Small employers mostly ask five things about AI in HR: what staff data may go into a tool, whether a tool may decide about people, whether to tell staff or candidates, whether to get consent, and what to keep on record. An HR consultant should answer each with the rule that applies, the evidence to collect and a named owner.
The detail depends on where the client's staff live and which tool they use. A twelve-person firm with a free chatbot has different exposure from one using screening software on hundreds of applications. The questions below are arranged the way clients ask them, so you can use them as a client FAQ, a call script or the headings of an audit report. None of it is legal advice.
Start with an inventory of what the client already does
Before you answer anything, find out where AI is used. In most small businesses the honest answer is "more places than the owner knows". A line manager pastes a grievance into a chatbot to tidy the wording. A recruiter-style tool ranks applications. An office manager uses an AI note-taker in one-to-ones. None of this is reported to the owner.
Ask for a list in four columns: tool, task, what personal data goes in, who can see the output. Here is a filled-in inventory for an illustrative eleven-person interior design studio.
| Tool | Task | Staff data going in | Who sees output |
|---|---|---|---|
| General chatbot (free account) | Drafting job adverts and reference replies | Role details; sometimes a candidate's name | Office manager |
| AI note-taker in video calls | Summarising one-to-ones | Performance and health remarks spoken aloud | Line managers, shared folder |
| Spreadsheet add-in | Rota and leave summaries | Names, absence dates | Owner |
| Job-board ranking feature | Sorting applicants | CVs, answers to screening questions | Owner |
This one table already shows two high-priority items: the note-taker captures health-related remarks without anyone having decided it should, and the ranking feature is an automated step in hiring. Everything below applies to rows like these. A consultant who starts with the inventory looks far more useful than one who opens with a generic policy.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowQuestions about staff and candidate data
What staff data may we put into an AI tool?
Give the client a three-level rule. Level one, never: special-category data (health, trade-union membership, religion, ethnicity and similar), disciplinary case files with names, and anything about a grievance, in a tool that has not been reviewed. Level two, only with a reviewed business-account tool and with names removed: performance summaries, absence patterns and reference wording. Level three, free to use: public job-advert text, policy templates, and generic letters that contain no real names.
The tool matters as much as the data. A free consumer account may keep prompts or use them to improve the product depending on its settings; a business account usually has different terms. Do not quote either from memory. Ask the client to read the current data-use page of the specific product and write down what it says on retention and training, with the date. For a short worked policy, see how to roll out an AI policy so staff follow it.
Does data-protection law apply to an AI tool's processing?
If the tool processes information about an identifiable person, data-protection law such as UK GDPR or the EU's GDPR applies to that processing, whatever the tool is called. In practice the client needs: a lawful basis for the use, a mention in the staff and candidate privacy notices, a check that the vendor acts as a processor under a written agreement, and a look at whether data leaves the client's region and on what terms. Where the use is likely to carry a high risk to individuals, a data-protection impact assessment is normally the tool. Your job is to prompt these steps and gather the documents, not to decide the legal basis for the client.
Is consent the right basis for staff data?
Often not. A regulator may treat employee consent as unreliable because the employee is in a weaker position and cannot refuse without worry. Many employers rely instead on the contract, a legal duty or legitimate interests, and document that choice. If a client says "we'll just get everyone to sign", ask them to check this with their legal adviser before the form goes out. Candidates are in a slightly different position, because they can usually walk away, but a notice is still needed.
Questions about automated decisions
Can a tool decide who we interview, promote or dismiss?
Several regimes treat decisions about people differently when no human is meaningfully involved. Under UK GDPR, as rewritten by the Data (Use and Access) Act 2025 (which replaced Article 22 with new Articles 22A to 22D), a significant decision taken with no meaningful human involvement must come with safeguards: telling the person, letting them make representations, giving them human intervention and letting them contest it. Such decisions are restricted further where special-category data such as health is involved. Check the regulator's current guidance rather than older summaries written before the change. The EU AI Act treats AI used for recruitment, selection, promotion, termination, task allocation and monitoring of workers as high risk, with the obligations on those systems applying from 2 December 2027 according to the AI Act Service Desk timeline (the date moved after the Digital Omnibus changes, so confirm it again before you quote it). Its ban on using AI to infer emotions in the workplace, except for medical or safety reasons, has applied since 2 February 2025.
The practical advice is the same across rules: a person who understands the tool reviews every adverse recommendation, can overrule it, and writes down why. A "human in the loop" who clicks accept in two seconds is not a review. Tell clients to ask for the vendor's explanation of how the tool scores people, whether it was tested for bias, and what its error rate is, and to keep the replies on file.
Which local rules might apply to a hiring tool?
Two local examples clients often hear about. NYC's Local Law 144 covers automated employment decision tools used for hiring or promotion for jobs in the city: the tool must have had a bias audit within one year of its use, a summary of the results must be public, and candidates or employees must get notice at least 10 business days before the tool is used, according to the city's Department of Consumer and Worker Protection page, which says enforcement began on 5 July 2023. Illinois amended its Human Rights Act, effective 1 January 2026, to make it a civil rights violation for an employer to use AI in decisions such as hiring, promotion, discipline or discharge in a way that has the effect of discriminating against protected classes (or to use postal codes as a proxy for them), and to require employers to notify employees when they use AI for those decisions. The statute leaves the state's human rights department to write rules on when, how and how quickly notice is given; commentary on their status has been inconsistent, so check the department's site before telling a client what the notice must say.
