What India’s AI appraisal compliance question actually is
The adoption pattern in India IT is clear: AI productivity platforms generate a score or productivity index for each employee based on signals like calendar participation, ticket velocity, code commit rates, focus-time proxies, and collaboration artefacts. Managers then use these scores — sometimes as one input among many, sometimes as the primary signal — to assign increment bands, flag underperformers for PIPs, or make promotion decisions.
The legal question is not whether AI scoring exists in this process. It is whether the employer has done what the law requires before and during the use of such scores. Three gaps are consistently found in organisations that have not yet formalised their AI appraisal compliance:
- No specific notice: Employees were told at onboarding that “productivity tools are used,” but not that the tool’s output would feed salary decisions. The DPDP Act requires a notice specific to the purpose — performance assessment for pay — not a bundled generic disclosure.
- No data accuracy check: AI scores can be wrong. A developer on leave for two weeks of a four-week sprint will score poorly. A sales team member who closes deals verbally and via WhatsApp (outside tracked systems) will appear idle. If an inaccurate score triggers a PIP, the employer has a problem: the DPDP Act gives employees the right to seek correction of their data.
- No documented human review: When a manager cites the AI score verbatim in a PIP letter without independent analysis, the employer has created a record that the decision was algorithmically determined. That creates EU AI Act exposure (if in scope) and complicates any challenge under DPDP.
For background on how DPDP Act 2023 applies to employee monitoring more broadly, see the DPDP Act India workforce monitoring buyer guide. For the EU AI Act dimension specifically, the EU AI Act Article 6 high-risk system classification guide for workforce AI covers the classification test in detail.
The verdict table: AI productivity score use cases vs Indian law
The table below gives a use-case-by-use-case answer. This is a practical guide, not a legal opinion. Verify each use case with qualified employment and data protection counsel before acting, particularly for use cases rated “High caution.”
| Use case | DPDP Act 2023 | EU AI Act (where applicable) | Verdict |
|---|---|---|---|
| Variable pay / bonus component | Notice must specifically state use in pay decisions; data minimisation; grievance mechanism required; employee can seek correction of underlying data | If score is a primary determinant → Annex III high-risk; human oversight, documentation required from 2 Aug 2026 | Permissible with compliance: DPDP notice + stated purpose + human review documented; EU AI Act registration for in-scope companies. Verify with counsel. |
| Performance Improvement Plan (PIP) trigger | Strong data accuracy obligation; employee can seek correction before PIP is issued; grievance mechanism must be accessible | Likely Annex III high-risk; human oversight mandatory; employees must be informed they are subject to the system | High caution: do not trigger PIP solely on AI score; manager must independently corroborate; correct data inaccuracies first. Verify with counsel. |
| Annual increment band allocation | Notice; purpose must cover pay-band use; minimisation; retention limits apply to scoring data | Depends on automation level and whether score is the primary mechanism | Permissible as one input: manager must assess independently; document rationale separately from AI score. Verify with counsel. |
| Promotion decision | Notice must cover talent and promotion decisions; accuracy obligation applies; employee can challenge data used | Annex III if AI is the primary scoring mechanism for promotion eligibility | Permissible if not sole basis: document the human decision rationale independently; do not rely on AI score alone. Verify with counsel. |
| Termination | Strictest obligations; accuracy of underlying data must be verified; employee has right to seek data correction before dismissal is finalised | Strictest Annex III scrutiny; human oversight is mandatory; EU member states may impose additional employment-law safeguards | Highest risk: never use AI score as sole or primary basis for termination; independent human assessment and legal review are essential before acting. Verify with counsel. |
The table above should be read as starting-point guidance, not a compliance certificate. The specific obligations depend on your organisation’s size, the processing architecture, which employees are in scope, and which sectors apply. Verify with qualified counsel before acting on any high-caution or high-risk use case.
