The difficulty which you’re overlooking, is that with AI, it may not be possible to determine what is lawful. So, for example, a company replaces part of its recruitment team with AI. Let’s say that the bot just sifts incoming applications and CVs and does the shortlisting. Without access to the algorithm, and the knowledge to interrogate it and interpret the results, you can’t know if the shortlisting was genuinely the best candidates for the role, or if people were excluded on the basis of gender, ethnicity, disability, or other protected characteristics. Similarly any AI process that makes decisions which affect people.