Manufacturing AI human rights governance: the worker-rights ladder for non-automotive plants

Stage 1 is rarely a decision anyone made. The worker-facing AI estate accretes: the vision system bought for quality inspection gains people-detection in a firmware update, the WFM suite's next release adds an absence-prediction module, the access-control vendor upsells facial recognition as a convenience feature. Each arrival is a procurement line item or a maintenance contract, not an AI deployment — so no deployment review ever fires. The plant is running algorithmic management without ever having chosen to.

The tell is to ask for a list. At stage 1 nobody can produce one, and the attempt exposes the ownership gap: HR believes plant IT reviews these systems, plant IT believes HR owns anything touching people, EHS assumes legal has looked at the cameras, and legal has never heard of half the estate. Meanwhile the systems accumulate exactly the data — individual cycle times, movement traces, biometric templates — that a works council, a data protection authority or a customer auditor will one day ask about.

This is a cheap stage to leave and an expensive stage to be caught in. The inventory is an afternoon per site: walk the floor, read the vendor contracts, ask supervisors what they can see about individual operators. Staying costs nothing until the first dispute — and the first dispute arrives with no register, no assessment, no notice and no paper trail, which converts a manageable governance question into a trust collapse.

Stage 2 is where most manufacturers with any governance ambition actually sit, and it feels like progress because the commitment is real. The board approved the principles, the sustainability report cites the UNGPs, and the intention is genuine. The gap is structural: deployment decisions are procurement and plant-IT decisions, and the policy has no seat at that table. A rostering module goes live because the operations director signed the purchase order; at no point does anything in the purchase path ask whether the policy applies.

Declared commitments are not neutral while they wait for process. They raise the standard against which the company is judged — by customer auditors working through their own CSDDD obligations, by works councils quoting the company's own principles back at it, and eventually by regulators reading the sustainability report next to the plant's practice. The delta between what is declared and what is enforced is precisely what an audit measures. A manufacturer with no policy and no estate review is careless; one with a published policy and an ungoverned estate is worse positioned in any dispute, because the knowledge standard has been set by its own hand.

Leaving stage 2 is process design, not philosophy. Three definitions do most of the work: what counts as worker-facing (any system that captures individual-level worker data or feeds decisions about work allocation, evaluation or discipline), which tier of assessment each class of system needs (a notice, a DPIA, or a full HRIA with consultation), and who signs the gate. Wire those three into the purchase-order path and the change-management process the plant already runs, and the policy acquires an enforcement point.

At stage 3 the character of the work changes from principle to caseload. There is a queue of systems, a tiering rule, and a growing folder of completed assessments, each ending in deployment conditions: the yard cameras keep footage 72 hours, the line-performance dashboard reports at crew level and never at individual level, the T&A system offers a non-biometric alternative. The organisation has learned to ask the right questions before go-live, which is genuinely most of the discipline. What it has not yet done is give the answers any enforcement mechanism beyond the document itself.

Consultation quality is what separates a stage 3 that works from one that decorates. Run as dialogue rather than announcement, consultation catches design errors that no assessment template finds, because workers know things about the plant that system owners do not: which camera angle incidentally covers the union noticeboard, which 'productivity' metric punishes the careful setter who absorbs the line's variability, which corner of the hall is where people take the phone call about a sick child. Every one of those is a rights exposure and a system-design improvement, and only the people on the floor can see them in advance.

The constraint that emerges is drift. Conditions agreed in an assessment are configured once, at go-live, by whoever does the install — and then the vendor ships a platform update, a migration resets a retention default, a new supervisor requests a dashboard permission, and the running system walks away from its assessment one setting at a time. Nothing detects the divergence because the assessment lives in a document repository and the configuration lives in the vendor's admin console, and no process compares them. Closing that loop is the move to stage 4.

At stage 4 the gate stops being a meeting and becomes infrastructure. The vendor contract template already contains the purpose-limitation, sub-processor and audit clauses, so procurement does not negotiate them from scratch. System configurations that implement deployment conditions are versioned and checked, the way the plant already versions PLC programs and quality parameters. The manufacturing organisation's existing muscle — management of change, deviation handling, layered process audits — turns out to be exactly the right machinery; rights governance stops feeling like an import from legal and starts running like any other plant discipline.

The interesting shift is that governance starts producing operational data. Appeal rates by system, override outcomes, access-log exceptions, grievance themes: this telemetry does two jobs at once. It is compliance evidence accumulating as a by-product — the artefact a CSDDD-obligated customer or a data protection authority actually asks for — and it is a feedback signal about the systems themselves, because a rising appeal rate on one line is as likely to be a mis-specified metric as a difficult crew. Plants that read the appeal log as system telemetry routinely find model and configuration errors that quality review missed.

Where co-determination applies — Germany's works-council consent requirement for technical monitoring systems being the sharpest case — stage 4 converts it from a blocker into an asset. Works agreements become the codified form of deployment conditions, negotiated once per system class rather than fought per install, and the works council becomes a co-owner of the register rather than an adversary discovering systems after the fact. The remaining gap is external: everything still rests on internal assertion. No one outside the company verifies the register, the conditions or the remedy outcomes, so trust does not compound and every customer audit starts from zero.

Stage 5 is narrower than it sounds. It is not moral perfection and it is not the absence of incidents; it is a defined set of claims the company makes in public and can have verified: we know our estate, we assess before deployment, we consult before signature, our appeal routes work and change our systems, and someone external checks all of this on a cycle. Each claim maps to an artefact — the register, the assessment log, the consultation records, the remedy statistics, the audit report — which is what makes the position defensible rather than aspirational.

Remedy is the pillar that proves the others. The UNGPs' third pillar is access to remedy, and Principle 31 sets effectiveness criteria for grievance mechanisms — legitimate, accessible, predictable, equitable, transparent, rights-compatible, a source of continuous learning, and built on engagement. A mechanism that visibly meets those criteria and demonstrably changes systems — configurations corrected, models retrained, deployments withdrawn — is the strongest single piece of evidence a manufacturer can hold, because it shows the whole cycle operating under load rather than on paper. Disclosure without remedy statistics reads as marketing to exactly the audiences it is meant to persuade.

The stage is also the most exposed to regression, because the estate changes faster than annual governance cycles. An acquisition arrives with an unregistered plant full of biometric T&A and camera analytics. A vendor's quarterly release adds an analytics module across every site at once. A reorganisation orphans the register. Sustaining stage 5 means making review change-triggered rather than calendar-triggered: procurement events, vendor release notes, and M&A due diligence each fire a register review, so the disclosure stays true between annual reports.