What DPDP Act 2023 requires for AI-driven performance data
The DPDP Act 2023 establishes the baseline for any employer in India using AI productivity scoring in performance management. The key requirements:
| DPDP requirement | What it means for AI appraisal scoring | How to meet it |
|---|---|---|
| Notice before collection (Section 5) | Employees must receive a specific, plain-language notice explaining what performance data is collected, by which tools, for what purposes — including that the data feeds appraisal or pay decisions. A bundled onboarding policy is unlikely to be sufficient. | Issue a standalone “Productivity Assessment Data Notice” that names the tools, the data categories, the purpose (performance management and pay decisions), and the retention period. Refresh when the tool or purpose changes. |
| Lawful purpose (Section 4) | The employer’s legitimate interest in managing performance is generally a sufficient basis for collecting work-output signals. However, the purpose stated in the notice must match the actual use. If the notice says “productivity monitoring” and the output is used for redundancy decisions, the purpose has changed. | State the purpose specifically and completely. If the score will be used for pay, promotion, PIP, and performance management — say all four. Do not list only the most palatable purpose. |
| Data accuracy (Section 8) | The Act requires that data be accurate and complete where it is used to make decisions that affect the Data Principal. An AI productivity score derived from incomplete data — missing leave periods, tool outages, or excluded collaboration channels — may be inaccurate in ways that materially affect the employee. | Build accuracy checks into the scoring workflow. Before any PIP or adverse action, have the manager or HR team verify the data period used in the score and identify any gaps. Document this check. |
| Grievance mechanism (Section 13) | Employees must be able to raise concerns about their performance data with a named data protection contact at the employer. The mechanism must be easy to find and use; responses must be timely. | Publish a data protection contact (DPO or equivalent) on the company intranet with a response commitment. Train HR on how to handle a data correction request on a productivity score before an appraisal cycle. |
| Data Principal rights (Section 11–12) | Employees can seek access to their personal data and request correction of inaccurate data. In the context of AI scoring, this means an employee can request the data that underlies their productivity score and challenge entries they believe are wrong. | Maintain a data subject access request process that covers productivity tool data. Be able to provide an employee with the raw data used to generate their score within a reasonable timeframe. |
For a full template covering the notice and consent obligations under DPDP for employee monitoring contexts, see the DPDP consent and employee monitoring template guide. For the specific question of how long to retain employee monitoring data, see our data retention guide under DPDP 2026.
EU AI Act Article 6 and Annex III: when does scoring become a high-risk AI system?
The EU AI Act (EU Regulation 2024/1689) creates a separate, harder compliance layer for any company in scope — including Indian IT companies with EU clients, GCC operations owned by EU parent companies, or EU-based employees whose productivity is scored by the same platform used in India.
Annex III, Point 4 of the EU AI Act lists two categories of high-risk AI systems relevant to performance scoring:
- AI systems used to evaluate the performance and behaviour of persons in employment relationships; and
- AI systems intended to be used for making or influencing decisions on promotion or termination of work-related contractual relationships, allocation of tasks, and monitoring and evaluation of performance and behaviour.
If a productivity scoring tool systematically generates a score that managers use in pay-band allocation, PIP triggers, or promotion decisions, it is likely to fall within one or both categories. The classification is not about the tool’s marketing description — it is about how the tool is actually used.
High-risk AI system deployers (the employer) must, from 2 August 2026:
- Maintain a risk management system throughout the system’s lifecycle;
- Implement human oversight measures — a human must be able to override, disregard, or flag the system’s output before it affects an employment decision;
- Ensure the system is accurate, robust, and secure, and have technical documentation to support that claim;
- Notify workers that they are subject to a high-risk AI system; and
- Register the system in the EU AI Act database where required.
Practical scope check for India IT companies: If your productivity scoring platform is used by any employee who works on EU client projects, is employed by a GCC whose parent is EU-based, or who reports to an EU-based manager, the EU AI Act may apply to that use of the system. This is a legal question that depends on how the Act’s territorial scope applies to your specific corporate structure. Verify with counsel familiar with both the EU AI Act and Indian employment law before the 2 August 2026 deadline. Use the EU AI Act Annex III workplace systems deep dive for a detailed scope analysis.
The key safeguard required under EU AI Act Article 14: the human oversight measure must be genuinely human — it cannot be a rubber stamp. If a manager’s role in the process is to click “approve” on a score they have not independently reviewed, the human oversight requirement is not met. Verify with counsel.
