The future becomes human when it retains an exit. In decent work in the automatic era, the initial comfort had bought a dependency that was only seen when trying to get out.
A tool may save hours, organise a workload and reduce errors for months. The decisive test, however, begins when the price changes, the service stops, quality deteriorates or the organisation discovers harm that requires withdrawal. If data cannot be recovered, operational knowledge has disappeared and nobody remembers how to continue without the supplier, the initial efficiency contained a debt. This was not merely a technology purchase: the organisation had surrendered part of its capacity to decide.
Keeping an exit does not mean distrusting every form of automation or maintaining two complete organisations in parallel. It means designing a reversible transition proportionate to risk. It must be possible to stop a function, export information in a usable format, sustain essential tasks, review pending decisions and repair consequences. The more a system affects pay, schedules, recruitment, safety or care, the more concrete that possibility must become. A contractual clause promising portability without a practical test is not an exit.
Reversibility also protects professional dignity. When a workforce loses the practice, permissions and time needed to intervene, human oversight becomes a signature placed after the machine. A person retains responsibility but no longer retains the means to exercise it. Decent design keeps judgment, learning and authority close to those doing the work. It does not romanticise the previous method; it preserves enough memory to compare outcomes and act when an exception occurs.
The following three cases are educational composites built from familiar risks in logistics, recruitment and care. They do not describe an identifiable company and do not replace technical, employment or legal assessment. They allow the same principle to be observed in different settings: an exit must exist before the problem, be usable by ordinary people and lead to an equivalent outcome without punishing the person who needs it.
A genuine exit is designed before the contract is signed#
The first task is to separate the need from the solution. Reducing travel, covering shifts more fairly or answering applications quickly are needs; depending on one platform is not. This distinction makes it possible to compare alternatives and negotiate without accepting that every feature forms an indivisible package. It also prevents money already spent from becoming an argument for retaining a tool that no longer serves its purpose.
The first task is to separate the need from the solution. Reducing travel, covering shifts more fairly or answering applications quickly are needs; depending on one platform is not.
Before procurement, the organisation should inventory the data, integrations, instructions, decisions and knowledge that would remain inside the system. Every element needs an owner, an export format, a copying frequency and a validation procedure. Exporting is not the same as receiving an enormous file that no alternative can read. A proper test reconstructs a sample elsewhere, checks relationships and permissions, and measures how long a team that did not conduct the implementation needs to understand it.
Continuity requires identifying essential functions and maximum interruption times. Some tasks can wait; others affect medication, payroll, access to work or physical safety. There must be an understandable degraded mode with defined forms, channels, owners and priorities. That mode needs limits so that it does not become an excuse for permanent precarity, but it must be possible to activate it without calling a salesperson, revealing a personal password or improvising contradictory instructions.
The contractual exit covers support periods, verifiable deletion, delivery of logs, preservation of evidence and predictable costs. It must also cover changes of ownership, supplier closure, incompatible updates and subcontractors. The ILO framework on decent work is a reminder that workplace innovation must be assessed alongside rights, protection and social dialogue. Technical dependence never removes the responsibility of the organisation deciding how a tool will be used.
Risk assessment must consider normal operation and withdrawal alike. The NIST AI Risk Management Framework proposes governing, mapping, measuring and managing risks throughout the life cycle. Applied to exit planning, it prompts questions about who can order a pause, which signals activate it and how a correction is shown to work. A committee without access to records or budgetary authority may discuss risk, but it cannot govern it.
Finally, an exercise must take place. A failure, price increase, model change or lost integration is simulated; the organisation records who detects the problem, how long continuity takes and which information is missing. Gaps are corrected before use expands. Reversibility is demonstrated not by intention but by a dated, repeatable test known to the workforce. Like an emergency exit, it earns trust only when it is clear and somebody knows how to open it.
