Where AI already helps in HR
Most HR work in a small or mid-sized company is admin: checking requests, chasing missing data, producing documents, answering the same questions. This is where AI saves time with little risk, because it applies rules you set in advance. The more a task judges a person, the stricter the law and the more a human sign-off matters.
| Use case | Risk level | Human approval needed? |
|---|---|---|
| Answering policy questions (leave, expenses, remote work, bank holidays) | Low | No. Answers should cite the policy; individual cases go to HR |
| Leave and absence admin (balances, cover, team calendar) | Low | Yes for refusals and exceptions; routine cases under fixed rules need not |
| Onboarding tasks (account requests, meetings, welcome, checklist) | Low | No, spot checks are enough |
| Drafting documents (contracts, letters, references) | Medium | Yes, before anything is sent or signed |
| Payroll prep checks (missing data, changes, overtime) | Medium | Yes, HR or the payroll provider signs off |
| Expense checks (receipts against policy, mileage, per diems) | Low to medium | Yes when a claim is cut or refused |
| Recruiting screening (sifting, ranking, scoring applicants) | High: EU AI Act Annex III; UK GDPR and Equality Act | Yes, always |
| Monitoring or scoring performance, assigning work by personality | High: EU AI Act Annex III | Yes, always |
| Reading emotions, for example in video interviews | Banned in the EU since 2 February 2025 | Not allowed for EU staff, except for medical or safety reasons |
Low risk is not no rules. Leave and onboarding still process employee data, so data protection law applies. The line that matters is whether the AI carries out a rule you wrote or forms a judgement about a person.
What the law requires
The UK has no AI-specific law for employers. The rules come from data protection and equality law. If you employ people in the EU, the EU AI Act applies on top.
- Automated decisions, UK GDPR. Since 5 February 2026, Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025, replace the old Article 22. A significant decision (one with a legal or similarly significant effect, such as rejecting an applicant) may now be taken solely by automated means on any lawful basis, but only with safeguards: you tell the person, let them make representations, offer human intervention and let them contest the decision. Decisions based on special category data, such as health or ethnicity, stay restricted to narrow cases such as explicit consent.
- Meaningful human involvement. A decision only counts as made by a person if the person can change it and weighs the facts. Someone who approves every suggestion unread is unlikely to count.
- Impact assessment. A data protection impact assessment (UK GDPR Article 35) is required for processing likely to result in high risk. The ICO lists innovative technology, including AI, and the evaluation or scoring of people among the signs of high risk. Do it before you start, not after.
- Recruiting. The ICO audited AI recruitment tools between August 2023 and May 2024 and made 296 recommendations. It found tools that let recruiters filter out people by protected characteristics or inferred gender and ethnicity from names. Its advice to employers: tell candidates how AI processes their data, collect only what you need and complete an impact assessment early (ICO, November 2024).
- Discrimination. Under the Equality Act 2010 you are responsible for the outcome of a tool you use, not the vendor. A screening rule that puts people with a protected characteristic at a disadvantage is indirect discrimination unless you can justify it, and disabled candidates may need reasonable adjustments, for example an alternative to a timed online test.
- Telling staff. UK law has no works council with a veto. If you recognise a trade union or have an information and consultation agreement, check whether it covers new technology, and tell employees what the AI does and which data it uses.
Staff in the EU bring the EU AI Act (Regulation (EU) 2024/1689) into play. It covers deployers established in the EU and also deployers outside it where the AI's output is used in the EU. Since 2 February 2025 it bans AI that infers emotions in the workplace, except for medical or safety reasons, and requires employers to address AI literacy among staff who use AI (Article 4). Since 27 July 2026, after Regulation (EU) 2026/1744 (the Digital Omnibus), that duty is to take measures that support AI literacy rather than to ensure a set level.
