There is no single law on AI and employment law in the UK. If you use AI to hire, manage, monitor or discipline people, the laws you already know apply to it: UK GDPR and the Data Protection Act 2018, the new automated decision-making rules that took effect on 5 February 2026, the Equality Act 2010, and ordinary employment law on fairness and trust. This guide explains each in plain English and ends with a checklist.
This is general information, not legal advice. Parts of this area are still moving, so take advice on any specific decision.
Is there an AI law in the UK?
No. The UK has no AI-specific Act for employers. The government’s approach, set out in its response on a pro-innovation approach to AI regulation, is for existing regulators such as the ICO to apply five principles in their own areas: safety, transparency, fairness, accountability and the ability to challenge outcomes.
One thing is new. Since 12 May 2026, regulations have required the Information Commissioner to prepare a statutory code of practice on personal data in AI and automated decision-making. Watch for its consultation.
If you have staff or customers in the EU, the EU AI Act may apply to some of your uses. Take specific advice on that.
UK GDPR and the Data Protection Act 2018
Most AI tools in HR process personal data, so data protection law is where most of your duties sit.
- Lawful basis. You need one for each use. The ICO says consent is not usually appropriate in employment, because of the imbalance of power.
- Transparency. Your staff and candidate privacy notices must say what AI you use, on what data and why.
- DPIA. The ICO says that in the vast majority of cases, using AI is likely to be high risk and so legally requires a data protection impact assessment. If you decide a use is not high risk, record why.
- Data minimisation. Give the tool only the data it needs. A tool drafting a rota letter does not need sickness history.
- Subject access. Employees can ask for their personal data, including AI outputs about them, and you must respond within one month in most cases.
The ICO’s guidance on AI and data protection is the main reference. It notes it is under review after the Data (Use and Access) Act 2025.
Automated decision-making about employees under UK GDPR
The Data (Use and Access) Act 2025, section 80, replaced the old Article 22 of UK GDPR with new Articles 22A to 22D. They came into force on 5 February 2026. Decisions taken before that date stay under the old rules.
In plain terms:
- A significant decision is one with a legal or similarly significant effect, such as rejecting a candidate, setting pay or dismissing someone.
- It is solely automated if there is no meaningful human involvement. A manager clicking “approve” on whatever the tool says is unlikely to count.
- Solely automated significant decisions are now allowed more widely, but you must have safeguards: tell the person about the decision, let them make representations, let them get human intervention, and let them contest it.
- Stricter limits apply where the decision uses special category data, such as health. Only narrow conditions, such as explicit consent, allow it.
The ICO’s draft guidance and its recruitment findings
On 31 March 2026 the ICO consulted on draft updated guidance on automated decision-making. The consultation closed on 29 May 2026. At the time of writing, the guidance page still described it as draft, with final guidance to follow, so check it for the latest version.
Alongside it, the ICO published Recruitment rewired, based on over 30 employers. It found candidates were not always told about automated decisions, human involvement was not applied consistently, and bias monitoring needed to improve. The ICO expects employers to test regularly for biased outputs (it suggests considering monthly reviews), tell candidates when automation is used, and explain how to challenge a decision and ask for human review. The government’s Responsible AI in Recruitment guide covers what to ask suppliers.
The Equality Act 2010
AI does not change discrimination law, and buying a tool from a supplier does not move your responsibility to them. Under section 39, you are responsible for how you recruit and treat staff, whichever tool you use.
- Indirect discrimination (section 19). A screening rule that looks neutral can disadvantage a protected group. For example, marking down CVs with career gaps may hit women and disabled candidates harder.
- Reasonable adjustments (section 20). A timed online test or automated video interview may disadvantage some disabled candidates. Offer an alternative route and say how to ask for it.
- Supplier evidence. Ask what bias testing was done, on what data, and how often it is repeated. Keep the answers.
Monitoring employees with AI
The ICO’s guidance on monitoring workers applies to AI-driven monitoring such as productivity scoring. You must tell workers about monitoring, have a lawful basis and use the least intrusive method. You must do a DPIA before high-risk monitoring, and the ICO gives keystroke monitoring and performance management as examples. Covert monitoring is only justified in exceptional cases. This guidance is also under review after the 2025 Act.
Trust, confidence and consultation
Every employment contract includes an implied duty of mutual trust and confidence. Bringing in AI that changes how people are watched or judged, without telling them, puts that at risk. Acas advises consulting staff and representatives before introducing AI, and notes that expecting some roles to use it may mean changing their terms. A clear AI policy for employees sets the rules for both sides.
AI in disciplinary and performance decisions
A fair process still means investigating, sharing the evidence and letting the employee respond, as the Acas Code of Practice on disciplinary and grievance procedures sets out. If AI summarises evidence or scores performance, a manager must check it and make the decision, and be able to explain it. “The system flagged it” is unlikely to be enough on its own. Acas’s 2026 consultation on a new draft code asked about AI in these processes but did not propose specific rules.
Checklist: AI use case, legal risk, what to do
| Use case | Main legal risk | What to do |
|---|---|---|
| CV screening and shortlisting | Solely automated significant decisions; indirect discrimination | DPIA, meaningful human review, tell candidates, bias testing |
| Online tests and video interviews | Disability discrimination | Offer reasonable adjustments and an alternative route |
| Productivity or activity monitoring | Excessive monitoring; trust and confidence | DPIA, tell staff, least intrusive method, consult |
| AI-assisted performance ratings | Unfair outcomes; bias | Manager decides and documents reasons |
| AI summaries in disciplinary cases | Unfair process | Check against source evidence; employee can respond |
| Staff pasting HR data into public chatbots | Data breach; confidentiality | AI policy, approved tools, training |
| Employee-facing assistants answering pay or policy questions | Accuracy; data access | Limit to each person’s own data; route complex questions to a person |
How Givver approaches AI
Givver uses AI only in a few features where it saves time. Customer data is not used to train AI models, and the AI payslip assistant only sees the employee’s own data. Read more on AI in Givver and security.
FAQs
Is there an AI employment law in the UK?
No single one. UK GDPR, the Data Protection Act 2018, the Equality Act 2010 and ordinary employment law all apply to AI use at work.
Can an employer make automated decisions about employees under UK GDPR?
Since 5 February 2026, yes, more widely than before, but only with safeguards: tell the person, let them make representations, get human intervention and contest the decision. Stricter limits apply to special category data.
Do we need a DPIA to use AI in HR?
Usually. The ICO says most uses of AI are likely to be high risk and need one. If you decide not to do one, record why.
Who is liable if a supplier’s AI tool discriminates?
You, as the employer making the decision. Check the supplier’s bias testing and keep a human in the loop.
Next steps
Map where AI already touches decisions about people, do a DPIA for each, and write the rules down. Then review them every 6 to 12 months.