The legal framework UK employers must navigate

UK employers using AI in hiring, performance management, or workforce decisions face obligations under multiple overlapping frameworks. Unlike EU employers, UK employers are no longer subject to EU law post-Brexit, but the UK GDPR and Equality Act create an equally demanding compliance environment.

UK GDPR and the DUAA 2025: automated decision-making and data processing

The Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025, made significant changes to automated decision-making obligations for UK employers. Section 80 of the DUAA repealed Article 22 of the UK GDPR and replaced it with new Articles 22A-D, which came into force on 5 February 2026 (DUAA, section 80). Under the new framework, solely automated decisions with significant effects are permitted by default, provided the organisation implements specified safeguards: informing the individual that an automated decision has been made; giving them a way to make representations and request human review; and allowing them to contest the decision. The strongest pre-decision human involvement requirement, which previously prevented solely automated decisions in the absence of consent, contractual necessity, or legal authority, now applies only where the decision is based entirely or partly on special category data (health, biometric, racial origin, and others).

In practice for UK employers: automated rejection of job applications, AI-generated performance scores, and algorithmic redundancy selection remain lawful under the new framework as long as meaningful human review is available on request, individuals are informed that automated processing was used, and a contestation mechanism exists. The ICO ran a public consultation on draft updated automated decision-making guidance from 31 March to 29 May 2026, and as of mid-2026 had not yet published the final version (ICO, ADM guidance consultation). For employment decisions involving special category data, health assessments, disability-related adjustments, pregnancy-related decisions, the stronger safeguards still apply.

For all AI processing of employee data, you need a lawful basis under Article 6 (typically legitimate interests or contractual necessity) and, for special category data, a basis under Article 9 (typically explicit consent or employment law necessity under Schedule 1 of the Data Protection Act 2018). Run a legitimate interests assessment or Data Protection Impact Assessment before deploying AI tools that process employee data.

You must also inform employees about AI use in their privacy notice, Articles 13 and 14 require transparency about automated decision-making including meaningful information about the logic involved. A generic statement that "we use technology in employment processes" does not satisfy this obligation.

The Equality Act 2010

The Equality Act 2010 applies fully to AI-driven employment decisions. The most common AI risk is indirect discrimination, a practice that appears neutral but puts a group sharing a protected characteristic at a particular disadvantage. You must show the practice is a proportionate means of achieving a legitimate aim or it is unlawful.

Common indirect discrimination risks in AI hiring tools include: tools trained on historical data that reflect past discriminatory hiring patterns; skills-based filters that proxy for protected characteristics; geographical filtering that correlates with ethnicity; and communication style assessment tools that may disadvantage neurodivergent candidates. Require your AI vendors to provide bias testing data covering all nine Equality Act protected characteristics, not just sex and race.

The Equality and Human Rights Commission (EHRC) has published guidance on AI and the public sector equality duty and a checklist for public bodies using AI, alongside updated recruitment advertising guidance addressing discrimination risks from generative AI (EHRC, artificial intelligence guidance). It has enforcement powers under the Equality Act 2006 including the ability to conduct formal investigations and issue unlawful act notices. Employers found to have discriminated face unlimited compensation in Employment Tribunal proceedings.

ICO employment guidance

The ICO replaced its former Employment Practices Code with topic-specific guidance covering monitoring workers, recruitment and vetting, and keeping employment records (ICO, employment information guidance). This sets out expectations for monitoring at work, data retention, and worker privacy. For AI specifically, the ICO expects employers to: carry out a DPIA before deploying AI tools that process employee personal data at scale; inform workers in clear terms what monitoring AI is used and why; and ensure monitoring is proportionate to a legitimate purpose.

Covert AI monitoring of employees is only lawful in very limited circumstances, where there is a specific, serious suspected criminal act and informing the employee would prejudice the investigation. Routine covert monitoring by AI is not lawful.

Trade union obligations

If you recognise a trade union, AI in the workplace may become a subject of collective bargaining, particularly where AI is used in performance management, scheduling, or workforce planning. Unite has published a model AI agreement for use by workplace representatives in collective bargaining (Unite, AI guide and model agreement), and other unions, including GMB, have negotiated specific agreements addressing algorithmic management. Be prepared for union requests for information about AI tools used in employment decisions, the Information and Consultation of Employees Regulations 2004 creates a right to information and consultation on significant changes in work organisation.

The Employment Rights Act 2025

The Employment Rights Bill, introduced October 2024, received Royal Assent on 18 December 2025 as the Employment Rights Act 2025. As enacted, section 25 reduces the qualifying period for unfair dismissal claims from two years to six months, rather than creating the day-one right originally proposed in the Bill, and this change is due to come into force on 1 January 2027 under commencement regulations. While not AI-specific, it will affect AI-driven performance management and dismissal processes. Employers should monitor implementation guidance ahead of the 2027 commencement date.

Practical steps for UK employers

Before deploying any AI tool in employment: complete a DPIA; update your employee privacy notice to describe the AI tool and its purpose; conduct bias testing across all nine Equality Act characteristics and document the results; implement a genuine human review process for consequential AI decisions; and train managers on how the AI tool works and its limitations. In recruitment specifically: check whether your AI hiring vendor has carried out UK GDPR-compliant processing impact assessments; review your privacy notice to candidates; and ensure your process allows candidates to request human review of automated rejection. Document all of this, if an Employment Tribunal or ICO investigation arises, your documentation is your primary defence.

Related reading

Further reading: ICO AI guidance