AI turns up in performance reviews in two different ways. A manager may use a chatbot to help draft the written review. Or the organisation may use software that scores, ranks or flags employees from data about their work. The first is a writing aid; the second is a system making or supporting a judgment about a person. The rules and the risks are different for each, and this page covers both.
The short answer: drafting help is fine if the manager owns the judgment, checks every claim and keeps personal data out of tools that are not approved for it. AI that evaluates people is treated much more strictly: in the EU it is listed as high-risk under the AI Act, with duties from 2 December 2027, and some US laws already cover AI used in promotion and discipline. In every case, a person who knows the employee's work should make the call and be able to explain it.
Using AI to help write a review
Generative AI can turn notes into clear sentences, suggest a structure, soften harsh wording or spot vague feedback. It cannot know what the employee actually did. The risks:
- Invented or wrong detail: AI can produce confident but wrong output, which NIST calls confabulation (NIST AI 600-1). In a review, a made-up example or a misattributed result is unfair and hard to undo. See checking AI output.
- Over-trusting the draft: NIST also describes automation bias, excessive deference to automated systems (NIST AI 600-1). A polished draft can feel more authoritative than it is.
- Personal data: a review is personal data about the employee. Only use tools your organisation has approved for that kind of data; see AI agents and personal data and AI policy for employees.
- Generic feedback: text that could describe anyone tells the employee nothing. Start from your own notes and concrete examples, not from a blank prompt.
AI that scores or ranks employees
Some systems rate performance from activity data, flag people as low performers, or recommend who should be promoted or managed out. This is where the law focuses.
European Union
- High-risk: the AI Act lists AI systems intended to be used to make decisions affecting terms of work-related relationships, promotion or termination, or to monitor and evaluate the performance and behaviour of people in those relationships (EU AI Act, Annex III, point 4(b)). The listing turns on the system's intended purpose.
- Telling workers first: employers deploying a high-risk AI system at the workplace must inform workers' representatives and affected workers before putting it into service or use (EU AI Act, Article 26(7)).
- Human oversight: employers must assign oversight to people with the competence, training and authority to do it (Article 26(2)), who must be able to interpret the output, avoid over-relying on it, and override it (Article 14).
- Explanations: a person affected by certain decisions based on high-risk AI output has a right to clear and meaningful explanations of the AI's role and the main elements of the decision, subject to conditions and exceptions (EU AI Act, Article 86).
- When: these high-risk duties apply from 2 December 2027, the date set by Regulation (EU) 2026/1744 (European Commission; NI Assembly EU law tracker).
- Already in force: Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them, with exceptions and safeguards (GDPR, Article 22).
United States
- Illinois: since 1 January 2026, the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has the effect of subjecting employees to discrimination on the basis of protected classes in recruitment, hiring, promotion, discharge, discipline or the terms of employment, or to fail to give employees notice that it uses AI for those purposes (Illinois Public Act 103-0804).
- Colorado: SB 26-189 on automated decision-making technology covers decisions about employment among others. From 1 January 2027 it requires notice to people at the point of interaction, an explanation within 30 days after an adverse decision, and a right to ask for meaningful human review and reconsideration (Colorado General Assembly, SB26-189). Nothing under it applies yet.
Anti-discrimination law applies to performance decisions whether or not AI is involved. For the hiring side of the same rules, see AI in hiring; for the wider framework, AI at work and workers' rights.
Fairness and accuracy
NIST lists fairness, with harmful bias managed, among the characteristics of trustworthy AI, alongside validity and reliability (NIST AI RMF 1.0). For a performance tool, that means asking whether it measures the work that matters or only what is easy to count, whether it has been tested for different outcomes across groups, and whether part-time staff, people on leave or people whose work is less visible to the system are scored fairly. Activity data is not the same as performance: see AI monitoring at work.
In Great Britain, the Equality Act 2010 covers how employers give access to promotion, transfer and training; see AI in promotion and training decisions.
Good practice for managers
- Own the judgment: the rating is yours. If you cannot explain it without pointing to a tool, it is not ready.
- Write from evidence: keep notes through the year and give the AI your notes, not a request to invent feedback.
- Check every line against what actually happened, and remove anything you would not say face to face.
- Be open about it: follow your organisation's policy on whether to say AI helped draft the text, and never hide that a scoring system was used.
- Treat a system score as a question, not an answer: look for the reason behind it before acting on it.
See also AI for managers, and for employees, how to request the data AI systems hold on you.
Questions employees can ask
- Was any AI system used to score, rank or flag me, and what data did it use?
- Who made the final decision, and can I discuss the reasons with them?
- How can I correct data that is wrong or incomplete?
- If a score is used to justify a warning or dismissal in Great Britain, see unfair dismissal when AI data is behind the decision.
- Is there a way to ask for the decision to be reviewed? In Great Britain, see grievances and discipline when AI data is involved. In the US, see US federal discrimination law beyond hiring.
- If the review feeds into pay, which criteria set my pay and pay progression? In the EU, see AI pay tools and pay transparency.
This page is general information, not legal or HR advice.
Questions and answers
Is it OK for a manager to use AI to write a performance review?
As a drafting aid, often yes, if the organisation allows it, the tool is approved for personal data, and the manager checks every claim and owns the judgment. AI can produce confident but wrong detail, which NIST calls confabulation.
Is AI that rates employees high-risk under the EU AI Act?
AI systems intended to monitor and evaluate the performance and behaviour of workers, or to make decisions on promotion or termination, are listed as high-risk in Annex III, point 4(b). Those duties apply from 2 December 2027 under Regulation (EU) 2026/1744.
Do employers have to tell employees that AI is used in reviews?
In the EU, from 2 December 2027, employers deploying a high-risk AI system at the workplace must inform workers' representatives and affected workers first. In Illinois, since 1 January 2026, employers must give employees notice when they use AI for decisions such as promotion, discharge or discipline.
Can I challenge a review that relied on AI?
Depending on where you work, you may have rights to an explanation or human review, for example under GDPR Article 22, AI Act Article 86 from 2 December 2027, or Colorado SB 26-189 from 1 January 2027. Start by asking who made the decision and what data was used.