If a client has no staff in those places, say so plainly and move on. Quoting those two laws to a client who hires only in another place wastes their time, but knowing the pattern (audit, notice, human review) prepares them for the ones coming elsewhere.
A worked case: ranking applicants for a design studio
The eleven-person studio from the inventory advertises one role and receives 143 applications. The job-board ranking feature sorts them and the owner plans to interview the top 15. A consultant working through the checklist would ask: what does the ranking use (CV keywords, answers, anything inferred from names or addresses)? Has the vendor published any bias testing, or said what it tested? Can the owner see why a candidate ranked low? What happens to the other 128?
Say the consultant recommends this: the owner reads the bottom 30 by ranking in a quick sample, 10 of them at random, to see whether strong candidates are being buried. Suppose 3 of the 10 look interviewable on a plain read. That is a 30 per cent rate in a tiny sample, which is not a statistic but a reason to stop using the rank as a filter and use it only as a sorting aid. The consultant writes that into the note and records the date, the sample and the owner's decision. The illustration is invented, but the method of sampling the rejects is real and cheap.
Questions about telling people
Do we have to tell staff and candidates?
For personal data the answer is nearly always yes in some form: privacy notices should describe what is collected, why and who receives it, and automated decision-making is something notices are expected to cover. Specific AI notice rules exist in some places, as above. Even where none applies, tell people: it costs a paragraph and avoids a trust problem later. A sample notice line for a job advert:
We use software to help sort applications. A person reads every application that the software marks as unsuitable before any rejection is sent, and you can ask us to reconsider. Details of how we use your data are in our privacy notice at [link].Only write the sentence if it is true. A consultant who writes a reassuring line that the client's process does not follow creates a worse problem than saying nothing.
Do chatbots on the client's site need to say they are AI?
If the client runs a candidate or staff helpdesk bot, the EU AI Act's transparency duty for systems that interact with people (Article 50) has applied since 2 August 2026 for those within scope. The simple habit is to begin every conversation with a line saying it is an automated assistant and giving a way to reach a person.
Questions about records
What should we keep to show we were careful?
A small business can cover most of this with one folder per tool containing five items: the inventory row, the vendor's data terms as read on a given date, any impact assessment or risk note, the notice wording used, and a short log of reviews. For decision tools, add the sampling checks and the reasons for overruling the tool. Here is a filled-in log line:
Tool: job-board ranking | Role: studio assistant | 143 applications, top 15 interviewed
Checked: random sample of 10 from the bottom 30; 3 judged interviewable; owner decided to read all 143 in a quick pass
Reviewer: [owner initials] | Date: [date] | Next review: before next vacancyHow long do we keep it?
Records about hiring and employment have retention periods that depend on the place and the type of record. Do not give a number from memory. Tell the client to follow their existing records policy for decision records, delete working drafts and chat transcripts that are not needed, and ask their legal adviser for the period that applies. If their policy does not cover AI outputs, adding a line is a small, valuable piece of work you can do for them. For a pre-built version of the policy work, see selling an AI policy and handbook update package.
Questions about monitoring and AI-written HR letters
Can we use AI to monitor productivity?
This is the question owners ask after a tool vendor's demo, and it deserves a slower answer than the others. Monitoring staff with software that scores activity, reads messages or infers mood is the area where the rules are tightest, and the EU AI Act's ban on inferring emotions at work shows the direction. For a small client, ask three things before anything is switched on: what exactly does the tool collect, could a less intrusive method meet the same aim, and have staff been told in writing before it starts. If the client cannot answer the second question, the tool is probably not proportionate. Record the answer, because a regulator or tribunal will ask for exactly that reasoning.
Can the manager draft a warning letter with a chatbot?
Drafting is fine if the facts are the manager's and the output is checked. Here is a short before and after, illustrative. The manager types "write a final written warning for a signage fitter who was late five times" and the draft says the employee "has repeatedly demonstrated a lack of commitment" and "will be dismissed if there is any further issue". Two problems appear: "lack of commitment" is an opinion where the letter needs dates and times of lateness, and "any further issue" promises an outcome that the disciplinary procedure may not allow. The consultant's edited version lists the five dates, cites the policy step, sets a review period, states the right to appeal and avoids predicting the sanction. The lesson for the client: the model supplies the shape, the manager supplies the facts, and the person who signs has read every word against the procedure.
A short reply you can send a client who asks "are we compliant?"
Hi [first name],
Thanks for asking. I can't say "compliant" in a word, because it depends on where your staff work and which tools you use. What I can do is this: (1) list every AI tool in use and the staff data it sees; (2) check each one's data terms; (3) flag any tool that ranks, scores or decides about people; (4) check that notices and records match what you actually do. I'll send a one-page summary with the items that need legal review marked. Could you send me the list of tools and the places you employ people?
