AI and employment law for UK employers: recruitment, monitoring, decisions and consultation.
By Zain Masroor · 9 October 2026 · 13 min read
When a UK employer uses AI on applicants or staff, four bodies of law apply. Data protection: the ICO’s 2026 report on automated decision-making in recruitment expects employers to test regularly for bias, to tell candidates AI is used and how, to explain the right to challenge and obtain human review, and to assess honestly whether a human is meaningfully involved; the Data (Use and Access) Act 2025 widened the lawful bases for significant automated decisions but kept those safeguards. Equality law: the employer, not the vendor, answers for a discriminatory outcome. Monitoring rules: staff must be told what is monitored and why, and it must be necessary and proportionate. And the Employment Rights Act 2025, which received Royal Assent in December 2025, is being brought in by stages with consultation duties that a firm changing how work is done should read. This guide is practical, not legal advice.
What the ICO found in 2026, and what it expects
The ICO’s 2026 report on automated decision-making in recruitment drew on evidence from more than thirty employers gathered between March 2025 and January 2026, and published its expectations alongside a consultation on updated guidance that ran to 29 May 2026. Employers are expected to monitor proactively for bias, testing regularly for biased outputs and asking vendors about their own bias testing when procuring tools; to be transparent with jobseekers about whether automated decision-making is used and how it works; and to explain the right to challenge a decision and request human review. The finding the ICO emphasised most was that employers underestimate when their tools are actually making decisions rather than supporting a human, and must assess the level of meaningful human involvement honestly.
For an SME the translation is short. Screening is advisory, with the reasons shown and a recruiter deciding who is called. Candidates are told in the privacy notice. There is a route to challenge and a person who reviews. And outcomes are checked by protected characteristic, monthly if volume allows, with the check written down.
Automated decisions after the Data (Use and Access) Act 2025
The Act replaced Article 22 of UK GDPR with Articles 22A to 22D and, in the ICO’s words, opened up the full range of lawful bases for significant automated decisions, including legitimate interests, so long as safeguards are in place: the individual is told, can make representations, can contest the decision and can obtain human intervention. Decisions based on special-category data remain more restricted. The ICO’s guidance page confirms all of the Act’s data protection provisions are in force as of June 2026. A significant decision, for this purpose, is one with legal or similarly significant effects on the person, which rejecting an applicant, allocating shifts that affect pay, or triggering a disciplinary process can be. The DPIA is where an employer records that the safeguards exist and how.
Discrimination: the employer answers for the tool
The Equality Act does not care whether a decision was made by a person or a model. If an AI screening tool scores applicants from one group lower for reasons unrelated to the job, the employer has discriminated, and “the vendor built it” is not a defence. The CIPD’s employment-law guidance lists bias in AI systems among the risks employers carry, alongside data protection and grievances arising from AI decisions. The controls are the ones the ICO expects: test on a sample that includes the groups affected before go-live, monitor outcomes by protected characteristic after, keep the reasons for scores visible so a human can disagree, and keep a human deciding. Where a vendor will not explain how its tool scores, that is the answer to whether to buy it.
Monitoring staff, including their use of AI
Monitoring is processing personal data, and the ICO’s employment guidance expects it to be necessary, proportionate and explained to staff in advance. Reviewing what individuals put into an AI assistant is monitoring. Using AI to analyse productivity, emails or calls is monitoring, and often systematic enough to need a DPIA. The practical rule for an SME is to say in the staff privacy notice and the acceptable-use policy what is monitored, why, and what triggers a review, and to review for a stated reason rather than as routine. Consent is the wrong basis, because an employee cannot freely refuse; legitimate interests with a balancing test is the usual one.
The Employment Rights Act 2025, and changing how work is done
The Employment Rights Act 2025 received Royal Assent in December 2025 and is being implemented in stages, with many provisions waiting on regulations, codes of practice and consultations that the government has been running through 2026. Its subject is broader than AI, but two things follow for a firm automating work. Consultation duties, including changes to collective redundancy thresholds, apply when automation changes roles enough to put jobs at risk, and Acas and the CIPD both track the commencement dates. And the honest conversation our change-management guide recommends, what the tool takes and what it does not, is also the beginning of the consultation the law may require. A firm that involves the people whose work changes in deciding how it changes is meeting both.
A checklist an SME can complete
Not legal advice; a working list drawn from the ICO’s and CIPD’s published positions.
Common questions
Can a UK employer use AI to screen job applicants?
Yes, as advisory screening with a human deciding, candidates told, a route to challenge and human review, bias tested and monitored, and a DPIA. The ICO’s 2026 report sets out exactly those expectations.
What did the ICO say about AI in recruitment in 2026?
Test regularly for bias and ask vendors about theirs, be transparent with candidates about automated decision-making, explain the right to challenge and obtain human review, and assess honestly whether a human is meaningfully involved rather than rubber-stamping.
Can AI make a decision about an employee or applicant on its own?
A significant decision made by automated means needs the safeguards in Articles 22A to 22D: the person is told, can make representations, can contest it and can obtain human review. Special-category data is more restricted. Most SMEs keep a human deciding.
Who is liable if an AI tool discriminates?
The employer. The Equality Act applies to the outcome regardless of whether a person or a model produced it, and the vendor is not a defence.
Can we monitor what staff put into AI tools?
Yes, if it is necessary, proportionate and stated in advance, on legitimate interests rather than consent. Routine reading of conversations is hard to justify; review for a stated reason is not.
Does the Employment Rights Act 2025 cover AI?
Not specifically, but its consultation duties apply when automation changes roles, and it is being implemented in stages through 2026 and beyond. Check the commencement dates with Acas or the CIPD before a change that affects jobs.
Do we need a DPIA to use AI on staff data?
For scoring, triage, monitoring or any significant automated decision, yes. It records the lawful basis, the safeguards, the bias testing and the human involvement.
Using AI on applicants or staff?
We build screening, chasing and booking with the ICO’s safeguards designed in: advisory scores with reasons, a person deciding, outcome monitoring and the DPIA written alongside the system.