Performance review, goal-setting & 360-feedback assistant

Review season costs managers days of writing and HR weeks of chasing, and the result is often vague, recency-biased and inconsistent between teams. An LLM assistant condenses the evidence (goals, 1:1 notes, 360 comments) into structured drafts, helps formulate measurable goals, and checks the final texts and ratings for bias and gaps before calibration. The manager stays the author and decider. In the EU this is a regulated worker-evaluation setting: works council, GDPR and the AI Act must be handled before go-live.

Problem & value

• Today: managers write 5-15 review texts from memory and scattered notes; 360 free-text answers are read and summarised by hand (or by HR); goals are vague ("improve communication"); calibration meetings compare ratings from managers with very different standards.
• AI value: saves writing and reading time, makes reviews evidence-based (each statement traceable to a source), raises the quality and measurability of goals, and surfaces inconsistent language or ratings that humans overlook.
• Vendor-reported benefit: Leapsome advertises a time saving of about two hours per calibration round through drafted reviews; this is a marketing claim, not an independent study [3]. Independent, peer-reviewed effect sizes for LLM-written reviews are still scarce, so measure your own baseline.
• Not a scoring engine: the legitimate value is drafting, summarising and quality-checking. Letting a model derive ratings, promotion or pay decisions is what moves the system into the highest regulatory burden (see Risks).

Variants

• SMB (20-250 staff): annual or semi-annual review with manager and self-assessment; assistant mostly drafts text and goals. Often no works council, but GDPR and fairness duties still apply.
• Enterprise: cycles with 360 feedback, calibration committees, competency frameworks and talent reviews; integration with HRIS (Workday, SAP SuccessFactors, Personio) and strict works-council agreements.
• Public sector: Beurteilungswesen with legally prescribed rating scales and Personalrat co-determination; assistant limited to drafting and wording checks; the formal Beurteilung stays human-authored.
• Engineering teams: evidence from tickets and pull requests as input. This is the most sensitive variant, because it edges into activity monitoring; use only with explicit agreement and without individual productivity scores.
• Upward and team feedback only: summarise manager feedback or team-health surveys at aggregate level (see LANG-013, LANG-019); lowest risk.
• Private use: self-reflection tools for annual self-appraisals or job-interview preparation; no regulatory burden for the individual.

How it works

1. sources (goal tool, 360 survey, 1:1 notes, praise, optional work artefacts)
2. consent/permission filter + pseudonymisation (only data covered by the works agreement)
3. retrieval per employee and review period (embeddings + metadata filter)
4. LLM: theme extraction, evidence-linked summary, draft review, goal suggestions
5. quality & bias checks (vague/gendered/personality wording, recency, missing evidence)
6. manager edits and owns the text
7. HR calibration view (distributions, outliers)
8. final review stored in HRIS; AI-suggestion vs. final-text log

• Summarisation of 360 feedback: LLM clusters comments into themes, keeps minimum-rater thresholds (e.g. no summary below 3-5 raters) so that individual raters cannot be identified, and quotes only after anonymisation.
• Goal drafting: LLM rewrites a rough goal into SMART/OKR form with measurable key results and links it to the team goal; the employee and manager agree it in conversation.
• Bias and quality checks: prompts or a small fine-tuned classifier flag adjectives about personality instead of behaviour, gendered descriptors, unsupported superlatives and statements without evidence. Calibration analytics compare ratings by team, gender, working-time model and tenure; these are statistics for humans, not automatic corrections.
• Human-in-the-loop: the manager writes or approves every sentence; ratings are entered by humans; HR reviews calibration outliers; the employee can respond to the review.

Data preparation

Needed are goals and OKRs, 1:1 notes, feedback and survey results, role profiles and competency models. They typically live in the HRIS, a talent tool, Excel sheets, Word forms, e-mail and chat, and managers' private notes. Gaps: inconsistent goal formats, free-text feedback of very uneven quality, no shared competency definitions, notes spread across tools, and unclear access rights; data about health, union membership or similar must be excluded.

Steps: define the competency and rating scheme first (PREP-019); restructure goal and feedback sheets into tidy tables (PREP-011); export from HRIS via API or CSV (PREP-005); write a short glossary of terms like "meets expectations" (PREP-015); define which data may be used for which purpose and clarify the legal basis (PREP-024, PREP-025); pseudonymise data for tests and prompt tuning (PREP-022); restrict retrieval to the manager's own team. Tools: HRIS exports, n8n, spreadsheets. Roughly 25 to 35 percent of the effort; the larger work is agreeing on the process, not on technology. See GUIDE-003.

Implementation paths

Which path for whom

• smb: A, because HR platforms with built-in review features and EU hosting exist at SMB prices and the review process is standard; the provider carries most product duties.
• enterprise: B, because large companies have custom review cycles, need integration with HRIS and a shared internal AI platform, and face strict works-agreement limits that a bought black box may not meet.
• public: B, on a sovereign EU/German cloud, because staff data in public bodies is subject to strict sovereignty and staff-council rules.
• developer: C, because self-hosted models allow building review tooling where employee data never leaves the customer's environment.

