AI for HR teams: where it helps and where it's a liability

HR has gone from cautious to keen, and AI genuinely lightens the admin: drafting, scheduling, summarising, answering the same policy question for the ninth time. But hiring, performance and discipline are where bias and privacy bite hardest. Any decision about a person keeps a person who can change it.

That is the whole rule, and it is simpler than the compliance literature makes it sound. AI can do the work that surrounds a decision. It should not be the thing that makes one.

What follows is where the line falls in practice, what changed in UK law this February, and the one-page policy that keeps a small people team on the right side of it.

HR has warmed to AI faster than it has adopted it

The confidence is there. The CIPD's Futureproofing your skills report, published on 29 April 2026 and based on a YouGov survey of 1,342 people professionals and business leaders fielded in January and February 2026, found 67% of people professionals confident in learning how to use AI tools, and 64% confident they understand their limitations.

That second number matters more than the first. Knowing where a tool stops being reliable is the skill the job actually needs.

The CIPD also found the confidence pays. Where HR leaders reported higher confidence in AI-related skills, close to nine in ten said AI had improved workers' job performance. Where confidence was lower, that fell to around half, with many reporting little or no impact. The tool is not the variable. The people using it are.

Adoption lags the enthusiasm, and it lags hardest for small teams. In the US, SHRM's State of AI in HR 2026 report, based on 1,908 HR professionals surveyed in December 2025, found 39% of organisations had adopted AI in their HR function. Split by size, 33% of small organisations had, against 60% of the very largest. Those are US figures, but the pattern matches what the Office for National Statistics finds across UK business, where a quarter of firms were using AI in late December 2025, rising to 44% among those with 250 or more staff.

Where AI safely helps HR

The safe ground is the work around the decision, and there is a lot of it.

Drafting is the obvious win: job adverts, offer letters, policy updates, induction material, the internal announcement nobody wants to write. AI produces a serviceable first version and a person shapes it. The voice stays yours because you edited it.

Summarising is the quiet one. Long policy documents, exit-interview themes, engagement-survey free text, a sprawling email thread before a meeting. A tool reduces the reading load and a person checks the summary against the source before acting on it.

Scheduling and the administrative churn of recruitment sit here too. Co-ordinating interview slots, chasing references, formatting a candidate pack. Nothing about that work involves judging a person.

And the internal FAQ. Half of what a small HR team fields is the same question about holiday carry-over, sick pay or the expenses process. An assistant pointed at your own written policies handles the routine ones, provided a person has checked what it says and it does not guess when it does not know.

In all of these the tool touches the paperwork, not the person's prospects. That is the test.

Where it becomes a liability

The risk concentrates in four places: hiring and screening, performance, discipline, and the personal data running through all of them.

Screening is the sharpest. A tool that ranks, scores or filters applicants is weighing up people, and it learns from whatever pattern is in the data it was given. If past hiring favoured a group, a model trained on it will reproduce that preference and dress it up as a score. The candidate never sees the reason, and often neither does the employer.

Performance and discipline are next. Anything feeding into pay, promotion, capability or dismissal is a decision with real consequences for someone's livelihood. Using AI to summarise the evidence is reasonable. Using it to weigh the evidence is not.

Privacy runs underneath all of it. HR holds some of the most sensitive information an organisation has: health conditions, absence reasons, grievances, disciplinary records, sometimes ethnicity or religion. Information of that kind does not belong in a consumer AI tool with no agreement behind it, and this is the same discipline we set out in our note on whether staff can put client data into ChatGPT.

If you use an agency or run high-volume recruitment, the same risks apply to the tools they use on your behalf, which we cover in AI for recruitment agencies.

The rule that matters: a person who can change the outcome

The UK rules on this changed recently, and quietly. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with a new set, Articles 22A to 22D. It came into force on 5 February 2026, under the commencement regulations.

