Midstream Changes: Notice and Reauthorization When Workplace AI Rules Move

After a workplace artificial-intelligence tool goes live, the rule that governs alerts, rankings, or official advice often continues to change. Vendors ship model updates; employers retune thresholds; HR assistants receive new prompt instructions; scheduling systems revise optimization weights. Workers may still be held to the picture of the tool they were given at rollout. This paper treats that midstream interval as a documentary problem in employment settings. It draws on GDPR purpose limitation and accountability, European workplace-processing guidance, the temporal character of monitoring notice in Bărbulescu v. Romania, lifecycle quality themes in the EU Artificial Intelligence Act, and the ongoing govern and map functions in NIST’s AI risk framework. The argument is that a material change in the rule used to advise, flag, rank, or allocate work should be handled through three linked records: a dated plain-language version of the rule in force, notice to affected workers of what changed, and internal reauthorization by employment-side authority before the new rule governs people. A composite walkthrough of a fatigue-alert threshold change shows how the three records would look in ordinary organizational files. Onboarding notice that never updates expires as soon as the live system moves. References [1] Bărbulescu v. Romania, Application no. 61496/08, Eur.Ct. H.R. (Grand Chamber), judgment of Sept. 5, 2017,ECLI:CE:ECHR:2017:0905JUD006149608. [Online]. Available:https://hudoc.echr.coe.int/eng?i=001-177082 [2] Article 29 Data Protection Working Party, “Opinion 2/2017 ondata processing at work,” WP 249, 17/EN, adopted June 8,2017. [Online]. Available:https://ec.europa.eu/newsroom/article29/items/612178 [3] D. J. Solove, “A taxonomy of privacy,” Univ. Pa. Law Rev.,vol. 154, no. 3, pp. 477–560, Jan. 2006, doi: 10.2307/40041279. [4] S. Deupala, S. Shakya, S. Dahal, and R. Khadka,“The reinforcing cycle of AI disadvantages,” in Proc.AICCONF, Prague, Czech Republic, 2026, pp. 1–6, doi:10.1109/AICCONF69182.2026.11600674. [5] European Parliament and Council of the European Union,“Regulation (EU) 2016/679 of the European Parliament and oftheCouncilof27April2016ontheprotectionofnaturalpersonswith regard to the processing of personal data and on the freemovement of such data (General Data Protection Regulation),”Off. J. Eur. Union, L 119, pp. 1–88, May 4, 2016. [6] S. Wachter, B. Mittelstadt, and L. Floridi, “Why a right toexplanation of automated decision-making does not exist inthe General Data Protection Regulation,” Int. Data Priv. Law,vol. 7, no. 2, pp. 76–99, May 2017, doi: 10.1093/idpl/ipx005. [7] M. E. Kaminski, “The right to explanation, explained,”Berkeley Tech. Law J., vol. 34, no. 1, pp. 189–218, 2019, doi:10.15779/Z38TD9N83H. [8] D. K. Citron and F. Pasquale, “The scored society: Due processfor automated predictions,” Wash. Law Rev., vol. 89, no. 1,pp. 1–33, Mar. 2014.