Path A — Buy (recommended for most SMBs)

• Performance/talent platforms with built-in AI: Lattice (AI review drafting from 1:1s, feedback and goals; states it does not make performance decisions and runs on OpenAI models) [2]; Leapsome (Berlin office; per-employee summaries before review rounds, AI goal suggestions, claims GDPR and AI Act readiness) [3]; Culture Amp (comment summaries, sentiment analysis, AI features switchable per organisation, generative models from Google Vertex) [4]; also Workday, SAP SuccessFactors, Personio, Microsoft Viva/Copilot in M365 and 15Five.
• Check: EU data residency and sub-processors (which LLM provider, where), opt-out of training on your data, switchable AI features per module, rater anonymity thresholds, audit trail, role-based access, provider documentation for AI Act high-risk duties (Art. 13 instructions for use), works-council-ready documentation.
• Choose A when: you already have or need a review tool, fewer than a few thousand employees, no special data-sovereignty constraints.

Path B — Build on cloud APIs

• Models: frontier LLMs with EU processing (Claude, GPT and Gemini via Azure/AWS Bedrock/Vertex EU regions) or EU providers such as Mistral; a long-context model handles a year of notes per employee. Use structured outputs for summaries with source IDs.
• Orchestration: n8n or Power Automate reading from the HRIS and survey tool; a vector store (pgvector, Qdrant) per tenant with strict per-employee retrieval filters; PII pseudonymisation before the call.
• Integration points: HRIS APIs (Personio, SuccessFactors, Workday), survey tools, Teams/Slack for nudges to managers.
• Choose B when: your review process is custom or the SaaS tool has no AI, and no on-prem requirement exists. Note: building your own system makes you the provider and deployer under the AI Act if you put it into service for your own staff.

Path C — Self-host (open source)

• Models: open-weight instruct models in the 30-120B range (e.g. Mistral Small/Medium-class, Qwen3, gpt-oss-120b or Llama-family releases; verify licence terms) served via vLLM or Ollama; German-language quality needs testing on real review texts.
• Stack: embedding model + pgvector/Qdrant, guardrails/PII filter (Presidio), n8n or Camunda, self-hosted survey tool (LimeSurvey) as input.
• Hardware: HW3 (one 48-96 GB GPU) for a 70-120B-class model, a 24-32 GB card (HW2) is enough for a ~14-30B model if text quality is acceptable. Review season is bursty, so a small shared GPU suffices.
• Choose C when: works council or public-sector rules demand that employee data never leaves your infrastructure.

Path D — Custom training

Rarely worthwhile for generation. A small fine-tuned encoder classifier for biased/vague wording or a company-specific competency tagger can be trained on a few thousand labelled review sentences; labelling must be done by trained HR staff. Fine-tuning on past reviews risks reproducing historical bias, so audit training data first.

State of the art (2026)

• Embedded copilots in HR suites are standard: review drafting from accumulated evidence, summarised 360 feedback, goal suggestions and manager coaching prompts [2][3][4].
• Long-context LLMs can read a full year of notes at once, but evidence-linked outputs (each claim cites a note) are the practical quality control.
• Bias detection is mostly lexical/LLM-based wording analysis plus statistical calibration views; it detects patterns, it does not prove fairness.
• Limits and failure modes: hallucinated achievements, generic "HR-speak" that sounds identical for everyone, sycophancy towards the manager's prompt, loss of nuance, systematic differences in how the model writes about different groups (check by A/B testing of outputs), over-reliance by time-pressed managers, rater de-anonymisation through distinctive quotes, and "automation bias" in calibration. LLM summaries of feedback should never be the only input to ratings.

Shared resources & combinations

• Same stack (llm-general + embedding-text + vector-db + guardrails): LANG-004 (HR documents, references), KNOW-003 (HR self-service assistant), LANG-013 and LANG-019 (feedback and survey analysis), SPEECH-001 (meeting notes feed 1:1 evidence). One internal LLM server (HW3) and one PII pseudonymisation layer can serve all HR assistants.
• Neighbours with different risk: PRED-012 (attrition prediction) and LANG-032 (communications surveillance) use employee data for prediction/monitoring and carry stricter limits; do not feed their outputs into reviews. CONV-017 (recruiting chatbot) and AGENT-009 (onboarding) share HRIS integration and works-council templates.
• Data pipeline: HRIS connector, role/competency taxonomy and a consent/permission registry are reusable across all HR use cases.

