Time turns a provisional solution into something else. In decent work in the automatic era, the absence of expiration transformed an arguable exception into permanent infrastructure.
A temporary solution commonly enters an organisation under exceptional conditions. Staff are missing, a rule changes, a health emergency appears, or a service is interrupted. Urgency narrows deliberation and makes it possible to accept a tool that would require more evidence in ordinary circumstances. The problem does not necessarily lie in that first decision. It emerges when the situation that justified the measure disappears but data collection, automated scoring, surveillance, or accelerated task allocation remains.
The move from provisional to permanent is rarely announced. It occurs through administrative renewals, extended contracts, dashboards that nobody dares to switch off, and routines that workers learn to endure. Each additional week appears to be a minor continuation. After a year, however, the exception already organises schedules, expectations, and power relationships. The institution has stopped asking whether it needs the measure and asks only how much removing it would cost.
Time changes the ethical and operational balance. An intrusion that is proportionate for ten days may be indefensible for ten months. An error tolerated in a small pilot can become a serious pattern when it reaches thousands of people. Purpose also drifts: data gathered to protect continuity may eventually inform performance reviews, disciplinary decisions, or predictions of absence. The tool still has the same name, but it no longer performs the same institutional work.
Expiry is not an automatic instruction to erase every innovation. It is a decision point that requires the purpose, evidence, harms, and alternatives to be presented again. A responsible renewal must not depend on the supplier's convenience or on investment already made. It must show that the problem continues, that the measure remains necessary, that its benefits are fairly distributed, and that no less intrusive option exists.
In automated work, that review requires the participation of those who experience the measure. Management knows objectives and costs; the technical team knows dependencies and limits; prevention specialists know risks; workforce representatives know everyday changes; and affected people know exceptions that never reach the dashboard. No view is sufficient by itself. Temporality is governed well when this evidence is brought together before renewal, not after harm occurs.
The following three cases are educational composites based on plausible workplace situations. They do not describe identifiable organisations and do not replace legal, employment, or occupational safety advice. Their purpose is to show how an initially defensible measure can change its nature without changing its interface, and which controls can preserve an improvement without normalising its hidden cost.
Expiry turns a promise into a reviewable decision#
Every exceptional measure should begin with a short record: specific problem, affected population, data used, authorised purpose, accountable owner, expiry date, and exit criterion. It should also state which result would justify renewal and which harm would require a pause. Without that information, a later review starts from incomplete organisational memory and favours continuity through inertia.
Every exceptional measure should begin with a short record: specific problem, affected population, data used, authorised purpose, accountable owner, expiry date, and exit criterion.
The date must trigger a real decision. An automated email leading to routine approval is not a safeguard. Before expiry, a person with authority needs to compare current conditions with the baseline, hear from workers, examine errors and secondary uses, and sign an intelligible resolution. When evidence is missing, the measure should return to a limited scope or stop until that evidence is available.
Three clocks must also be separated. The first measures the duration of the original problem. The second concerns the validity of the processing or automated rule. The third concerns retention of data and records. An emergency can end while the tool remains active; the tool can be withdrawn while its profiles remain; and some records may be retained in a limited way for audit or remedy. Confusing these periods makes indefinite storage appear to be an unavoidable consequence.
Renewal must prevent silent purpose expansion. If an application collected location to coordinate an evacuation, later using it to assess punctuality requires a new decision, an appropriate basis, and its own evaluation. It is not enough to say that the data already exists. Technical availability does not create legitimacy or turn surveillance into an ordinary function of the employment relationship.
An exit clause needs practical means. There should be an inventory of integrations, copies, derived models, permissions, and decisions that depend on the system. When the measure expires, someone must know what to switch off, what to erase, what to retain with justification, and which manual or alternative process restores the service. Without a technical and organisational reversal plan, the expiry date sits on infrastructure designed never to end.
Finally, time requires remedy. If review finds that a provisional rule harmed a group, changing the rule prospectively is not enough. The organisation must locate affected decisions, provide proportionate notice, open an accessible review route, and restore pay, rest, opportunity, or reputation where appropriate. Institutional memory is demonstrated by the ability to correct consequences, not merely by the ability to update software.
Case one: attendance monitoring that outlived the emergency#
In the first composite case, a service network introduced mobile attendance registration during a crisis. It showed which centres could open, supported exposure notifications, and helped reorganise teams quickly. The measure was approved for ninety days. Workers understood the urgency because its purpose was specific, access was restricted, and the benefit to continuity was visible.
The crisis eased, but the contract was renewed without debate. Human resources began consulting connection times and approximate locations to resolve discrepancies. Later, some managers downloaded weekly reports to compare punctuality between centres. A signal designed for exceptional coordination became performance evidence. Nobody announced the change; each use appeared to be one small additional convenience.
The cost concentrated among people working in homes, areas with poor coverage, or split shifts. The application recorded late arrivals when synchronisation failed and did not show time spent resolving incidents before reaching the centre. Affected people had to disprove an absence that the dashboard already presented as fact. The system saved administrative minutes by transferring hours of explanation to workers.
The annual audit compared the original purpose with actual uses and found excessive permissions, indefinite retention, and no correction channel. The organisation suspended individual reports, erased histories with no current purpose, and returned to a less intrusive record. It retained only a centre-level availability function for declared emergencies, activated for a fixed period and accompanied by visible notice.
The lesson was not that all digital coordination was illegitimate. It was that proportionality had expired with the context. The revised solution maintained operational continuity without turning a health exception into ordinary employment surveillance. It also required every future reactivation to identify its reason, duration, authorised users, and deletion date.
