Dutch Data Protection Authority fined Uber €825 million, the second-largest penalty ever under the General Data Protection Regulation (GDPR), the EU’s data protection law. It found that between 2018 and 2022, suspected fraud or low ratings could automatically suspend drivers, and persistently low ratings could lead to permanent deactivation, without warning or human review. As PersonalData.io founder Paul-Olivier Dehaye put it, one serious complaint could undo a thousand happy trips.

“A computer should not make decisions on its own that have major consequences for you.”

—Monique Verdier, Deputy Chair, Dutch Data Protection Authority

Uber disputes the findings, says it never automated permanent deactivations, and plans to appeal. Dehaye doesn’t question Uber’s right to act against fraud. His point is that Uber must own those decisions, just like an employer.

That comparison is why the case is essential beyond the gig economy. Since 2018, GDPR Article 22 has restricted decisions made solely by software when they significantly affect people, and the law’s explanatory notes cite automated recruiting as an example. The EU AI Act goes further, classifying AI that hires, assigns tasks, evaluates performance, or ends work relationships as high-risk.

Those AI Act rules were delayed in July 2026 and now take effect on December 2, 2027. It’s easy to read that as time to wait, but the delay doesn’t touch what GDPR already requires. Employers, not vendors, answer for how these tools are used, which is why HR, legal, and workers’ representatives need a seat at the table.

In this article, we’ll look at three places where HR’s controls on algorithmic management break, and how leading enterprises closed each gap.

Why Is Algorithmic Management Moving Faster Than HR Oversight?

Uber’s fine wasn’t an isolated case. Since 2018, European regulators have issued €7.1 billion in GDPR fines, with nine of the ten largest going to big tech companies. The rules are being enforced.

Yet HR often has little say in the systems that manage workers. While 39% of organizations have implemented AI in HR, 52% don’t involve HR in AI strategy. When HR joins late, it manages the fallout of algorithmic management rather than shaping AI strategy.

“Often AI deployment decisions are being made without any involvement of HR.”

— Eser Rizaoglu, Senior Director, Analyst, Gartner HR Practice

That’s why HR leaders need to work with security, legal, and business teams before these systems are chosen. The same gap shows up in governance. In ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals, 90% said employees use AI at work, yet only 38% of organizations had a formal, comprehensive AI policy, and 25% had none. 

Human oversight lags further behind. Only 36% said humans approve most AI-generated actions before they run, and 20% didn’t know how their organization oversees AI decisions at all. As the chart below shows, organizations are further along in using AI than in governing it.

‍

‍

To close that gap, every system used for algorithmic management needs a named owner, a human reviewer with the power to overrule it, and notice to workers before it goes live. Next, let’s look at where each of those controls breaks down.

Why Vendor Compliance Doesn’t Cover Algorithmic Management 

On paper, employers seem covered. Their algorithmic management tools come from established vendors. Yet just 18% of European employers surveyed say they’re very prepared to comply with the EU AI Act, and 20% say they aren’t prepared at all.

The problem is ownership. Vendors answer for how their tools are built, but employers answer for how they’re used. GDPR already restricts decisions made by software alone, and from December 2027, EU AI Act high-risk rules add two specific duties for employers. 

They must assign human oversight to people with the authority to act, and they must inform workers before a system is used. Neither is possible without knowing which tools make decisions or run AI employee monitoring, and that takes HR, legal, and IT working together.

Without that coordination, HR’s controls on algorithmic management break down in three places:

• Vendor AI Nobody Has Mapped: AI often comes built into tools for hiring, scheduling, or performance reviews. When procurement or IT buys these tools, no one may check whether they use AI, so HR and legal may not know which systems make decisions about workers. In Littler’s survey of US employers, HR was among the leading uses of AI at work, at 54%, yet only 45% vet their AI vendors. As the chart below shows, just 34% have one person responsible for AI oversight.

‍

‍

• Human Oversight Only on Paper: Sometimes a person is supposed to make the final decision but simply approves the AI's recommendation. The policy says a human decides, but the tool effectively makes the call, because reviewers may not see why it made a recommendation or have the authority to change it. When the UK’s data protection regulator spoke with over 30 employers about automated recruitment, it found that many were likely letting software make decisions without meaningful human involvement.
• Workers Told After the Tool Goes Live: AI tools that schedule, monitor, or evaluate workers can arrive before anyone tells their representatives. In a Weizenbaum Institute survey of German works councils, only 35% were consulted at the planning stage, when key design decisions are made. As the chart below shows, just 37% said management gave them enough information to understand the AI in use.

‍

‍

Each gap leaves decisions about workers without a clear owner. Here’s how three leading enterprises closed these algorithmic management gaps, and what changed as a result.

Why Did Ingka Map Its Vendor AI Before It Went Live?

For Ingka Group, the largest IKEA retailer, the risk of unmapped vendor AI came with scale. It operates in 31 countries, and by early 2025, around 30,000 employees had access to an AI copilot. Ingka builds some AI itself and buys the rest from vendors, for uses ranging from employee productivity to supply chain and customer experience.

It already had digital ethics and responsible AI policies, but its early reviews of AI use cases were reactive. Ingka has since moved the checks to the start. It keeps a repository of its AI systems, each with a clear owner, and no use case is cleared without proof that it meets the rules. Vendors face the same gate.

“Our supplier agreements require our partners to get our approval for AI use, ensuring transparency.”

—Francesco Marzoni, former Chief Data & Analytics Officer, IKEA Retail (Ingka Group)

HR and legal are involved in this work rather than hearing about it later. Ingka’s AI Task Force, set up in 2023, includes experts from Legal and People & Culture and checks that every AI initiative meets the company’s ethical guidelines.