Effort, cost & KPIs

• Path A: days to weeks to activate the AI module; usually priced per employee per month as an add-on.
• Path B: 2-3 months incl. works-council agreement, DPIA and integration; token cost is small compared with manager time.
• Path C: 3-5 months; one GPU server plus operations; main effort is quality testing in German.
• KPIs: manager time per review, review completion rate and timeliness, share of reviews with evidence references, goal quality (share of goals with measurable key results), spread between teams in rating distribution, employee-perceived fairness in pulse surveys, edit rate of AI drafts, number of bias flags accepted.

People & change

Involve management and HR from the start as process owners, the works council before any tool selection, the DPO for the DPIA, and IT security for access rights. Managers and employees as end users join the pilot design; ideally AI champions come from HR and from line managers.

Works council: yes. The system processes performance data and is objectively suited to monitor behaviour or performance (§87(1) no. 6 BetrVG, BAG); §90(1) no. 3 requires information on AI in work processes, §80(3) permits engaging an AI expert, and §95(2a) covers selection guidelines if used for staff decisions. Public sector: Personalrat. A works agreement should fix purposes, forbidden uses (no automatic ratings, no ranking) and data access. See GUIDE-004.

A DPIA under Art. 35 GDPR is very likely (systematic evaluation of employees); also conclude an AVV (GUIDE-005). The use case is high risk under the AI Act when it influences decisions on employees; Annex III duties apply from 2 Dec 2027. Art. 4 requires support of AI literacy: train managers on bias and on checking AI summaries (GUIDE-006). Communicate early that AI drafts and structures but managers decide and talk with employees (GUIDE-008). Pilot with one volunteer team. Typical concerns are surveillance and unfair ratings; address with transparency, employee access to summaries and human decision.

Risks, regulation & compliance

• EU AI Act: AI systems intended to monitor and evaluate the performance and behaviour of persons in work relationships, or to make decisions on terms of work, promotion or termination, are high-risk under Annex III point 4(b) [1]. Pure writing aids that only improve wording may fall outside, but a system that summarises evidence into assessments, scores or rankings should be treated as high-risk. Deployer duties (Art. 26) include use per instructions, competent human oversight, relevant input data, log retention of at least six months, and informing workers' representatives and affected workers before use [5]. The application date of the Annex III duties is stated as 2 December 2027 on the cited page (after the EU's postponement); verify the current date before planning [5]. Art. 4 AI literacy already applies. Never infer emotions of staff from voice, video or text, as this is prohibited at the workplace (Art. 5(1)(f)) [6].
• GDPR: employee data under Art. 6 and §26 BDSG; Art. 22 prohibits decisions based solely on automated processing with significant effects [7], so a human must really decide. A DPIA is likely required; transparency, purpose limitation and deletion periods for feedback and notes apply. Rater data needs special protection. Art. 88 GDPR allows works agreements as legal basis [7].
• Co-determination (Germany): introducing technical systems suited to monitor employee behaviour or performance triggers works-council co-determination under §87(1) No. 6 BetrVG [8]; a Betriebsvereinbarung should define data sources, forbidden uses (no automated rating, no individual productivity scores), access rights and retention. Public-sector equivalents: Personalvertretungsgesetze.
• Other risks: discrimination (AGG), unreliable summaries that wrongly harm careers, chilling effects if staff fear total evidence collection, vendor lock-in and sub-processor transfers to third countries.
• Mitigations: human authorship and sign-off, evidence links, employee right to comment and to see what AI was used, regular bias audits of outputs, opt-out of AI features per module, restricting inputs to agreed sources.

Getting started

1. Clarify scope with HR, data protection and the works council: allowed inputs, forbidden uses, drafting-only principle. Conclude a Betriebsvereinbarung or pilot agreement.
2. Do a DPIA and classify the intended use under Annex III 4(b); ask vendors for their AI Act documentation.
3. Pilot with 2-3 volunteer teams: AI drafts only, managers edit, compare time and quality against the last cycle.
4. Add wording and calibration checks; review a sample of AI drafts for differences between groups.
5. Train managers (AI literacy, Art. 4), publish a short transparency note for employees, and review KPIs after the cycle.

Sources

1. EU AI Act, Annex III (high-risk systems), point 4 Employment — https://artificialintelligenceact.eu/annex/3/
2. Lattice — AI features and principles — https://lattice.com/ai
3. Leapsome — product page (AI review summaries, goal suggestions) — https://www.leapsome.com
4. Culture Amp — AI features and principles — https://www.cultureamp.com/platform/ai
5. EU AI Act, Article 26 — Obligations of deployers of high-risk AI systems — https://artificialintelligenceact.eu/article/26/
6. EU AI Act, Article 5 — Prohibited AI practices — https://artificialintelligenceact.eu/article/5/
7. Regulation (EU) 2016/679 (GDPR), Art. 22 and Art. 88 — https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
8. Betriebsverfassungsgesetz §87 (Mitbestimmungsrechte) — https://www.gesetze-im-internet.de/betrvg/__87.html