HR Compliance Audits

Yesterday, the European Commission released two proposals that will materially affect how HR and TA teams use AI and manage people data: The Digital Omnibus Regulation and the AI Act Simplification Amendment. 1. High-Risk AI Timeline Adjustments The fixed August 2026 enforcement date for high-risk AI no longer applies. Obligations will now begin once the Commission confirms supporting tools (standards, guidance) are available, followed by a six-month transition for HR-related high-risk systems. A new final deadline requires compliance no later than December 2027. This creates a more realistic adoption window for HR technology and recruitment AI. 2. Key GDPR Changes for HR The Digital Omnibus updates GDPR to support modern people analytics and AI use: • Clearer definition of personal data, reducing uncertainty when using aggregated or pseudonymised data. • Permission for residual special-category data in AI training under strict safeguards. • Confirmed allowance for biometric verification when controlled by the employee. • Harmonised DPIA requirements across the EU. • Data breach reporting extended to 96 hours, with a unified EU reporting portal. 3. Streamlined Data and AI Governance Several data laws are consolidated into a clearer Data Act, simplifying vendor oversight and data portability. The AI Act amendment also introduces more practical obligations, expanded simplifications for SMEs and small mid-caps, stronger EU-level oversight, and support for using sensitive data to detect or correct bias in hiring and workforce systems. What This Means for HR and TA: The proposals provide clearer rules, reduced administrative burden, a more achievable timeline for high-risk AI, and better support for fair and compliant AI in recruitment and workforce management. Both the Digital Omnibus and the AI Act amendment are Commission proposals and are not yet law. They now enter the EU’s Ordinary Legislative Procedure, where the European Parliament and the Council will review, amend and negotiate the texts before jointly adopting them. Once approved and published in the Official Journal, each Regulation will enter into force and begin applying on the dates specified in the final legislation. If you’d like a tailored breakdown for your organisation or HR tech stack, feel free to get in touch.

SEBI Enforcement Spotlight: A Wake-Up Call for Fund Managers SEBI’s recent settlement in the Edelweiss matter is certainly unambiguous: having a written Conflict-of-Interest (CoI) policy is mandatory, but not enough. Regulators such as SEBI want evidence that policies adopted by the AIFs actually operate: i.e., committees must meet, recusals must be documented, disclosures must match trustee reporting, and governance failures must be remedied with real, verifiable action. For AIF Sponsors, Managers and Trustees, this is the time to convert governance rhetoric into repeatable, auditable practice. Quick, actionable takeaways for Funds - Operationalise your CoI policy: Don’t let the policy live in a drawer. In other words, schedule committee meetings, record recusals, and keep minutes that explain decisions and rationale. - Build independent oversight: A Fund Board with independent members and a dedicated Governance/Conflict Committee materially strengthens your compliance posture and investor confidence. - Make CTR & trustee reporting airtight: Ensure trustee submissions are accurate, fully evidenced and senior-signed before filing. Inaccurate reports are a clear regulatory trigger. - Segregate functions: Keep sourcing, voting and investor-relations roles distinct. Require written recusal forms and preserve the audit trail. - Test, review, disclose: Run periodic independent reviews (internal audit or external) and promptly disclose any material policy changes or conflicts to LPs. Fund Managers should treat this order as both a warning and a practical instruction manual: don’t let CoI policies sit in a file. Instead, embed them into everyday operations. Run regular committee meetings, require documented recusals, tighten trustee reporting, and schedule independent tests of your controls. These simple, consistent actions prevent conflicts from turning into crises, safeguard investor capital and protect your fund’s reputation, while showing LPs and regulators that every decision is made fairly, transparently, and in the best interests of unitholders. Ultimately, effective conflict management is an investor safeguard. It ensures decisions uphold fiduciary integrity, protects trust, and reinforces the credibility of India’s AIF ecosystem. ANB Legal I Akshat Tripathi #SEBI #AIF #FundManagement

