AI in the Workplace: Emerging Legal Issues for Bermuda Employers

From Productivity Tool to Decision Maker

The first generation of workplace AI was largely administrative. An employee might use an AI tool to draft a letter or summarise a document. The legal risk was principally about confidentiality, data security, accuracy and intellectual property. The next generation is different. AI is increasingly being used to make or influence decisions about people.

Recruitment software can rank applicants. Performance-management systems can identify employees considered to be underperforming. Algorithms can allocate work, assess productivity or determine who should receive further training. Some systems can analyse communications, attendance patterns or other behavioural information.

These developments are already attracting legal and regulatory scrutiny internationally. In Europe, for example, workers have challenged the use of algorithmic systems affecting pay and work allocation, while AI-powered recruitment tools have faced allegations of discrimination and lack of transparency. The risk is not necessarily that an algorithm is deliberately discriminatory. The problem may be that an apparent neutral system produces discriminatory results because of the data on which it was trained or because of assumptions imbedded in its design.

An employer may therefore find itself defending a decision that it did not technically make itself.

The International Regulatory Direction

The European Union is at the forefront of legal developments in this area. The EU AI Act establishes a risk-based regulatory framework for artificial intelligence, with a number of employment-related AI applications treated as high risk. These include systems used for recruitment and selection, decisions affecting employment relationships, promotion or termination, task allocation based on individual behaviour or characteristics, the monitoring and evaluation of workers.

The AI Act’s application is phased, and its territorial reach can, in certain circumstances, extend beyond organisations established in the EU. Bermuda employers should therefore obtain jurisdiction-specific advice if they provide services into the EU, employ individuals there or use AI systems connected with EU operations.

Other jurisdictions are developing their own approaches. Some laws require notice or disclosure when AI is used in recruitment or employment decisions; others address discrimination, impact assessments, bias testing, privacy or automated decision-making, or transparency. These rules are not uniform, and employers should not assume that a requirement in one jurisdiction applies in another.

The broader direction of these laws is nevertheless significant. Employers are increasingly expected to understand what an AI system does, what data it uses, how it reaches conclusions and how humans oversee its operation. The result is a developing regulatory expectation that “the computer made the decision” will not necessarily be an adequate legal defence.

Bermuda’s Current Protections Under PIPA

Bermuda does not currently have a comprehensive employment-specific AI regime comparable to the EU AI Act. That does not mean, however, that the use of AI in the workplace is legally unregulated. Existing employment, human rights, contractual, common-law and privacy principles may apply to AI-assisted decisions. The precise analysis will depend on the facts, the type of decision, the information used and the status of the individual affected.

Bermuda’s Personal Information Protection Act 2016 (“PIPA”) is particularly relevant. Although it is not an AI-specific statute, and it does not automatically prohibit automated decision making or require a human to review every AI-assisted decision, it does matter because AI depends heavily on data. An employer might, for example, provide an AI system with employee performance records, attendance information, emails, health information or other personal data. An AI vendor may then process the information on the employer’s behalf. The employer should not assume that using a third-party technology provider removes its responsibilities under PIPA. Depending on the arrangement, the employer remains responsible for determining the purposes and manner of processing. The contractual and factual relationship should be analysed carefully, and PIPA’s requirements concerning third-party processing, security, transfers and accountability should be addressed expressly.

The more sophisticated the technology becomes, the more important it is for the employer to ascertain the following:

• What personal information is being supplied to the AI system?
• For what specific purpose?
• Is the proposed use consistent with the purpose for which the information was collected and with any notice given?
• What lawful basis or other authority supports the use?
• Is the information accurate, relevant and reasonably necessary?
• Is sensitive information, including health information being used?
• Where is the information being processed or stored?
• Who has access to it?
• Is it being transferred outside Bermuda?
• Can the vendor use it for its own purposes or to train its models?
• How long will it be retained?
• Can an individual access or correct relevant information or exercise other rights under PIPA such as blocking, erasure and destruction of their personal information?
• What process exists for reviewing an AI-assisted recommendation?
• And, critically, is a suitably informed human being reviewing the recommendation before an important employment decision is made?

The Danger of the “Black Box”

One of the greatest practical risks of AI-assisted decisions is what is sometimes described as the “black box” problem. An employer may receive an AI-generated recommendation without being able to explain precisely why an individual was ranked lower, identified as a performance concern or selected for further review. This creates obvious difficulties if the employee or applicant challenges the decision.

Bermuda employment law does not impose one universal requirement that every employment decision be explained in the same way. The employer’s obligations will depend on the circumstances, including the contract, applicable legislation, the reason for the decision and whether discrimination, dismissal, redundancy or another statutory issue is involved. Nevertheless, employers should be able to identify the factual and business reasons for significant employment decisions. An employer who cannot explain why an employee was selected for redundancy, disciplined or dismissed may face evidential and procedural difficulties, even if an AI system recommended the decision.

Human oversight needs to mean more than a manager clicking “approve”. The reviewer should understand the system’s role, consider relevant information outside the system, question anomalous or potentially discriminatory results and retain responsibility for the decision.

What Should Bermuda Employers Do Now?

Not using AI is likely not an option for employers, and so it is wise to put controls around it. First, employers should identify where AI is already being used. AI may be embedded in recruitment platforms, payroll systems, HR software and productivity tools without HR or legal teams appreciating the extent of its functionality.

Second, employers should distinguish between low-risk administrative uses of AI and systems that influence decisions about employees. The legal and governance response should be proportional to the risk.

Third, contracts with AI vendors should be reviewed carefully. Employers should understand what data the vendor receives, where it is processed, whether it can be used for the vendor’s own purposes or to train models, what security measures apply, how incidents will be handled, and what audit, access, correction and deletion rights are available. Employers should also consider whether the vendor can explain the system sufficiently to support the employer’s legal and operational needs.

Fourth, the employer should ensure that AI does not become a substitute for managerial judgment. A human decision maker should understand the relevant circumstances and be prepared to reject an AI recommendation where appropriate.

Fifth, employers should consider whether privacy notices, employment policies, recruitment materials and internal AI policies adequately address the use of AI. Policies should not promise rights or protections that Bermuda law does not provide, and they should accurately explain how the organisation uses AI and how individuals can raise concerns about its use.

Finally, employers should document their approach. A written record of the system’s purpose, data inputs, safeguards, testing, human review and decision-making process may be important if the use of AI is later questioned.

Bermuda employers best prepared for evolving workplace regulation of AI will do more than ask “Can we use AI?”. They will identify where it is being used, assess its risks, maintain meaningful human oversight, explain and document its role, and take responsibility for every employment decision it influences.

First Published in the Bermuda Chamber of Commerce Newsletter (Chamber Insider), September 2026