Annex III point 4 classes AI used for recruitment and selection, for decisions on promotion and termination, for allocating tasks based on behaviour or personal traits and for monitoring and evaluating performance as high-risk. Employers using it must follow the provider's instructions, assign human oversight to competent people, monitor it, keep its logs for at least six months and inform workers' representatives and affected workers before it goes live (Article 26). These rules were due on 2 August 2026; Regulation (EU) 2026/1744, published on 24 July 2026, moved them to 2 December 2027. That is the date that applies as of 22 October 2026.
This page reflects the law as of 22 October 2026 and is not legal advice.
Assistant or agent: the difference
An AI assistant answers when someone asks. An employee wants to know how much leave she has left; the assistant reads her balance and replies. It does nothing nobody asked for.
An AI agent acts on its own when something happens or a schedule says so. When a new hire is added, it requests accounts, books meetings, sends the welcome message and ticks off the checklist. It runs when nobody is logged in.
In practice: with an assistant, the person asking checks the answer. With an agent, three things must be settled first: what it may read and change, which steps need a person's approval, and where each run is recorded. Without all three, an agent has no place in HR.
How to start
- 1.
Pick one admin-heavy workflow
Choose something that happens often, follows clear rules and judges nobody: onboarding, leave requests or checking data before payroll. Write the steps down the way you would explain them to a new colleague. Recruiting and performance reviews are not a good first project.
- 2.
Set permissions
Decide which data the AI may read and which it may change, and give it no more than it needs. Name the steps a person must approve: anything involving money, contracts or a refusal.
- 3.
Involve workers' representatives
If you have a recognised union, an employee forum or, in Germany, a works council, bring them in while you plan, not the week before launch. Without one, tell employees directly what the AI does, which data it uses and who to ask. Check with whoever handles data protection whether you need an impact assessment.
- 4.
Log every action
Each run should show what the AI read, decided and changed, when and why. Then a question from an employee, a union or the ICO gets an answer from the record, not from memory.
- 5.
Review after 30 days
After a month, read the logs. Where was the AI right, where did someone have to correct it, which approvals were a formality? Then widen the permissions, narrow them or add the next workflow.
Where Worklayer fits
Worklayer is our own product: HR software with an AI assistant for employees and AI agents for admin work such as onboarding, leave and absence, expenses, documents and payroll preparation. A new agent starts with no permissions. Only admins grant them, area by area: none, read, or read and write. A step that needs a permission it lacks stops and asks an admin. Some actions can never be granted, such as deleting employee records or changing compensation or bank details. How permissions work.
Every run is recorded step by step: what happened, when and why. See the audit trail. Worklayer is not built for screening applicants or rating performance: it has no recruiting or performance module, and it does not run payroll, UK or otherwise; your payroll provider or payroll software still does.
Frequently asked questions
Yes. There is no AI-specific ban for employers in the UK. You must follow UK GDPR, including the rules on automated decisions and impact assessments, and the Equality Act 2010, which makes you responsible for discriminatory outcomes of any tool you use.
In the UK, since 5 February 2026, a solely automated rejection is possible if you tell the applicant, let them make representations and offer human review and a way to contest it; decisions based on special category data stay restricted. In the EU, AI that screens applicants is high-risk under the AI Act and GDPR Article 22 still restricts solely automated decisions. Either way, a person reviewing rejections is the safer design.
Yes, where you deploy AI in the EU, for example through an EU entity, or where the AI's output is used in the EU, such as scoring the performance of staff based there. The bans and the AI literacy duty already apply; the high-risk rules for HR apply from 2 December 2027.
The bans, including emotion recognition at work, and the AI literacy duty have applied since 2 February 2025. The high-risk rules for recruitment, promotion, termination, task allocation and performance monitoring apply from 2 December 2027, after Regulation (EU) 2026/1744 moved them from 2 August 2026. Status as of 22 October 2026.
If the AI evaluates people, such as candidates or employees' performance, almost certainly. For an agent that creates onboarding tasks it is not always required, but it is often worth doing, because it answers the questions staff and their representatives will ask anyway.
For text without personal data, such as a job advert or a policy draft, usually yes. Employee data does not belong in a tool you have no data processing agreement with. A short written policy on what is allowed also counts towards AI literacy for staff in the EU.