HR chatbot: what it can answer, and what it must not decide

Somebody asks how many days of holiday they have left. Somebody else asks whether their partner's operation counts as time off for dependants. The first question has one answer, and a chatbot can give it. The second is a judgement about a person, and if a chatbot answers it, the employer has made that judgement without anybody in the organisation knowing it happened.

That is the whole subject. An HR chatbot is useful exactly to the extent that it answers questions, and risky exactly to the extent that it decides things. This article covers the queries one genuinely absorbs, why a confident wrong answer about leave or pay costs more than silence, the data protection duties that attach the moment it reads personnel data, what changed in the automated decision-making rules on 5 February 2026, what you owe employees in transparency, what to do about the transcript it creates, and the questions that should never reach a bot at all. It describes the position in the United Kingdom and is general information, not legal advice.

Routing is the part most deployments skip. See how New Dynamics workflows send a request to a named owner with a due date, so a handover is recorded rather than hoped for.

Answering a question is not deciding about a person

Write the distinction down before you buy anything, because every rule here hangs off it.

Answering is retrieval. What the policy says, where a form lives, how a process runs, what a number is. The correct answer exists independently of the person asking.

Deciding is applying a rule to one individual's circumstances and producing an outcome for them: approval, refusal, an entitlement figure, an eligibility verdict, a score, a next step in a formal procedure. The answer only exists because somebody weighed this person's facts.

A chatbot that answers reduces the queue. A chatbot that decides becomes the employer's decision-maker, and the law has a great deal to say about that.

The queries an HR chatbot genuinely absorbs

These are the repeat questions that arrive by email, get answered from the same three paragraphs every time, and interrupt somebody.

• Where things are. The handbook section on sickness reporting, the expenses form, the pension scheme name, the probation review template.
• What the policy says. Notice periods by length of service, the carry-over cap on annual leave, who signs off travel.
• How a process runs. The steps in a probation review, who an appeal goes to, how long a reference takes.
• Fixed facts about the organisation. Office hours, the bank holiday list, the payroll cut-off date, who the first aiders are.
• Pointing at the right person. Not resolving the issue, naming the owner and handing it over.

Nothing there produces an outcome for the person asking. That is why it is safe. There is a real prize, too, in the gap between what employers run and what staff already use on their own. The Office for National Statistics article Artificial intelligence in UK businesses: 2023 to 2026, released on 20 July 2026, reports that "Over half of employees (55%) report using AI for work or education, compared with around a third (35%) of businesses reporting use of at least one AI technology". See the statistics hub and our post on AI at work statistics for the wider picture.

If the answers are not already written down consistently, a chatbot will not fix that. It will read whatever you have, faster. Our posts on knowledge base software and internal communication tools cover the groundwork.

Why a confident wrong answer is worse than no answer

Silence sends people to a human. A wrong answer delivered fluently stops them asking.

Three things follow from a bad answer about leave or pay. The employee acts on it, books the time, misses the deadline, or does not claim what they were owed. The employer carries the consequence, because the bot was speaking for the employer. And the mistake repeats at scale, silently, until somebody complains.

So the design question is not how often it is right but what happens when it is wrong. A bot that says it does not know, and names the person who does, is doing its job. Measure the share of conversations that end in a correct handover, not the share answered.

Data protection attaches the moment it reads personnel data

A policy bot that reads nothing about the individual does little processing of personal data. A bot connected to the HR record is a different thing, and the whole of UK data protection law applies to it.

The Information Commissioner's Office guidance Employment practices and data protection: keeping employment records, published on 5 February 2025, sets out the duties that bite hardest on a chatbot build. On how much data it may see, the ICO says the data minimisation principle "says you must make sure the personal information you hold is adequate, relevant, and limited to what you need for your purposes", and that "If you are holding more information about your workers than you need for your purpose, this is likely to be unlawful". A bot given the whole record so that it can answer anything fails that test. Scope it to the fields the answers need, and read our post on access levels for HR data.

On consent, the ICO is blunt about the employment relationship: "It may be difficult for you to rely on consent to keep records of personal information about your workers. This is because, as an employer, you will generally be in a position of power over your workers." A tick box in the chat window is not a lawful basis.

Special category data needs more. The ICO lists health among the special categories and says that "in addition to a lawful basis, you must identify a special category condition (under Article 9 of the UK GDPR)" and that "You may also need to satisfy a condition in Schedule 1 of the DPA 2018". A chatbot that invites sickness questions will collect health data whether you planned for it or not.

That page now carries its own warning: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change." Read it knowing that, and run a data protection impact assessment before launch rather than after the pilot.

The automated decision-making rules changed on 5 February 2026

This is the part that is easy to get wrong, because the familiar provision has gone.

Article 22 of the UK GDPR, "Automated individual decision-making, including profiling", is no longer there. Open Article 22 at legislation.gov.uk and the text is struck through with one annotation: "Ch. 3 Section 4A substituted for Art. 22 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(1), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)".

