FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: HR consultants
AI monitoring of staff is lawful only if it is necessary, proportionate, transparent and backed by a DPIA, and scores must not drive decisions without meaningful human review. HR consultants who advise on these tools can face claims when monitoring leads to disputes.
Part of: AI in HR consultants
In short
AI tools can track keystrokes, score productivity and analyse the sentiment of staff messages. Data protection law applies first: lawful basis, transparency, proportionality and usually a DPIA. The ICO is updating its monitoring workers guidance for DUAA, with a final version due Winter 2026/27. If scores feed decisions about pay or dismissal without meaningful human involvement, Article 22C safeguards apply. Monitoring can lead to complaints, constructive dismissal and discrimination claims, and clients may look to the adviser who recommended the tool.
Employers now have access to tools that track keystrokes, application use and screen time, score productivity, analyse the tone of emails and chat messages, and flag staff who appear disengaged or likely to leave. HR consultants are asked whether these tools are lawful, how to introduce them, what to put in the monitoring policy and how to use the outputs in performance or disciplinary processes.
Monitoring workers is a data protection matter first. The ICO's monitoring workers guidance is being updated for the Data (Use and Access) Act 2025, with the final version due in Winter 2026/27, according to its guidance plans. Until then, the current guidance and the core UK GDPR principles apply: a lawful basis, transparency, necessity and proportionality, and data minimisation. DPIAs are usually needed for employee monitoring tools, and the ICO expects any human review to be meaningful and applied consistently.
Where monitoring outputs feed directly into decisions about pay, discipline or dismissal, the Article 22A test for solely automated significant decisions comes in. Sentiment analysis may also touch special category data, such as health inferred from messages, and the wider lawful bases for automated decisions do not extend to that data. From 19 June 2026 employers must also have a data protection complaints procedure and acknowledge complaints within 30 days, so staff concerns about monitoring now have a formal route (ICO summary of DUAA).
The CIPD Code requires members to respect privacy rights (civic virtue and stewardship, cl.5), to provide fair and consistent policies (positive and active impact, cl.1) and to give an up-to-date service (professional service and competence, cl.2). Advising a client on monitoring while the ICO guidance is being rewritten means flagging that the position may change. The CIPD's 2023 AI advice also warned HR teams to watch data security and GDPR risk.
These claims often arrive together. A single employee can raise a data protection complaint, a grievance and a tribunal claim about the same monitoring, and each one asks what the employer was told about the risks before the tool went live.
Illustrative: a consultant advises a client to introduce AI productivity scoring and drafts the monitoring policy, but does not recommend a DPIA or say how scores should be reviewed. The client uses low scores to start capability proceedings. An employee with a disability that affects typing speed is dismissed and claims discrimination and unfair dismissal, and complains to the ICO. The client says it acted on its adviser's policy.
A claim from the client that your monitoring advice was negligent is the kind of claim PI is designed for, subject to the policy terms. Regulatory fines imposed on the client are commonly not recoverable, and some PI wordings limit data protection-related claims, so check how yours treats them. See GDPR and data breach cover within PI.
Apex arranges PI for HR consultants advising on workplace technology. A broker can check how your policy treats data protection advice. Related: AI in performance reviews, employee data confidentiality and AI in HR consulting.
It can be, if it has a lawful basis, is transparent, necessary and proportionate, and is supported by a DPIA. Intrusive tools such as keystroke or sentiment monitoring are harder to justify, and outputs should not drive decisions without meaningful human review.
Yes. The ICO is updating its monitoring workers guidance for the Data (Use and Access) Act 2025, with a final version due Winter 2026/27. Advice given now should flag that the position may change.
Using a score alone is risky. Dismissal is a significant decision, so solely automated decisions trigger Article 22C safeguards, and a fair process requires a human to look at context, including disability and working pattern.
The employer is the controller and faces complaints and claims from staff. An HR consultant who recommended the tool or drafted the policy may face a recovery claim if the advice was negligent, which is where PI usually becomes relevant, subject to the wording.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