The The Fair Work Ombudsman has just released its Payroll Remediation Program Guide (PRP). 💡 TL;DR: Own the issue. Fix it fast. Put people first. Document everything. Talk to the FWO early. 🧾 Payroll Remediation Program (PRP) – Key Takeaways (FWO Guide | April 2025) If your business discovers payroll compliance issues, the FWO encourages a structured, employee-centred approach to remediation. This guide outlines how to run a compliant, transparent, and efficient PRP. 🔑 10 Features of a Model PRP 1. Fair, accurate, and transparent 2. Clear governance and documentation 3. Timely delivery with proper resourcing 4. Employee-first mindset 5. Genuine consultation with staff/unions 6. Simple processes for affected workers 7. Data gaps? Give employees the benefit of the doubt 8. Proactive, responsive communications 9. Real-time learning and improvement 10. Full transparency with FWO ⚙️ Key Steps in Building a PRP - Discovery: Identify issues, scope, and systems involved - Methodology: Use robust data analysis, risk reviews, and assumption models - Governance: Ensure senior oversight, clear documentation, and independent validation - Payments: Include interest and breakdowns, offer review channels - Former staff: Make real efforts to track and pay them, or lodge with the Commonwealth if not possible - Future-proofing: Fix systems, improve culture, add ongoing compliance checks 📣 Comms Matter - Communicate early, often, and clearly - Tailor messaging for different employee groups - Avoid legal jargon or pay secrecy clauses - Provide breakdowns, clear contact points, and options to dispute 📬 When to Notify FWO - Not required for small isolated errors (if resolved fast) - Recommended for broader/systemic issues—even if all facts aren’t known yet 📚 Full resource in the comments

Did you miss the first deadline of the EU AI Act? On February 2, 2025, new AI regulations officially kicked in. If you’re in HR, this isn’t just another compliance update: the law changes how AI can (and can’t) be used in people decisions.   ❌ Banned AI practices: - Social scoring systems - AI that manipulates human decisions unfairly (e.g. nudges) - Emotion inference in workplaces and educational settings - Biometric data collection revealing sensitive personal characteristics (ethnicity, religion, etc.) ✅ AI Literacy is Now Mandatory - All staff who use AI systems must have a sufficient level of AI literacy.   This goes beyond legal risk—it's about building trust!   Key Actions for HR: - Ask for AI transparency reports from your HR vendors - Verify their EU AI Act compliance - Train your employees to raise awareness of AI risks, compliance and policies   Timeline: - EU countries have until August 2, 2025, to set up national enforcement - No direct penalty for AI literacy non-compliance, but it may influence the penalty for an AI violation. - Use this period to address potential compliance gaps   Above all: Ensure that all your AI-driven decisions are explainable, fair and bias-free. What do you think: are you compliant? #Futureofwork #HRTech #AI

A ₹5 crore ($570k) fine. One of the biggest in IRDAI's history. That’s what landed on Policybazaar’s desk. India’s leading online insurance aggregator. The reason? A list of violations that could’ve been avoided: • Conflicts of interest - senior leaders holding unauthorised directorships elsewhere • Products promoted as "best" or "top" without independent verification • Irregular outsourcing payments • Sales calls not mapped to authorised verifiers • Premium payments delayed to insurers But the part other companies need to hear: This isn’t just about Policybazaar. It’s a warning. If you’re building in a regulated space - like fintech - you can’t treat compliance as an afterthought. Because regulators are watching. And they’re stepping up scrutiny. The founders who’ll sleep well in 5 years are reading cases like this now. And making changes before the knock on the door comes. Now here's what you, as a fintech founder, can learn from Policybazaar's ₹5 Crore Penalty 1) Governance Must Be Strong • Get regulatory approval for ANY external directorship or advisory role for key management • Document and disclose all potential conflicts upfront • Review your leadership team’s external commitments quarterly 2) Product Promotions Need Transparent Backing • Never rank products without clear, disclosed methodology • Use independent, verifiable data for any product comparisons • Include disclaimers explaining your ranking criteria • Avoid language that implies regulatory endorsement 3) Premium/Payment Handling is Sacred • Set up automated systems to ensure 24-hour premium transfers • Never use customer funds for operational cash flow • Build redundant payment processes with real-time monitoring • Document every payment flow for audit trails 4) Record-Keeping Cannot Be "Good Enough" • Tag every single transaction to a responsible person • Maintain complete audit trails for all customer interactions • Set up systems that allow instant regulatory access to records • Run regular internal audits to catch gaps before regulators do 5) Outsourcing Agreements Need Crystal Clear Terms • Define exact services, deliverables, and pricing in all vendor contracts • Ensure all outsourcing complies with regulatory guidelines • Regularly audit third-party relationships • Document how outsourced services relate to your core business 6) Commission and Fee Structures Must Stay Within Limits • Set up automated controls to prevent over-limit payments • Reconcile monthly, not annually • Document all fee structures clearly • Build buffers to stay below regulatory maximums The companies that survive in regulated spaces don’t just follow rules. They build compliance into their DNA from day one. Start now. Before the inspection. Before the penalty. Because in regulated industries, the cost of “fixing later” isn’t just money - it’s your entire business. --- ✍ Tell me below: What’s one compliance process you’ve delayed that could cost you big in the future?