Case two: the scheduling algorithm that turned a pilot into permanent availability#
In the second composite case, a retail chain tested a forecasting system for eight weeks to cover a seasonal campaign. The program combined historic sales, weather, and bookings to propose shifts. At first, a planner reviewed every suggestion and respected declared availability. Overtime fell, and several changes could be communicated further in advance.
After the campaign, the company extended the system because the dashboard was already integrated. Weekly review was removed to save time, and the forecast began updating schedules every night. The main indicator measured demand coverage, but not personal predictability, late changes, or shifts declined because of caring responsibilities. Commercial efficiency rose while life outside work became harder to organise.
The learning rule interpreted repeated acceptance of changes as future availability. People who had helped during the campaign received more modifications even when their circumstances had changed. Declining a proposal lowered a flexibility score and could reduce the hours offered. Supportive conduct during an exceptional period had become a permanent profile without conversation or a review date.
The intervention added limits: schedules were locked in advance, availability had to be confirmed periodically, declining a shift could not reduce opportunity, and exceptions required human review. The dashboard added stability, breaks, changes per person, and differences by contract type. Workforce representatives participated in a quarterly assessment with authority to suspend specific rules.
The organisation retained demand forecasting but stopped confusing it with an individual instruction. The system proposed needs; an accountable decision distributed their impact. Expiry applied not only to the technology contract but also to availability data and learned inferences. In that way, an intense campaign stopped following a person months later.
Case three: the safety camera that ended up measuring productivity#
In the third composite case, a factory installed computer vision in a hazardous area while building work was under way. Cameras detected approaches to a closed corridor and triggered an alarm. The measure had a preventive purpose, a limited zone, and a date linked to completion of the work. During that period, it prevented accidental access and helped correct deficient signs.
When construction ended, the supplier offered to retain the equipment and add movement analysis. Management accepted a trial to find bottlenecks but set no new expiry. Months later, route maps appeared in productivity meetings. Short pauses, journeys made to help colleagues, and routes adapted because of physical pain became deviations from an ideal pattern.
The system saw movement, not its meaning. It rewarded shorter routes even when some people carried greater loads, and treated time spent checking a component or explaining a task as inactivity. Workers began avoiding the corridor even when it was the safest route because crossing it produced a visible mark. Preventive technology had created an incentive contrary to prevention.
The safety committee required purposes to be separated. Immediate warnings remained active only for defined risks, while historical analysis stopped. Individual profiles were erased, decisions that had relied on the data were reviewed, and the organisation documented that no preventive signal would feed discipline or performance. Any new use would require evaluation, consultation, a time limit, and testing in real conditions.
Remedy included correcting assessments and recognising work the system had made invisible. The case showed that harm did not arise from an isolated camera but from continuity without mandate, purpose expansion, and asymmetric authority to interpret. A properly governed time limit would have forced the organisation to formulate its new question before reusing the infrastructure.
Four institutional sources for deciding whether a measure should continue#
The ILO Centenary Declaration for the Future of Work advances a human-centred approach and connects technological transformation with decent work, rights, protection, and social dialogue. Its direction prevents the continuation of a tool from being treated as a purely technical decision: review should ask whether it expands capabilities, respects dignity, and distributes benefits and risks fairly.
The European Agency for Safety and Health at Work's resources on digitalisation place algorithmic management, automation, and platform work within prevention. That perspective requires physical, psychosocial, and organisational risks to be reviewed across the life cycle. A solution that was safe in one context can cease to be safe when pace, uses, staffing, or incentives change.
The NIST Artificial Intelligence Risk Management Framework organises practice around governing, mapping, measuring, and managing. The framework is voluntary and does not replace applicable obligations, but it supplies a useful discipline: assessment does not finish when a system is deployed. Context changes and emerging risks must return to governance decisions, with accountable owners, measures, and documented responses.
The European Union Artificial Intelligence Act establishes risk-based duties for certain systems and gives specific attention to high-risk employment uses. Its concrete application depends on the system, the organisation's role, and the legal timetable, so it should not be invoked as an automatic label. It does reinforce a management principle: documentation, human oversight, monitoring, and incident response need to continue after purchase.
The four sources do not prescribe a universal duration. None says that ninety days is always proportionate or that annual review is enough. Together, they point towards continuous, participatory, and traceable governance. An appropriate date depends on the speed of change, severity of consequence, possibility of detecting harm, and reversibility. The greater the impact on income, safety, or access to work, the shorter and more demanding review should be.
A renewal record can summarise the decision on one page: continuing problem, population and purpose, evidence of benefit, errors and inequalities, voices consulted, available alternatives, data still needed, new deadline, and authority to stop. A signature should not certify that the system is perfect. It should make visible why continuation remains defensible and which signal will require a change of course.
Expiry also protects innovation. Removing useless functions releases resources, reduces dependency, and makes it possible to compare solutions. Keeping a tool merely because it is already installed turns past cost into a future obligation. An organisation that knows how to close pilots learns faster than one that accumulates layers of technology and calls its inability to let go transformation.
The final standard is easy to state and difficult to meet: a measure deserves to continue only when its purpose remains, evidence outweighs its costs, people can understand and contest its effects, and genuine capacity to stop and repair exists. Time does not automatically invalidate a solution; it invalidates the assumption that its first authorisation lasts forever. Work that does not renounce dignity preserves memory, sets limits, and decides again before an exception becomes destiny.