That instrument is the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, made on 29 January 2026. Regulation 2 brings "section 80 (automated decision-making)" into force on 5 February 2026. Regulation 5 saves the old law for old cases: the amendments "do not apply in relation to any decision taken before 5th February 2026" to which the former Article 22(3), or section 14 or 50(2) of the Data Protection Act 2018, applied. Section 14 of that Act, "Automated decision-making authorised by law: safeguards", is recorded as "omitted (5.2.2026)", on a page legislation.gov.uk states is "up to date with all changes known to be in force on or before 07 November 2026".

What replaced it is four articles. Article 22A defines the two tests: "a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision", and a decision is significant if "it produces a legal effect for the data subject, or it has a similarly significant effect for the data subject". Article 22B restricts solely automated significant decisions that rest on special category data, and bars them where the processing relies on the new recognised legitimate interests basis. Article 22C requires safeguards. Article 22D lets the Secretary of State make regulations defining meaningful human involvement and similarly significant effects. No such regulations appear on legislation.gov.uk as at the date of this article, so the statutory words and the regulator's guidance are all you have.

GOV.UK describes the direction in its guidance Data (Use and Access) Act 2025: data protection and privacy changes: the Act "creates a more permissive framework under the UK GDPR for organisations to make decisions based solely on automated processing that have legal or similarily significant effects on individuals. Organisations will be able to make such decisions in wider circumstances but must implement certain safeguards." More permissive is not the same as unregulated.

One source conflict is worth naming. The ICO's short, finalised page on rights related to automated decision-making including profiling still quotes the old text, that "The data subject shall have the right not to be subject to a decision based solely on automated processing", and attributes it to "[Article 22(1)]". Its longer guidance has moved on but is draft: the ICO states "We are consulting on the Data (Use and Access) Act updates to this guidance", with a change note dated 31 March 2026. The statute governs. Where the two differ, follow legislation.gov.uk.

There is more coming. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, made on 16 April 2026 and in force on 12 May 2026, require the Commissioner to "prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data" for "developing and using artificial intelligence" and "automated decision-making". The Regulations set no date by which it must be published. Note also that the regulator's name is changing in forward-looking documents: section 119 of the Act, "Transfer of functions to the Information Commission", came into force on 30 September 2026, and section 118 abolished the office of Information Commissioner. Current guidance is still correctly described as the ICO's.

When a human has to be involved

For most HR chatbots the honest answer is that they should never be the decision-maker, which keeps them outside the Article 22A tests altogether. If yours does decide, two rules matter.

First, whether the decision is significant. The ICO's draft guidance lists the areas to weigh, and "employment opportunities and circumstances (eg recruitment, promotion)" is on it. It adds a caution that suits HR: "Unless you are confident that you can accurately separate out the people who will experience legal or similarly significant effects from those who will not, you should apply the safeguards to all the decisions you make." Low-stakes assistance is treated differently. The ICO's own example is that "using a generative AI application to summarise a meeting is unlikely to lead to a legal, or similarly significant effect, in most cases, so this isn't in scope of the ADM provisions".

Second, whether human involvement is real. The ICO says that "for human involvement to be 'meaningful' in the context of the UK GDPR, you must ensure it is active and not just a token gesture", and lists what the human must do: "assess and review the decision at an appropriate point to ensure actual impact on the outcome", "have the ability to influence the outcome", "have discretion and authority to alter the decision", "be suitably trained and qualified to understand the system's logic, outputs, limitations, and risks", and "take into account the relevant data and factors on which the decision was based". Two further lines close the usual escape routes: "Using ad hoc spot-checking isn't sufficient because some automated decisions won't receive a check and therefore don't have meaningful human involvement", and "A human merely designing or building an automated system does not count as meaningful human involvement".

The ICO's own HR example is the shape to copy. An automated clocking-in system flags lateness, "the decision to issue it is taken by the employer's HR manager following a review of that data", and that is meaningful human involvement.

Where the ADM provisions do apply, Article 22C sets the safeguards. They must include measures that "provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject", "enable the data subject to make representations about such decisions", "enable the data subject to obtain human intervention on the part of the controller in relation to such decisions", and "enable the data subject to contest such decisions". The ICO adds a deadline on acting: "In all cases, you must act on the person's request without undue delay and at the latest within one month of receipt", extendable by two months for complex or repeated requests.

What you have to tell employees

Transparency is not a banner saying you use AI. The ICO's employment records guidance lists what workers must be told: "your purposes for collecting and using their personal information", "your lawful basis", the condition for special category or criminal offence information, "your retention periods for the information", who you will share it with, "their rights over their information", and where you got the data. It must be given "at the time you collect their information" when collected directly, "in a way that is easily accessible to your workers, easy to understand, and in clear and plain language". The ICO explicitly offers "'just in time' notices if you offer online workshops, platforms or tools where personal information might be collected or shared with others". A short notice in the chat window, linked to the full one, is exactly that. Update your employee privacy notice at the same time.

Say two things plainly in the interface: conversations are recorded and these people can read them, and the bot decides nothing and approves nothing.