Today, I came across a 'Sustainability Compliance Tech Map' designed to guide companies through the maze of solutions for compliance. It is a helpful resource, but it raises a critical question: Are we going to create new tools for each regulation? Or can we embed compliance into the digital backbone we’re already building? Reflecting on the Budapest Declaration, I encourage our industry to rethink this approach. Rather than inventing new solutions, let us leverage what we already have. At 9altitudes, we base our projects on powerful platforms like Microsoft, PTC, and Tulip Interfaces - solutions that support robust, scalable digital common threads across industries and enable integrated, data-driven compliance. Compliance should not be a standalone task. It should be a natural extension of the CAD, PLM, MES, ERP, and commerce platforms we rely on daily. By embedding compliance into these systems, it becomes an integral part of operations, connecting all data seamlessly. Industry efforts like the IDTA - Industrial Digital Twin Association, using frameworks like the Asset Administration Shell (AAS), already bridge systems for initiatives like the Digital Product Passport (DPP) without adding unnecessary complexity. Similarly, Microsoft Purview Compliance Manager helps companies assess and manage compliance across multicloud environments, building on existing architectures rather than creating silos. The future of compliance lies in enhancing our digital thread with smart data layers that integrate, communicate, and govern information across functions. Let us use this moment as a call to action. Compliance should not be a burden but a seamless part of the journey - helping us build a sustainable, resilient ecosystem for the future. I invite our colleagues, partners, and industry leaders to share their perspectives. Are you using existing platforms or adding new layers? Let us discuss how we can collectively build a sustainable future by leveraging the solutions we already have. Please feel free to comment, share, or engage with your thoughts. Together, we can make compliance smarter, simpler, and truly impactful. With all respect: what we need is not more legislation or more tech maps - it is a commitment to maximizing the solutions we already have, leveraging them to build a sustainable future. Agree ? #DigitalThread #Sustainability #Compliance #BudapestDeclaration #Microsoft #PTC #Tulip #9altitudes #Industry40 #Industry50 #DigitalTwin #ERP #PLM #MES

Handling conflicts of interest and ethical dilemmas in my role as a broker is a critical part of what I do, and I approach it with confidence and a clear sense of responsibility. Here's how I tackle these situations: 1. Transparency is Key: I firmly believe that transparency is the best policy. Whenever a potential conflict of interest arises, I address it head-on, openly discussing it with all parties involved. Transparency builds trust and ensures everyone is on the same page. 2. Stay Informed: To make informed decisions, I stay up-to-date with the latest industry regulations and ethical standards. Being well-informed allows me to navigate complex situations confidently and ethically. 3. Seek Guidance: If a dilemma seems particularly challenging, I'm not afraid to seek advice from colleagues, mentors, or industry experts. A fresh perspective can shed light on the best course of action. 4. Prioritize Client Interests: My clients always come first. When making decisions, I consider what is in their best interest above all else. It's essential to remain loyal to my clients and act in their favor. 5. Maintain Independence: I maintain my independence and objectivity in every transaction. While partnerships and relationships are essential in this business, I ensure that they never compromise my ability to represent my clients effectively. 6. Document Everything: Clear documentation is vital to show that ethical standards have been maintained. I keep records of all transactions and communications, which can be invaluable in case of disputes or ethical challenges. 7. Continual Self-Reflection: I constantly reflect on my actions and decisions to identify areas for improvement. Ethical dilemmas can be valuable learning experiences that help me grow as a professional. In the dynamic world of real estate, conflicts of interest and ethical dilemmas are bound to arise. However, I tackle them with confidence, guided by a commitment to ethical conduct and the best interests of my clients. How about you? How do you handle these challenges in your profession? Let's share ideas and learn together!