Case one: the warehouse that could not recover its own rhythm#
In the first composite case, a logistics cooperative adopted a platform that assigned internal routes, calculated targets and distributed breaks. During the first year, it reduced walking and simplified planning. Management stopped printing location maps, centralised incidents in the application and allowed several local spreadsheets to expire. Training for new supervisors focused entirely on the supplier's dashboard. The convenience seemed reasonable because the service almost never failed.
After an update, older readers stopped synchronising and some orders appeared twice. The supplier offered a fix within seventy-two hours. The warehouse could open, but nobody had an updated priority list or knew how to reconstruct the sequence of orders. Workers were asked to remember locations and record movements on improvised sheets of paper. The supposed automation had transferred institutional memory to a system that provided no operational copy.
The incident also revealed an inequality. Long-serving workers could navigate the site and absorbed additional decisions; temporary staff received targets that the system continued calculating from incomplete data. Several breaks were marked as excessive and some performance records became artificially low. Continuing operations was not simply a matter of moving boxes. It required suspending automated consequences and protecting those unable to prove that the fault originated in the platform.
The cooperative rebuilt its exit with operations, health and safety, worker representatives, IT and staff from different shifts. It created a daily export of locations, orders and rules; documented a manual priority order; retained readable labels; and prohibited performance assessment with metrics generated in degraded mode. Every shift practised for two hours without a connection and recorded the decisions that still depended on tacit knowledge.
In the second exercise, essential activity continued at seventy per cent, breaks were preserved and every movement could later be incorporated without duplicate penalties. The solution did not attempt to match ideal speed. It guaranteed safety, traceability and a reasonable workload while the fault was resolved. The next contract required access to logs and migration support. The cooperative retained the platform, but stopped confusing loyalty to a supplier with continuity of work.
Case two: automated recruitment retained candidates, but not reasons#
In the second composite case, a retail chain adopted a service to rank applicants and recommend interviews. The supplier hosted forms, scores and notes. Human resources could download names and contact details, so it considered portability solved. After several months, a persistent difference appeared between applicants with non-linear work histories and everyone else. The company decided to pause automatic recommendations and review records.
The download contained no profile versions, relevant factors, rules in force on each date or reasons for exclusion. It preserved only the final score. There was no way to know whether an application had fallen behind because of declared availability, an incorrect educational equivalence or a model change. The supplier invoked intellectual-property protection and offered to run another ranking. The organisation possessed basic personal data, but not the memory needed to explain its decisions.
The problem affected people who might never have known they had been screened out. A review limited to those filing complaints would have left the pattern intact. The potentially exposed group was defined by version, vacancy and period; destruction of relevant logs was suspended; and applications were reopened when a verifiable justification was unavailable. Recruitment continued meanwhile with reduced criteria, human review and longer deadlines, without turning hiring urgency into permission to repeat the filter.
The new design established a decision record independent of the supplier: the purpose of each criterion, data provenance, version applied, human intervention, outcome and review route. It did not copy proprietary code or store unnecessary attributes. It preserved enough information to reconstruct a decision and compare differences between groups with privacy safeguards. An expiry date was also included so that application data could not silently become a permanent employment history.
The European Union Artificial Intelligence Act treats certain systems used in employment and worker management as high-risk, with duties depending on the system, each actor's role and the application timetable. In the composite case, the operational lesson preceded any legal label: an important consequence should not be automated when the organisation cannot preserve evidence, oversee it and offer effective review. The exit required restoring explanatory capacity, not merely recovering a list of names.
Case three: the care service that had forgotten how to say no#
In the third composite case, a home-care provider used a planner to combine visits, journeys and availability. The tool reduced calls and found useful matches. Over time, coordinators stopped intervening unless the system displayed a conflict. Manual changes required a justification for deviating from the recommendation and worsened an efficiency indicator. Although oversight existed formally, the organisation was training people to accept the automatic proposal.