[your name]Six questions to put to any HR tool vendor
Clients rarely know what to ask a vendor, so hand them a list they can paste into an email. Ask: does the tool score, rank or recommend anything about individuals? What data does it use and is any of it inferred? Is customer data used to train the vendor's models, and can that be switched off in writing? Where is data stored and which sub-processors touch it? Has the tool been tested for bias, and can you see the summary? How do we export or delete a person's data on request? A vendor who answers in specifics within a week is a better bet than one who sends a brochure. Keep the replies in the tool's folder, with the date, because the answers change when products are updated.
A client-ready checklist you can run in an hour
| Client question | What to check | Evidence to keep |
|---|---|---|
| Which tools do we use? | Inventory by tool, task, data, viewer | The inventory table |
| What data goes in? | Three-level rule; special-category data never | Signed rule, staff briefing date |
| Is the tool reviewed? | Vendor data page read; processor terms | Dated notes or screenshots |
| Does it decide about people? | Named reviewer; right to overrule | Review log |
| Did we tell people? | Privacy notice and advert wording | Copies with dates |
| Is there a local rule? | Hiring place and staff location | Note of rules checked and by whom |
| What do we keep? | Retention line in records policy | Updated policy |
Two mistakes that show up in client audits
The first is the unreviewed note-taker. A mortgage broker's office turns on an AI note-taker for team calls, and it records a one-to-one where an employee mentions a medical appointment. The summary goes to a shared folder visible to six people. No one made a decision to collect health information, yet the firm now holds it. The fix is a rule for which meetings may be recorded, who can see summaries, and when they are deleted, plus a short note to staff.
The second is the policy nobody told staff about. A financial adviser's practice has a sensible one-page AI policy in a drawer, and a new starter uses a free chatbot to rewrite a client email that included an employee's name. The policy was fine; the briefing never happened. A consultant should therefore treat "staff briefed on" as an evidence line with a date. For new staff, see onboarding new hires onto AI tools and rules; for existing staff, run the briefing in a team meeting and record attendance.
How to give the answer without giving legal advice
Consultants vary on how far they can go. A sound way is to present three layers. Practical steps you can stand behind (inventory, rules on data, review, notices, records). Pointers to the rule the client should check, with the date you looked. And a clear line where the client needs a lawyer: lawful-basis choices, impact assessments for high-risk uses, and anything involving a dispute. Write the line into your report, for example: "This report describes practical steps and does not constitute legal advice; rules change, and the items marked for legal review should be reviewed by a qualified adviser for the places where the client employs people."
Also date your own claims. This is a field where a date moves (the AI Act timeline shifted, Illinois left its notice detail to rule-making, data-protection rules on automated decisions were rewritten). A report that says "checked on 4 November 2026" is more honest and more useful than one that reads as timeless.
If you are building this into a regular offer, how HR consultants use AI for policies, letters and cases shows where the drafting side fits alongside the compliance side.
More questions clients bring
Do we need staff consent to use AI on their data?
Not always, and consent is often the wrong basis for employment data because employees can hardly refuse freely. Under data-protection law the usual routes are contract, legal obligation or legitimate interests, each with its own tests. Say what you do in a privacy notice, and take legal advice on the basis for your jurisdiction.
Can an AI tool decide who gets an interview?
Some rules limit decisions made solely by automated means, and some places require bias audits or notice for screening tools. The safe habit is a named person who reviews every rejection recommendation and can overrule it, with a record of that review.
Is a free chatbot fine for drafting warning letters?
Drafting from a template with names and facts removed is lower risk than pasting a case file. Whatever the tool, check its data settings, strip identifying details, and have a person check the facts and the legal wording before the letter is sent.
How long should we keep AI outputs about employees?
Treat them like other HR records: keep what supports a decision for the period your records policy and local rules set, and delete working drafts. Ask your legal adviser for the retention period that applies to your employees, because it varies.
Further reads
- AI Screening: Bolt It Onto Your ATS or Switch Systems? — Whether to add AI screening to your ATS or switch.
- AI CV Screening for Recruitment Agencies: Setup and Safeguards — Setup and safeguards for AI CV screening.
- How to Evaluate the AI Features in Your Recruitment Software — Questions to ask a recruitment-software vendor about AI.
- How to Get Your Staff to Actually Use AI Tools — Get staff using the approved tools rather than their own.
- Will AI Replace My Employees? An Honest Answer for Small Firms — An honest answer for the question staff will ask.
- How to Survey Your Staff Before an AI Rollout (With Questions) — Find out how staff already use AI before writing rules.
- AI Salary Benchmarking for HR Consultants: Sources, Bands and Checks — A repeatable method for turning survey and job-advert data into pay bands with AI, plus the checks that catch invented figures.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: NYC Department of Consumer and Worker Protection page on automated employment decision tools; EU AI Act Service Desk implementation timeline, Annex III and Article 5; Illinois Public Act 103-0804 (HB 3773) statute text; Data (Use and Access) Act 2025, section 80, on legislation.gov.uk. This tutorial is not legal advice.