Somewhere in your organisation, an employee is using AI right now. They may be drafting emails with it, summarising documents, screening CVs, or feeding client data into a tool whose privacy settings nobody has checked. Most businesses have reached this point without a policy, without training, and without any clear picture of what that exposure looks like. That gap, between where your people already are and where your governance framework is not, is where liability accumulates. It is also where employment tribunals and regulators are increasingly looking.
For businesses that want the productivity benefits without the legal risk, the time for a watching brief has passed.
What AI use in the workplace actually looks like
It is more varied than most employers realise. Many employees are already using general-purpose tools such as ChatGPT, Microsoft Copilot, or Google Gemini to draft communications, summarise documents, or produce content. Others are working with AI that is quietly embedded in software they use every day, including HR platforms, CRM systems, and accounting tools, without necessarily knowing it is there. Some organisations are going further, deploying AI for recruitment screening, performance monitoring, or workforce planning.
Each of these raises different questions. A member of staff using a chatbot to tidy up a report sits in a different risk category from an employer using AI to rank job applicants or track hourly productivity. What does not shift across any of these situations is the core legal position. AI-assisted is not the same as liability-reduced. The method changes. The responsibility does not.
The legal framework
There is no single piece of UK legislation that governs AI at work. Instead, a body of existing law applies in full, regardless of whether the employer has thought about it in an AI context. The assumption that AI sits in some regulatory grey area is one that does not survive scrutiny.
Data protection is the most immediate pressure point. The UK GDPR and the Data Protection Act 2018 require that personal data is processed lawfully, transparently, and only to the extent necessary. Those requirements do not bend for AI. Where tools handle personal data about employees, clients, or job applicants, the same rules apply as they would to any other processing activity. Employers who allow staff to input personal data into third-party AI tools without understanding what those tools do with it are accumulating data protection liability in ways they have often not considered. The Information Commissioner’s Office has been increasingly active in this area. Where AI use carries significant risk for individuals, a data protection impact assessment is a legal requirement, not a recommendation.
The Equality Act 2010 is where the risk is often least visible. AI is not neutral. It is trained on data, and data carries the imprint of past decisions. A recruitment tool built on years of hiring history may replicate the biases embedded in that history, quietly filtering out candidates by age, ethnicity, or other protected characteristics, not by design but by learning. Employers who deploy such tools without auditing them for discriminatory outcomes are exposed. Discrimination law does not require intent. The fact that a decision was made by an algorithm rather than a person provides no protection whatsoever.
Obligations under the Employment Rights Act 1996 and the common law duty of mutual trust and confidence also come into play. Covert monitoring through AI, or the use of AI in disciplinary or performance processes without transparency or genuine human oversight, can give rise to constructive dismissal claims. Health and safety law adds another dimension: the impact on employee wellbeing of opaque AI-driven decisions about pay, promotion, or job security is not a peripheral concern.
Data protection and AI
Three issues come up most often.
The first is what happens to data that employees put into AI tools. Many general-purpose services may depending on configuration, use that input to train or refine their models unless employers have specifically configured otherwise. Where the data includes personal information about colleagues, clients, or others, the organisation may be in breach of its obligations as a data controller before anyone has identified the problem.
The second is automated decision-making. UK GDPR gives individuals the right not to be subject to solely automated decisions that significantly affect them,and rights in relation to such decisions, including the right to obtain meaningful information about the decision-making process.
. Where AI shapes decisions about recruitment, pay, performance, or dismissal, employers must be able to show genuine human oversight and provide explanations that have real substance. The question that matters is whether human involvement has been meaningful or whether it has amounted to little more than approving whatever the system produced.
The third is international data transfers. AI platforms are frequently operated by companies outside the UK. Data processed through those platforms may be transferred abroad, and employers need to ensure that appropriate mechanisms are in place and that supplier contracts are adequate.
Employment law
The employment law picture extends well beyond discrimination risk.
Where AI tools are introduced in ways that materially change how work is directed, monitored, or assessed, questions about contractual variation can arise. Employers who implement significant AI-driven changes without proper communication or process leave themselves open to grievances and claims. Redundancies that follow from AI-driven efficiencies do not escape collective or individual consultation obligations simply because the rationale was generated by a system rather than a person.
Monitoring is one of the most contested areas. Employees retain a reasonable expectation of privacy at work. That expectation is not displaced by the fact that it is software rather than a manager doing the watching. Employers who use AI tools to track keystrokes, screen activity, communications, or location must have a lawful basis, must be transparent with employees about what is happening, and must ensure the level of monitoring is proportionate. The potential for data protection breaches and constructive dismissal claims in this area is real and should not be underestimated.
Algorithmic management, where AI directs, paces, or evaluates work in real time, is a growing source of legal scrutiny. Employers in logistics, retail, and customer services in particular should be alert to claims that can arise where working conditions are governed by automated systems with little meaningful human oversight.
What good governance looks like
Start with a policy. Without one, employees make their own decisions about which tools to use and how far to take them. Those decisions will not always be the right ones, and the organisation bears the consequences.
A good AI policy does not need to be long. It needs to answer the questions employees will actually have. Which tools are permitted, and for what? What information must not be entered into unapproved or unsecured AI systems?? Who is responsible for reviewing AI-generated output before it is used or submitted? The answer to that last question should always be the employee, not the machine.
For higher-risk uses, including anything touching recruitment, performance management, or disciplinary decisions, the policy should require genuine human oversight at every decision point. Genuine means the person making the decision has engaged with the output, understands what it is based on, and could account for the decision without reference to the tool. That is a higher bar than it might appear, and it is the bar that matters.
Training reinforces policy. Employees who understand the reasoning behind the rules apply them more reliably than those who have simply been told what they cannot do. This is particularly true for HR professionals and managers, who are most likely to be making or authorising the decisions that carry the greatest legal exposure.
Employers should also take stock of the AI already embedded in their systems. HR software, recruitment platforms, and productivity tools often contain AI functionality that arrived as a product update and was never formally assessed. Understanding what data those tools process, where it is held, and whether supplier contracts meet current data protection requirements is a necessary part of managing risk.
Looking ahead
The regulatory environment is moving. The EU AI Act classifies certain AI applications in employment as high-risk and imposes significant obligations on those who deploy them. It is in force and being phased in. UK employers with EU operations need to take note. Domestic regulation is not yet in equivalent terms, but the direction of travel is clear.
Employers who build governance frameworks now will find adaptation straightforward. Those who have let adoption run well ahead of oversight will find the gap harder to close, and more costly, the longer it remains open.
How Buckles can help
Buckles’ employment team advises employers across a wide range of sectors on workforce strategy and risk management. We can assist with developing and reviewing AI policies, advising on the employment law implications of specific AI applications, responding to data protection queries and subject access requests, and acting in tribunal proceedings where AI-related issues are in dispute. If you would like to discuss any of the issues raised in this article, please get in touch.