A contract change increased the price and restricted essential functions. The provider wanted to migrate within three months, but found that service users' preferences, continuity agreements and many warnings were stored as unstructured notes. The most experienced coordinators remembered some context; others had moved roles. Exporting calendars did not reconstruct relationships of trust, household risks or the reasons why a visit should never change without speaking to the person receiving care.
During the transition, the system made a technically compatible match between a care worker and a household. The proposal overlooked an earlier experience that made the relationship unworkable. No harm occurred because a relative recognised the name, but the episode showed that an exit must also preserve the right to refuse. A system that migrates availability alone turns human boundaries into dispensable details. Dignity depends on keeping certain refusals visible without requiring somebody to narrate a painful situation again.
The provider created a gradual plan. It classified information by necessity, sensitivity and currency; sought consent or applied the relevant basis to transfer only what was necessary; verified critical agreements with professionals and service users; and kept teams stable during migration. An accessible channel was opened for correcting context without disclosing intimate reasons to multiple people. A named owner could stop any assignment and activate human continuity.
The exercise included a network failure, two absences, an incomplete address and a last-minute refusal. Measures covered completed visits, delays, changes of professional, coordination load, incidents and the experience of those receiving the service. The first test failed because the alternative telephone line became overwhelmed; the second added priorities, extra staffing and callbacks. That controlled failure was more valuable than a flawless demonstration: it revealed where the exit still depended on heroism.
The migration took longer than expected, but preserved continuity and reduced ambiguous information. The new contract enabled restrictions and agreements to be exported in documented formats. The provider also reserved monthly hours for coordinators to review exceptions and practise manual operation. Automation continued to add value, but the capacity to care was no longer subordinate to the availability of a platform.
A withdrawal protocol that preserves rights and learning#
A mature exit begins with agreed signals: prolonged unavailability, declining quality, unjustified differences between groups, a safety breach, unexpected cost or loss of control over data. Each signal has a threshold, a person with authority and an initial measure. Pausing a function does not always require abandoning the whole system. Modular withdrawal reduces harm and permits learning without turning every failure into a battle between blind continuity and a complete shutdown.
The protocol must organise six fronts: protect people, preserve evidence, sustain essential tasks, communicate uncertainty, correct decisions and choose the destination of data and contracts. Communication explains which function is stopping, who is affected, what alternative exists and when review will occur. Where pay, access to work or safety is at stake, disputed consequences should be suspended when possible. An organisation cannot require every affected person to discover and prove an error produced at scale.
The EU Platform Work Directive 2024/2831 addresses transparency and human oversight in algorithmic management, among other matters. Its particular application requires current advice about transposition, dates and context. As a general criterion, it reinforces a useful idea: where a system allocates, monitors or evaluates work, identifiable human decision-makers and procedures capable of reviewing outcomes must exist, not an inbox administered by the same mechanism under challenge.
After withdrawal, a review takes place without blaming the person who detected the problem. It reconstructs conditions, warnings, decisions and effects; searches for people potentially affected; and repairs downstream consequences such as scores, opportunities or reused incorrect data. The assessment distinguishes supplier faults, organisational decisions and missing resources. Outsourcing technology does not outsource the duty of care. Refunding an amount is also insufficient if a rating that will continue closing doors remains in place.
Closure requires proof of deletion or transfer, documentation of outstanding obligations and retention only of legitimate evidence for the necessary period. The organisation records which knowledge was lost, which alternative worked and which requirement will change in the next procurement. Metrics include recovery time, export accuracy, additional load, complaints, differences between groups and service quality, rather than financial savings alone.
The final question is not whether an organisation can return exactly to the past. In many cases it cannot and should not. The test is whether it retains enough freedom to change direction without abandoning workers, applicants or people receiving care. A human future uses automation without surrendering the final word, keeps practical exits and turns every withdrawal into institutional learning. Convenience then stops buying dependence and becomes an improvement that remains subject to rights, safety and repair.