The work was in place before the EU AI Act’s first deadline in February 2025. As a signatory of the EU’s AI Pact, Ingka had committed to early compliance, and in the year before the deadline, it reviewed its prohibited AI use cases and mapped which systems could fall under EU AI Act high-risk rules. The company says its governance has since helped prevent prohibited uses from emerging.

The same gate applies to people. Co-workers can’t use advanced generative AI tools until they complete basic training, and in FY24, more than 4,000 completed AI-related training. Ingka aims for every co-worker to reach basic AI literacy by 2027.

Ingka’s answer to vendor AI nobody has mapped is a repository of its AI systems, each with a clear owner, and AI vendor management that requires approval before any AI is switched on.

Why Did Just Eat Takeaway.com Put Human Oversight in Writing?

Sometimes a person is supposed to make the final decision but simply approves what the AI recommends. Couriers at Just Eat Takeaway.com (JET) in the UK said this was happening to them. In 2023, a campaign group found that couriers had been removed from the app over disputed overpayments as small as £1.35, often with little explanation.

JET said a person reviewed every flagged case before deactivating an account. But the campaign group said evidence of that review was lacking, and couriers said they couldn’t get answers. On paper, a human decided. In practice, no one outside the company could tell.

In Spain, JET had already taken a different path. The country’s 2021 Rider Law gave workers’ representatives the right to know the rules behind algorithmic management, and that December, JET signed an agreement with Spain’s two largest unions that turned that right into concrete rules.

The agreement puts human oversight in writing. JET must tell workers’ representatives when algorithms or AI influence hiring, working conditions, or job security, and share the data and rules behind those decisions. The systems must have human supervision and can’t use data such as sex or nationality. A joint Algorithm Committee can call in the person responsible for supervising the algorithm, and chatbot conversations can’t be used to discipline anyone.

“This agreement proves that the pursuit of profitability is compatible with respect for labor rights.”

—Chema Martínez, General Secretary, CCOO Servicios (translated from Spanish)

In January 2025, JET and three unions renewed the agreement for more than 2,500 couriers. In a 2025 rating of seven Spanish platforms, JET scored 7 out of 10, the highest score, and was one of only two with human appeal channels and protection against reprisals. It also has more than 20 worker representation bodies in Spain and around 100 workers’ representatives.

JET now describes the same approach across its markets. Its 2026 transparency report says no system automatically deactivates a courier. Tools flag cases, a person reviews the data before any decision, and a different person handles appeals.

The EU’s Platform Work Directive builds on GDPR automated decision-making rules and makes this the standard for digital labor platforms. Only a human can suspend or close the account of someone working through a platform, and those overseeing AI employee-monitoring and decision systems must have the authority to override automated decisions. EU countries must bring these rules into national law by December 2, 2026.

The agreement has limits. It covers only JET’s directly employed couriers in Spain, and it doesn't share information about the algorithm the law protects. Still, JET shows how to fix human oversight only on paper by putting it in writing, with a person accountable for the algorithm, a human behind every account decision, and workers’ representatives who can question both.

Deutsche Telekom Set Its Algorithmic Management Rules Before the Pilot

Deutsche Telekom, considered Europe’s largest telecoms company with about 200,000 employees, used to bring new systems to its works council too late. Under its old review process, the council’s IT committee had six weeks to review each system, sometimes with more than 100 items at a single meeting.

“Among developers, a mood arose of seeing the works council as an obstacle: just before the finish line, I still have to go to the works council and they stop my development plans.”

—Giovanni Suriano, Chair of the IT Committee, Group Works Council, Deutsche Telekom (translated from German)

So Telekom moved the review to the start. Each new system now gets a short profile as soon as its requirements are set, and one shared tool shows every item and its status. Trials follow the same rules, capped at three months and 100 employees. 

After more than two years as a pilot, the process became permanent in March 2021. Systems that follow the agreed rules can now go live without waiting for a council vote, and by 2022, the IT committee was handling up to 150 items per meeting.

The real test came with hiring. In 2024, Telekom had about 4,000 open positions, and recruiters needed around 40 working days to choose from a shortlist. It turned to Eightfold, an AI tool that matches candidates’ skills to job requirements, the kind of system EU AI Act high-risk rules cover.

This time, the rules came first. After 20 days of talks, the works council signed a pilot agreement in early 2024. A person makes every final decision, in line with GDPR Article 22, and the AI can’t use data such as age, gender, or disability. Employees must be told in advance how their data will be used, and the pilot can’t become permanent without an evaluation and further negotiation. Telekom has since launched an AI-based HR platform, growth hub, with 110,000 registered users.

Agreeing on the rules first is still rare. In 2025, only 13% of German workplaces surveyed had a specific AI agreement, up from 2% a year earlier. Telekom’s own approach has limits too. Its AI Manifesto applies only in Germany, and Suriano warns that overstretched recruiters may accept AI suggestions without checking them.

For workers told after the tool goes live, the fix is timing. At Telekom, the works council sees a system as soon as it sets its requirements, pilots follow the same rules, and employees hear how their data will be used before the tool goes live.

Algorithmic Management Can’t Wait for EU AI Act High-Risk Rules

When Uber cut off Brahim Ben Ali and other drivers, the regulator found that no person had reviewed many of those decisions. GDPR Article 22 has required that safeguard since 2018, and the EU AI Act’s December 2027 deadline doesn’t change that.

Yet many workers still can’t push back. In the EU’s latest European Working Conditions Survey, 46% of workers exposed to algorithmic management said there was no way to contest an automated decision, or that they didn’t know of one.

Closing that gap comes down to three questions. Who owns this tool? Who can overrule it? When were workers told? A worker like Ben Ali can ask them today, and HR should already have the answers.