What employees can do when an AI score affects their pay in India
For HR teams, understanding employee rights in this context is not just a legal obligation — it is a risk management tool. An employee who receives a lower increment and later discovers the basis was an inaccurate AI score, and who was not properly notified of the scoring process, has multiple avenues to raise concerns. Knowing these avenues helps employers get the process right before the fact.
Under the DPDP Act 2023, an employee whose performance data has been used in a pay decision can:
- Request access to their data: The employee can request the personal data held about them, including the data used to generate their productivity score. The employer must be able to respond.
- Seek correction of inaccurate data: If the employee believes the data underlying the score is wrong — a leave period was not accounted for, a project was miscategorised, a tool outage went unrecorded — they can formally request correction. The employer must respond and, if the data is inaccurate, correct it.
- Raise a grievance: Via the employer’s data protection grievance mechanism. If the mechanism does not exist or does not function, this is a standalone DPDP violation.
- File a complaint with the Data Protection Board of India: If the grievance is not resolved, the employee can escalate to the DPB. As of 2026, the DPB is operational and receiving complaints.
Under the EU AI Act (for companies in scope), employees subject to high-risk AI system outputs additionally have the right to an explanation of the system’s role in the decision and to request human review. These EU rights are in addition to, not instead of, the DPDP rights above.
The practical implication: employers who have not addressed DPDP notice and accuracy obligations are exposed to a combination of DPB complaints and employment law grievances if a pay decision based on AI scoring is challenged. The first and most cost-effective step is to ensure the notice is correct and the accuracy-check process exists. Verify with counsel.
How to implement AI productivity scoring compliantly in India 2026
The following checklist covers the minimum steps for DPDP compliance and, where applicable, EU AI Act readiness. This is a starting-point framework; adapt it with qualified counsel for your organisation’s specific size, sector, and processing activities.
- ☐ Audit current scoring: List every productivity tool that generates a score, metric, or ranking for individual employees. Note which tool outputs are used in formal appraisal, pay-band, PIP, or promotion decisions.
- ☐ Check your notice: For each tool listed, verify that a specific notice has been given to all employees covered. The notice must name the tool, the data categories captured, the purpose (including pay decisions if applicable), and the retention period. Update if any element is missing.
- ☐ Check your stated purpose: Confirm the notice accurately describes how outputs are used. If outputs feed pay decisions but the notice says only “productivity monitoring,” update the notice before the next appraisal cycle.
- ☐ Build an accuracy check into the appraisal workflow: Before any PIP or adverse pay action, have a defined step where the manager or HR team reviews the scoring period for data gaps — leave, system outages, excluded tools — and documents the review.
- ☐ Verify your grievance mechanism: Confirm that a named data protection contact exists, is published on the company intranet, and that HR staff know how to handle a data correction request on a productivity score.
- ☐ Document human review: For every pay-band, PIP trigger, or adverse employment decision that used AI scoring as an input, the manager’s independent assessment should be recorded separately. The AI score is an input; the human decision is the record.
- ☐ EU AI Act scope check (if applicable): If your organisation has EU employees, EU clients, or EU parent-company oversight of India employees, engage counsel to determine whether your productivity scoring platform requires Annex III high-risk compliance before 2 August 2026.
- ☐ Set a retention schedule: Performance scoring data should not be kept indefinitely. Define the retention period, automate deletion where possible, and document the schedule.
For a broader assessment of which workforce AI tools in your stack carry the highest DPDP risk, the DPDP Vendor Risk Assessment provides a structured self-assessment. For the EU AI Act angle, use the EU AI Act Article 6 Classifier to check whether your productivity scoring system meets the Annex III classification criteria.
How gStride handles AI productivity scoring and compliance
gStride is built on outcome-signal intelligence: calendar participation, repository velocity, ticket and deliverable closure rates, and collaboration artefacts. These signals are surfaced for manager review — they are inputs to human judgment, not automated employment decisions. This architecture directly addresses the compliance challenge described in this guide.
- No automated decisions: gStride surfaces signals; it does not trigger PIPs, change pay bands, or make employment recommendations without a human in the loop. The score is a diagnostic, not a verdict.
- Work-output signals only: gStride does not capture screenshots, keystrokes, or biometric data. The data categories processed are work-product signals, which carry a lower DPDP classification and simpler notice obligations than surveillance or biometric data.
