UK employment law round-up: January 2025

AI: What you need to know 

AI is now commonplace. To support businesses in the responsible implementation, management and ethical use of such systems, the CIPD are sharing key resources and insights to help the profession be leaders in this field. 

As part of this focus, we are using this month’s employment law round-up to outline how UK businesses, big and small, are accountable.  

The main point for all UK business is that there is currently no single law that relates to AI.  

In January 2025 the new ‘AI Opportunities Action Plan’ was launched. The plan is a series of government proposals around AI. Of note for people professionals, the proposals state that any regulatory approach will be “flexible”, and the emphasis will be on removing barriers to growth (for the AI industry). 

Until these proposals progress, businesses in the UK are best to consider the current law around AI in terms of how a system could, or does, cross over existing employment rights. For example:  

• Automated decision making*: The UK Data Protection Act 2018 (DPA) prevents people being subjected to fully automated decision making that has, or has the potential to have, a “legal or similarly significant effect on them”. Indeed, people professionals may note that the ICO applies the specific example of “e-recruiting practices without human intervention” to this ‘ban’. It is important that people professionals must consider whether their organisation may have such systems, either wittingly or unwittingly (for example, AI may be in the backend of people management systems). 

*It is also worth noting that this may be set to change. The Data (Use and Access) Bill has been introduced in parliament. Among many other matters, the bill generally looks to allow automated-decision making as long as safeguards are in place. These safeguards could include meaningful human oversight, allowing individuals to provide input and challenge decisions and applying stricter rules when sensitive data is involved. 

• Collection of data, or monitoring: The collection of biometric data, or employee monitoring, also follows under the rules set out by the DPA. In effect, any monitoring of employees (by employers) needs to be proven to be necessary, justified and proportionate. A data breach claim would be handled in the civil court system, where awards for damages are generally higher. The employer would need to show whether the aim of the monitoring could have been achieved by other means, as well as what the impact of such monitoring has on the employee.   

The list above is illustrative and does not contain all the ways in which AI may breach existing employment, or employment-related, laws. There are, for example, further discussions around AI use for the commercial elements of business (contract law) or a business’ position in the market and how this is impacted by their use of AI systems (competition law).  

As matters on AI legislation progress, the CIPD will provide all relevant information in the employment law timetable and legal page on AI and technology  

How the EU AI Act impacts UK business 

The EU AI Act has been law since August 2024 and is not dependent on an industry or sector. It is a law that applies to UK businesses if:  

• Your company is creating an AI system for the EU market (regardless of whether you are creating it in the UK or other territory)  
• Your company is using an AI system, and the company is located in, or established in, the EU 
• Your company is outside the EU but is using an AI system to generate outputs for the EU market 

The act works by applying levels of risk to the AI system (unacceptable risk, high risk, limited risk and minimal or no risk) and then there are rules on compliance for each level. People professionals may wish to check whether their systems crossover to the EU market and review the relevant risk levels if a crossover is identified. 

Please also note that it is currently unclear whether, and to what extent, the EU AI Act will apply to Northern Ireland. Its provisions are being phased in and discussions are ongoing. 

Overall, employers should be particularly conscious of one of the most widely-used instances of AI in the workplace...recruitment. For example, AI systems may be used for reviewing CVs, covering letters and any content created as part of the application process. Under the act, high-risk AI systems, such as those used for shortlisting candidates, would be included in the act, although the risk level could be downgraded to limited risk if they meet certain criteria. See the EU AI Act compliance checker questionnaire for further information. For 2025, people professionals should note the following rollout dates for the EU AI Act: 

• 2 February 2025 – Certain prohibited AI practices are banned. Examples from the list include monitoring peoples’ emotions in workplace and educational institutions and advertisers using subliminal techniques to influence customers (so this does, for example impact UK advertisers operating in an EU market) 
• 2 February 2025 – Providers and developers of AI are obliged to ensure that their staff have an appropriate level of AI literacy  
• 2 August 2025 – The rules set for general purpose AI (GPAI) developers and providers take effect 

2024-2025 in employment law 

Across Great Britain, December saw the closure of a series of consultations for matters in the Employment Rights Bill. The consultation on strengthening Statutory Sick Pay (that queried removing the Lower Earnings Limit and making SSP available from day one of employment) and the consultation on the proposed repeal of the Trade Union Act 2016 and Strikes Act 2023, are two examples. The detail of these consultations and recommendations on how companies can prepare for any potential change are highlighted in the tracker.  

In addition to the progression of the Employment Rights Bill, the April increases in National Insurance contributions, plus the annual increases in the national minimum wage and statutory rates are due. 

Further, this January the government has confirmed that across Great Britain the Neonatal Care (Leave and Pay) Act 2023 is progressing. The act makes a statutory right for leave, for parents who have a child placed in neonatal care for seven consecutive days or more, within the 28 days following birth. There will also be a right to statutory pay for employees who meet the service requirements and minimum earning threshold. 

People professionals may wish to review the updated laws in the 2025 area of the employment law timetable for oversight of what to expect over the coming months.