The record it creates

A chatbot generates a transcript, and that transcript is personnel data. Decide these before launch.

• Who can read it. A manager reading a direct report's chat history will change what people ask. If managers have access, say so in the interface.
• How long you keep it. The ICO is clear there is no fixed answer: "Data protection law does not set specific time limits for how long you can keep your workers' personal information. This is up to you, and will depend on how long you need the information for your particular purposes." Set a period, write down the reason, and apply it.
• That it is disclosable. Transcripts fall within a subject access request, and they will be read later in a dispute.
• What leaves your systems. If the tool sends conversations to a third party or uses them for model training, that is a processing decision you have to document and justify.

The questions that always go to a person

These should trigger an immediate handover, not a best answer. The trigger is the subject matter, not the bot's confidence.

• Anything that is or becomes a grievance. The Acas Code of Practice on disciplinary and grievance procedures, published on 11 March 2015, is "the minimum an employer should follow", and Acas notes that "The procedure an employer follows and an employee's actions will be taken into account if the case reaches an employment tribunal". A bot cannot follow a procedure. See what a grievance means.
• Anything disciplinary. Same Code, same reason. Our post on the disciplinary procedure sets out the steps a person has to take.
• Disability, health and adjustments. Section 20 of the Equality Act 2010 requires an employer, where a provision, criterion or practice "puts a disabled person at a substantial disadvantage", to "take such steps as it is reasonable to have to take to avoid the disadvantage". Reasonableness is individual and negotiated. It is not a lookup.
• Whistleblowing. Section 43B of the Employment Rights Act 1996 defines a qualifying disclosure as information which the worker reasonably believes "is made in the public interest and tends to show" a criminal offence, a failure to comply with a legal obligation, a miscarriage of justice, a danger to health or safety, that "sexual harassment has occurred, is occurring or is likely to occur" (inserted on 6 April 2026 by section 23(2) of the Employment Rights Act 2025, commenced by S.I. 2026/323), environmental damage, or deliberate concealment of any of these. Our post on what a whistleblower is covers the protection. A disclosure made to a bot is still a disclosure, and the clock has started.
• Bullying, harassment and safeguarding. A person, named, reachable, and trained.
• Anything about pay owed, dismissal, redundancy or immigration status. Individual facts, legal consequences, no lookup answer.

Build the escalation path first and the answer library second. A bot that routes well and answers less is worth more than the reverse.

Frequently asked questions

Is an HR chatbot legal in the UK?

Yes. Nothing in UK law prohibits one. What the law regulates is the personal data it processes and the decisions it makes. If it answers policy questions and routes everything else to a person, the duties are the ordinary ones of transparency, data minimisation, security and retention. If it makes solely automated decisions with legal or similarly significant effects, Articles 22A to 22D of the UK GDPR apply, in force since 5 February 2026.

Does an HR chatbot count as automated decision-making?

Only if it decides. Article 22A says a decision is solely automated where "there is no meaningful human involvement in the taking of the decision", and the provisions bite only where the decision also produces a legal or similarly significant effect. Answering a question about the holiday policy is neither. Refusing a request, setting an entitlement or scoring somebody may be both.

Can a chatbot approve annual leave?

Applying a fixed rule with no judgement, such as checking a balance against a blackout date, is closer to a calculation than a decision. The moment refusal depends on weighing competing requests, service cover or someone's circumstances, a person should decide. Approval and refusal both affect employment circumstances, which the ICO lists among the areas where a decision may have a similarly significant effect.

What should an HR chatbot never answer?

Grievances, anything disciplinary, disability and adjustment questions, whistleblowing, harassment and safeguarding, and anything about pay owed, dismissal, redundancy or immigration status. Each is an individual judgement with legal consequences, and several start a formal procedure the moment they are raised.

Do we need a DPIA for an HR chatbot?

Almost always, if it processes personnel data. A new technology applied to employee data at scale is the situation a data protection impact assessment exists for, and doing one before launch is cheaper than retrofitting the answers.

Who is responsible when the chatbot gives wrong advice?

The employer. The bot speaks for the organisation, and the supplier contract does not change the employee's position. That is why the honest answer to an unclear question is a handover rather than a guess.

Your next step: draw the line, then build

1. List the twenty questions your HR inbox receives most often. Mark each as answerable or a decision. The answerable ones are your scope.
2. Write the escalation list by subject, with a named owner for each. Grievances, discipline, disability, whistleblowing, harassment, pay disputes and exits all go on it.
3. Decide which fields the bot may read, and nothing beyond them. Document why each is necessary.
4. Run a data protection impact assessment, and update the staff privacy notice with the purpose, lawful basis, retention period and recipients.
5. Write the in-interface notice, and set a retention period for transcripts with the reason recorded.
6. Measure correct handovers rather than answered conversations, and review the unanswered log monthly for the next gaps in the written policy.

For the policy behind all of this, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.

Want the handover to be a recorded piece of work rather than an email somebody forgets? Book a New Dynamics demo and bring your top twenty HR questions. You can also email contact@new-dynamics.com.