- Explainable scoring: Managers can see what data underlies a team member’s trend. If an employee asks “what does my score measure?”, a manager using gStride can answer. This is the foundation of the EU AI Act’s transparency and explanation requirement for high-risk systems.
- Human-first by design: gStride is designed to help managers have better performance conversations, not to replace them. The output is a team dashboard, not an individual sentence.
For a view of how gStride fits within the EU AI Act compliance framework specifically, see the EU AI Act and employee productivity scoring guide.
Check if your productivity scoring system is EU AI Act Annex III high-risk
The EU AI Act Article 6 Classifier walks through the Annex III classification criteria for workforce AI systems: does your tool evaluate employees? Does the output influence pay, promotion, or termination? Is the process automated? Answer 6 questions and get a classification assessment — free to use; PDF with email.
Also: the DPDP Vendor Risk Assessment helps you identify which performance monitoring tools in your stack carry the highest DPDP compliance risk before you brief counsel.
Frequently asked questions
Can an Indian employer legally use an AI productivity score for salary or variable pay?
Under the DPDP Act 2023, using AI productivity scores in salary or variable-pay decisions is not prohibited but requires compliance: a clear notice given before or at data collection specifying use in pay decisions; a stated lawful purpose; data minimisation; and a functioning grievance mechanism. The critical safeguard: AI scores must inform human judgment, not replace it. A manager must review, document, and be accountable for the pay outcome. Using a score as the sole or determinative basis for a salary decision without human review carries legal and reputational risk. Verify with employment and data protection counsel.
Does the EU AI Act apply to AI productivity scoring at Indian companies?
The EU AI Act applies to AI systems deployed by EU-established entities or whose outputs affect people in the EU — regardless of where the provider is. For Indian IT companies with EU clients, GCCs owned by EU parents, or EU-based employees in scope of the same scoring platform, the EU AI Act may apply. Under Annex III, Point 4, AI systems that evaluate employees and influence pay, promotion, or termination are high-risk systems requiring documented human oversight from 2 August 2026. Verify with counsel whether your specific organisational structure brings you in scope.
What rights does an employee have if an AI score affects their appraisal or PIP in India?
Under the DPDP Act 2023, employees can request access to their personal data, seek correction of inaccurate data, raise a grievance through the employer’s data protection contact, and file a complaint with the Data Protection Board of India. If a productivity score is based on inaccurate data, an employee can formally request correction. For EU AI Act-in-scope companies, employees additionally have the right to explanation and to human review of automated decision outputs. Verify with employment and data protection counsel.
What must employers disclose before using AI productivity scoring for performance reviews?
Under DPDP Act 2023 Section 5, a specific notice must be given specifying the personal data collected, the purpose (including use in pay or appraisal decisions), the retention period, data sharing, and how employees can exercise their rights. A generic employment contract privacy clause is unlikely to satisfy this requirement. For EU AI Act-in-scope companies, employees must also be informed that they are subject to a high-risk AI system. Verify the specific notice standard for your organisation with counsel.
Is an AI productivity score classified as a high-risk AI system under the EU AI Act?
It may be. EU AI Act Annex III, Point 4 covers AI systems used to evaluate employees and influence decisions on pay, promotion, performance improvement, or termination. If a productivity score is systematically applied in such processes, it is likely Annex III high-risk. The classification depends on the specific system design and how it is used in practice. Use the gStride EU AI Act Article 6 Classifier for an initial assessment, then verify with qualified counsel before the 2 August 2026 enforcement date.
Disclaimer: This article is general information, not legal advice. The DPDP Act 2023 obligations, EU AI Act 2024 requirements, applicable enforcement posture, NASSCOM sector guidance, and specific employment law implications are subject to evolving regulatory interpretation, Data Protection Board guidance, and national authority enforcement. The verdict table is a practical starting point, not a legal assessment for any specific organisation or employment situation. Penalty and compliance figures cited are statutory maxima or statutory provisions; actual enforcement outcomes depend on authority discretion, company-specific facts, and case law. Verify the lawfulness of any specific AI scoring activity, notice requirements, and applicable obligations with qualified employment and data protection counsel before acting. Nothing on this page constitutes a compliance assessment, certificate, or legal opinion.