Where you are
What applies to AI in HR, region by region
The rules are a calendar rather than a countdown. Everything below was reviewed against the sources linked: the United Kingdom, the European Union, the United States and Asia-Pacific on 17 September 2026, the Middle East on 23 September 2026. Your legal and privacy owners make the interpretation; we help them make it.
United Kingdom · European Union · United States · Middle East · Asia-Pacific
Reviewed September 2026
The UK, the EU, the United States, the Middle East and Asia-Pacific on one page, with primary sources.
United Kingdom
There is no single UK AI law. Existing law applies at the point of use, and two things changed this year for HR.
- Data (Use and Access) Act 2025: new UK GDPR Articles 22A to 22D apply from 5 February 2026. Solely automated decisions with legal or similarly significant effects are permitted for most data where safeguards are in place: tell people, let them make representations, provide meaningful human intervention, and let them contest the decision. The stricter rule remains for special-category data. legislation.gov.uk
- ICO, Recruitment Rewired (31 March 2026): employers are expected to tell candidates when AI is used, make human involvement meaningful and consistent, carry out a data protection impact assessment, test tools for bias and give candidates a route to challenge. The ICO plans to publish updated automated decision-making guidance in winter 2026. ico.org.uk
- Equality Act 2010: the discrimination test for any AI-assisted decision about people.
- Employment Rights Act 2025: tribunal time limits extend from three to six months from 1 October 2026; the unfair-dismissal qualifying period reduces to six months for dismissals from 1 January 2027. gov.uk
- EU AI Act: can apply to a UK employer where an AI system's output is used in the EU (Article 2(1)(c)).
- Consultation: where a union is recognised, changes to how people work are a consultation matter under your recognition agreement; a first step is scoped to HR's own work and representatives are told before anything touches represented roles.
European Union
The EU AI Act sets a calendar for employers as deployers. Data protection and worker consultation apply in their own right.
- AI literacy (Article 4): since 2 February 2025, employers using AI take measures to support the development of AI literacy among the people operating it on their behalf. No particular level is mandated and no certificate is required. European Commission
- Prohibited practices (Article 5): since 2 February 2025, including emotion recognition in the workplace, with narrow medical and safety exceptions.
- Transparency (Article 50): since 2 August 2026, people are told when they interact with an AI system; deployers disclose deepfakes and AI-written public-interest text; providers mark AI-generated content, with existing systems given until 2 December 2026. European Commission
- High-risk employment uses (Annex III): deployer obligations apply from 2 December 2027 under Regulation (EU) 2026/1744: human oversight assigned to people with the competence and authority to exercise it, relevant input data where you control it, logs kept at least six months, workers' representatives and affected workers informed before use, and people subject to decisions told. EUR-Lex
- GDPR and consultation: Article 22 and impact assessments continue to apply. In Germany the works council has information rights on planned AI use and co-determines any system that can monitor performance or behaviour; in France the CSE, in companies with 50 or more employees, is informed and consulted before AI tools that affect employees are introduced; in the Netherlands the works council's consent is needed for rules on processing employee data or monitoring. We plan around their agreement rather than after it.
United States
There is no federal AI employment law. Rules arrive state by state and city by city, and courts are testing vendor tools. We map what applies to the states where your people work.
- New York City Local Law 144: annual bias audits and candidate notice for automated employment decision tools, enforced since July 5, 2023. nyc.gov
- Illinois: amendments to the Human Rights Act on AI in employment decisions apply from January 1, 2026, including notice when AI is used; the rules on how notice is given are still being finalised.
- Colorado: the 2024 AI Act was replaced in May 2026 by SB 26-189, which applies from January 1, 2027: notice when automated decision-making technology is used in an employment decision, a plain-language explanation after an adverse decision, and a route to human review. leg.colorado.gov
- California: Civil Rights Council rules on automated decision systems in employment apply since October 1, 2025; the privacy agency's automated decision-making technology rules took effect January 1, 2026, with notice and opt-out duties from January 1, 2027.
- Federal direction and the courts: a December 2025 executive order set a national policy framework and a task force to challenge state AI laws; no federal law pre-empts state rules yet. A federal court in California has allowed claims that a vendor's screening tool acted as employers' agent to proceed (Mobley v. Workday); the case continues. Title VII, the ADEA and the ADA apply to AI-assisted decisions as they always have.
Middle East
Each Gulf state has a data protection law, national AI principles and workforce nationalisation targets, and the financial free zones have rules of their own. We map the countries and zones in scope for your workforce in the first conversation, starting with where employee data may be held.