The Employment Rights Bill just made this illegal. Day-one flexible working rights are reshaping how we approach workplace flexibility. Forward-thinking HR teams are already adapting their processes to turn this change into competitive advantage. The Workers' Rights Bill removes waiting periods and frequency limits for flexible working requests. Employees can request arrangements from their first day, multiple times per year if circumstances change. Smart HR professionals recognise this isn't just about compliance, it's about attracting top talent who value flexibility from day one. Your strategic flexible working toolkit: → Rewrite job adverts to showcase flexible options as benefits → Discuss working preferences during interviews to set clear expectations → Create decision templates for common requests (hybrid, compressed hours, school run adjustments) → Train managers to explore creative solutions when initial requests need adjustment → Document decisions with clear business reasoning to demonstrate fair process The organisations winning are treating this as recruitment advantage. They're advertising flexibility in job posts and discussing preferences before offers are made. This positions you ahead of competitors who haven't yet adapted their approach to reflect what top candidates now expect. The opportunity isn't minimum compliance, it's using these changes to attract talent who value flexibility and forward-thinking employers. What opportunities are you seeing with day-one flexible working requests?

Audit or assurance process walkthroughs with core team members are essential because they: 1. Promote Understanding: Walkthroughs ensure that auditors and assurance teams fully understand the process from those who know it best. Core team members can explain intricate details, variations, and operational nuances that might not be documented. 2. Validate Process Accuracy: Direct discussions help verify that documented processes align with real-world practices. This minimizes gaps between what's on paper and actual execution, enhancing the audit's relevance. 3. Identify Potential Risks and Controls: Core team members can provide insights into areas where risks arise and how controls are applied. This helps in assessing the effectiveness of controls, identifying gaps, and finding areas for improvement. 4. Foster Collaboration: Involving core team members promotes transparency and collaboration. It builds a sense of joint accountability for process improvements and highlights the importance of control ownership across teams. 5. Highlight Best Practices and Areas for Improvement: Walkthroughs often reveal not only gaps but also strong practices within the team. These can be acknowledged, shared, and scaled across other processes or departments for broader benefits. Regular walkthroughs are therefore valuable, both for enhancing audit quality and building a culture of continuous improvement and compliance across the organization. Anup Singh, CISA® #Audit #Assurance #ProcessImprovement #RiskManagement #ControlEffectiveness #Collaboration #InternalAudit #Compliance #ProcessWalkthrough #Linkedin #ContinuousImprovement #BestPractices #OperationalExcellence LinkedIn LinkedIn for Learning LinkedIn Guide to Creating

🔍 As HR professionals, staying ahead of regulatory changes is key to driving compliance, transparency, and people-first policies. With the 2025 Labour Law updates, we are stepping into a new era of structured compensation, stronger employee benefits, and more accountable workforce practices. Here are the most impactful changes every HR leader and business head should note: 🔹 Basic Salary = Minimum 50% of CTC This will significantly reshape PF, Gratuity, and overall cost-to-company structures. 🔹 Gratuity eligibility now after 1 year A major boost for employee retention and long-term financial security. 🔹 Salary credit deadline moved to 7th of each month Enhances payroll discipline and timely wage assurance. 🔹 Double wages for overtime beyond 8 hours/day Ensures employee protection and promotes structured shift planning. 🔹 48-hours weekly limit (still allowing 12-hours days) Supports better work-life balance and compliance in manufacturing setups. 🔹 F&F settlement must be completed within 2 working days A huge step toward transparent and smooth exit processes. 🔹 Mandatory PF, ESIC & social security for contract and fixed-term workers Strengthens the social safety net across all categories of employees. 💼 These reforms will directly impact workforce planning, budgeting, recruitment strategies, and HR policy frameworks across industries. Organizations that align early will build trust, stronger employer branding, and sustained retention. #HR #LabourLaws2025 #HRLeadership #Compliance #WorkforcePlanning #Recruitment #Payroll #EmployeeExperience #FutureOfWork #StrategicHR #HRBP