Bringing AI into a company

When a business brings AI into its work, people's jobs can change. The business may also start to handle staff and customer data in new ways. The law and the public guidance ask certain things of an employer when that happens. This page sets them out, with the source for each.

Talk to people early

Acas says employers should always consult workers and their representatives when making decisions. It says consulting can help make better decisions and improve working relationships. In some situations the law says an employer must consult.

Acas has separate advice on consulting employees and their representatives. It covers why, when and how to do it, and the legal requirements.

If jobs will go

Sometimes a change of this kind means fewer jobs. The government's guidance says that if an employer does not consult staff in a redundancy situation, any redundancies will almost certainly be unfair. Staff could then take the employer to an employment tribunal.

Where an employer plans a larger number of redundancies at one workplace, stricter collective consultation rules apply. The employer consults staff representatives and waits a minimum period before anyone is dismissed. It also tells the Redundancy Payments Service on form HR1 before the consultation starts.

Parliament amended section 188 of the 1992 Act, which holds these rules, through the Employment Rights Act 2025. As of 19 October 2026, legislation.gov.uk notes that more changes may come into force later. The current wording is on legislation.gov.uk. In Northern Ireland, nidirect explains the rules that apply.

Staff and customer data

The ICO says that in the vast majority of cases, using AI will mean processing that is likely to be high risk to people's rights. That triggers the legal requirement for a data protection impact assessment, which the business must carry out before the processing of personal data begins. The ICO says each case needs its own assessment.

The ICO also has guidance for employers who monitor workers. Both pages carry a notice that the ICO is reviewing them after changes made by the Data (Use and Access) Act.

Decisions about people

Some decisions about a person are taken by a system alone, with no meaningful human involvement. The law calls a decision significant when it has a legal effect on the person, or a similarly significant effect. For those decisions, the business must give the person information about the decision. The person must be able to make their case, ask for a human to step in, and contest the decision.

These rules sit in Articles 22A to 22D of the UK GDPR. They replaced the old Article 22 in stages, and the last part came into force on 5 February 2026. The ICO updated its draft guidance on 31 March 2026 and is consulting on it.

Questions for the supplier

The NCSC published guidance for managers on AI and cyber security on 13 February 2024. It suggests managers ask where responsibility for the security of AI tools sits in their organisation. It suggests asking what the worst case would be if a tool the business uses failed.

It also asks whether the business understands its data, model and software supply chains. Managers can then ask suppliers the right questions about their own security.

Skills

Skills England published a benchmark called AI foundation skills for work on 28 January 2026. It sets out the basic technical, non-technical, responsible and ethical skills people need to use simple AI tools at work. It applies in England.

Useful links