- United Arab Emirates: Federal Decree-Law 45 of 2021 on personal data protection covers employee data and, under Article 18, gives people the right to object to decisions based solely on automated processing that have legal or similarly serious effects, including profiling; the executive regulations are still awaited. The Labour Law (Federal Decree-Law 33 of 2021, Article 4) prohibits discrimination on race, colour, sex, religion, national or ethnic origin or disability across advertising, hiring, pay, training, promotion and dismissal, with Emiratisation as the lawful exception. A Federal Authority for Artificial Intelligence and Data was announced on 14 June 2026; there is no federal AI law yet. u.ae
- DIFC and ADGM: in the Dubai International Financial Centre, the Data Protection Law 2020 and Regulation 10, in force since 1 September 2023, set duties for deployers and operators of autonomous and semi-autonomous systems, including AI: notice of how a system processes personal data, evidence of the checks that bring a person in where an outcome could be unfair or discriminatory, an Autonomous Systems Officer for high-risk processing, and audit and certification duties; amendments were consulted on in June and July 2026. Abu Dhabi Global Market's Data Protection Regulations 2021 (Article 20) carry the right against solely automated decisions with legal or similarly significant effects. difc.com
- Saudi Arabia: the Personal Data Protection Law, supervised by the Saudi Data and AI Authority (SDAIA), has applied in full since 14 September 2024, with implementing regulations and the Regulation on Personal Data Transfer Outside the Kingdom, updated on 1 September 2024: transfers rest on SDAIA's standard contractual clauses, binding common rules or accreditation, so where employee data is hosted is usually the first question. SDAIA's AI Ethics Principles (September 2023) apply to every entity developing or using AI in the Kingdom, with a four-tier risk classification. Arabic is the language of employment records and contracts (Labor Law, Article 9), and Nitaqat sets Saudisation bands by sector. sdaia.gov.sa
- Qatar: Law No. 13 of 2016 on personal data privacy protection; the National Cyber Security Agency's Guidelines for Secure Adoption and Usage of AI (February 2024); the Ministry of Communications and Information Technology's Principles and Guidelines for Ethical AI, in effect since 8 May 2025 as non-binding guidance; and the Qatar Financial Centre's own Data Protection Regulations 2021 for QFC entities. Employment contracts are in Arabic, with the Arabic text prevailing, and Qatarisation targets apply in the private sector. hukoomi.gov.qa
- Bahrain, Oman and Kuwait: Bahrain's Personal Data Protection Law (Law 30 of 2018) has applied since 1 August 2019, and an AI bill approved by the Shura Council in April 2024 remains before the Council of Representatives. Oman's Personal Data Protection Law (Royal Decree 6/2022) and its 2024 executive regulations have applied in full since 5 February 2026. Kuwait's data privacy regulation (CITRA Resolution 42 of 2021) was narrowed in 2024 to CITRA licensees in the telecoms sector. mtcit.gov.om
- Nationalisation and language: Emiratisation, Saudisation, Qatarisation, Omanisation, Bahrainisation and Kuwaitisation targets shape hiring, so any screening or workforce tool applies nationality rules exactly as each country sets them, and keeps the evidence. Employee-facing notices and records are needed in Arabic where the law makes Arabic the official version.
Asia-Pacific
Asia-Pacific is many regimes rather than one. We map the jurisdictions in scope for your workforce in the first conversation, starting with where data may be processed.
- Singapore: the PDPA and the PDPC's 2024 advisory guidelines on personal data in AI decision systems; IMDA's Model AI Governance Framework, including the generative AI edition, and AI Verify; the Tripartite Guidelines on Fair Employment Practices; and the Workplace Fairness Act, expected to take effect from end-2027 for employers with 25 or more employees. TAFEP
- South Korea: the AI Basic Act applies from 22 January 2026; high-impact AI includes systems used for recruitment and other judgements that materially affect people, with duties falling mainly on the businesses that develop or provide them, and enforcement phased through 2026.
- Japan: the AI Promotion Act (2025) is principles-based; the APPI governs employee and candidate data.
- China: the PIPL, the algorithmic recommendation provisions and the generative AI measures. Sending employee data abroad needs a lawful route, with an exemption for transfers needed for cross-border HR management; notice, consent and impact-assessment duties still apply.
- Hong Kong: the PCPD's Model Personal Data Protection Framework for AI (2024) and its 2025 checklist on staff use of generative AI. pcpd.org.hk
- Australia: Privacy Act transparency for automated decisions from 10 December 2026. OAIC
- India: the DPDP Act and its 2025 Rules, phasing in, with the main duties from May 2027.
We map what applies to your workforce, build the work around it, and keep the evidence in PeopleSafeguard: what AI HR uses, who is trained, and what was decided. Your legal and privacy owners make the interpretation; we help them make it. More references, guides and the weekly note
Find your first move
A 30 minute conversation about your priorities, your systems and a responsible place to start. You leave with three candidate first moves. No charge, no sensitive data required, no slides about us.