Artificial intelligence has moved quickly from experiment to everyday tool. Many employers now use AI to screen CVs, schedule shifts, draft documents, analyse productivity and support performance reviews, often through features built into software they already license. The benefits are real, but so are the legal risks, and responsibility for those risks sits with the employer rather than the software provider.

Where employers are using AI

The most common uses fall into three groups. The first is recruitment, where tools rank applications, analyse video interviews or chat with candidates. The second is people management, including performance analytics, scheduling and allocation of work. The third is monitoring, where software tracks activity, communications or location. Each raises slightly different issues, but the underlying questions are the same: what personal data is being used, how are decisions being made, and could the outcome be unfair to a particular group?

Data protection comes first

Almost every workplace AI tool processes personal data, so UK data protection law applies from the outset. Employers need a lawful basis for the processing, must tell employees and candidates clearly how their data will be used, and must keep the data secure and no longer than necessary.

Where a tool is likely to result in a high risk to individuals, which will usually be the case for recruitment screening, performance scoring and monitoring, a data protection impact assessment should be completed before the tool is introduced. The assessment is not a formality. It is the best opportunity to understand how the system works, what data it uses and what safeguards are needed.

Particular care is needed with special category data, such as health information or data revealing ethnic origin, which some tools may infer indirectly even when they are not given it directly.

Automated decisions and human review

Data protection law contains specific rules on decisions made solely by automated means that have significant effects on individuals, such as rejecting a job application or selecting someone for redundancy. Employers relying on such decisions must put appropriate safeguards in place, including the ability for individuals to obtain human intervention and to contest the decision.

In practice, meaningful human review is the most important safeguard. A manager who simply approves whatever the system recommends is not providing real oversight. Reviewers should understand what the tool does, what its limitations are, and when to depart from its output.

The discrimination risk

AI systems learn from historic data, and historic data often reflects historic bias. A screening tool trained on the profiles of past successful hires may disadvantage candidates who differ from them, even where protected characteristics are never explicitly used. Under the Equality Act 2010, an employer can be liable for indirect discrimination if a tool puts people with a protected characteristic at a particular disadvantage and the employer cannot justify it.

Disabled candidates and employees raise a further issue. Timed online assessments, video analysis or productivity metrics may disadvantage people with certain conditions, and the duty to make reasonable adjustments continues to apply. Employers should make it easy for individuals to request an alternative process.

Monitoring and employee trust

Monitoring tools can be lawful, but they must be proportionate and transparent. Covert or excessive monitoring is difficult to justify and can damage trust and engagement. Employees should know what is monitored, why, and how the information will be used.

Get the supplier contract right

Many of the risks can be managed contractually. Employers should understand how a supplier trained and tested its system, what bias testing has been carried out, where data is stored and who can access it. Contracts should address data protection responsibilities, security, audit rights, and liability if the tool does not perform as described.

What employers should do now

Employers using or considering AI tools should:

  • Map where AI is already being used across the organisation, including features in existing software.
  • Carry out data protection impact assessments for higher-risk uses before rollout.
  • Update privacy notices for employees and candidates.
  • Introduce a clear internal AI policy covering acceptable use, approval and oversight.
  • Train managers to review AI outputs critically rather than simply accept them.
  • Test outcomes for adverse impact on groups with protected characteristics.
  • Review supplier contracts for data protection, audit and liability terms.

Key takeaways

AI can make HR processes faster and more consistent, but it does not remove legal responsibility. Employers that understand the tools they use, keep humans genuinely involved in significant decisions and document their approach will be well placed as regulation and guidance continue to develop.

If you would like help reviewing your use of AI in the workplace, please contact Technology & Data partner Marcus Lee.