The shape of it is this. A significant decision is one producing a legal effect for the person, or a similarly significant effect. A decision counts as solely automated when there is no meaningful human involvement in taking it. Where such a decision does not rest on special category personal data, an organisation may now make it, provided it has a lawful basis and safeguards are in place for the person affected. The Act names those safeguards: give the person information about the decision, let them make representations, give them access to human intervention, and let them contest it.

Where the decision is based, entirely or partly, on special category data, such as health, racial or ethnic origin, or religious belief, the tighter rule holds. It may not be taken by solely automated means unless the person has given explicit consent or another specific condition applies. That is precisely the territory a screening tool wanders into when it infers a health condition or an ethnicity from an application, even when it infers it wrongly.

So the easing is real, and it is conditional. The old default said no unless. The new one says yes, with safeguards, unless the sensitive data is involved. Neither version lets a machine quietly decide who gets the job with nobody accountable.

The test that decides which side you are on is whether the human in the loop can genuinely change the outcome. A reviewer handed a ranked shortlist who cannot realistically overturn it has not been involved in the decision that mattered, which was the one to set everyone else aside. We go through that test in detail in using AI to screen candidates: the UK rules changed this year.

Separately, the Equality Act 2010 still applies to the result. If a screening step disadvantages people sharing a protected characteristic, the employer carries that risk, including when the tool came from a vendor. The candidate who lost out does not care whose software it was.

How any of this applies to your own tools and data is a question for a qualified adviser, not a blog. The job for an HR leader is narrower: know which decisions in your organisation a machine is really making.

A simple HR AI policy

A one-page rule closes most of the gap, and it does not need to be a governance document. It answers four questions in plain language.

Which tools are approved, so people are not each picking their own. What never goes in: health information, disciplinary and grievance records, anything identifying a candidate or employee, unless the tool is on a proper contract that covers it. Where AI may not be used at all: screening, performance, promotion, discipline, dismissal. And who reviews AI-drafted work before it reaches a person's inbox.

Write that before you buy anything. Our simple AI policy for small firms is a reasonable starting point, and for a people team it is the cheapest protection available.

What to do next

List every point where AI already touches a decision about a person in your organisation: hiring, shortlisting, references, performance reviews, promotion, capability. For each one, ask the plain question the rules turn on. Could the person in the loop actually change the outcome, with the authority, the time and the information to do it?

Where the answer is no, or where nobody is sure, that is your first job. Either put a real decision-maker back in, or stop using the tool there. Then write the one-page policy, name the approved tools, and pick one safe use case, drafting or summarising, to run properly for a month.

If it would help to work out where AI fits in your people work, and where a person must stay in charge, book a call and we will think it through with you.

Common questions

Where can HR safely use AI?

In the work that surrounds a decision rather than the decision itself: drafting adverts, offer letters and policy updates, summarising long documents and survey feedback, co-ordinating interview scheduling, and answering routine internal questions from your own written policies. In each case a person checks the output before it is used. The tool touches the paperwork, not the person's prospects.

Can AI make hiring decisions in the UK?

Not with nobody accountable. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, in force from 5 February 2026, moving significant solely automated decisions to a permitted-with-safeguards position where no special category data is involved and a lawful basis exists. Safeguards include telling the person, letting them make representations, giving access to human intervention and allowing them to contest. Where special category data such as health or ethnicity is involved, tighter conditions apply. How this works for a specific employer is a matter for legal advice.

What is the single most important rule for AI in HR?

That a person who can genuinely change the outcome owns any decision about a person. A reviewer who signs off a ranked shortlist without the authority or information to overturn it is not meaningfully involved, and the decision belongs to the machine. Alongside that, keep sensitive HR information, health, grievances, disciplinary records, out of any AI tool that is not on a contract covering it.

---

This is general information, not legal advice. The rules on automated decisions, data protection and discrimination apply differently to every organisation, so take advice from a qualified professional on your own obligations before using AI in hiring, performance or discipline.