HR AI and automation, built around your HR system

• New starters

  Right to work is checked before day one: a Home Office online check from a share code, a registered digital provider for British and Irish passports, or a manual document check, with a dated copy kept for the employment plus two years. The principal written statement is due on the first day.

• Sickness and absence

  Since 6 April 2026, Statutory Sick Pay has no waiting period or lower earnings limit: £123.25 a week or 80% of normal weekly earnings, if lower. A fit note is due after more than seven days off in a row. The ICO advises keeping illness details apart from the absence record.

• Disciplinaries and grievances

  The Acas Code asks for investigation and a meeting without unreasonable delay, written notice with copies of evidence, a companion, a written decision and an impartial appeal. For acts from 1 October 2026, most tribunal claims have a six-month limit, not three.

• Subject access requests

  A worker can ask verbally or in writing, and the ICO says a grievance or tribunal claim is no reason to refuse. The answer is due within a month, after reasonable searches of mailboxes and files, with other people's details redacted where needed.

• Personio and HiBob

  Personio's API v2 uses OAuth 2.0 and covers people, employments, absences, attendances and documents, with signed webhooks. HiBob documents APIs for employee data, time off, attendance, documents and tasks, with webhooks.

• Breathe and BrightHR

  Breathe documents an API that takes a key in an X-API-KEY header. BrightHR's developer portal covers employees, Blip clock-ins and breaks, and approved absences.

• Access PeopleHR and Ciphr

  Access PeopleHR publishes Swagger API documentation, keys that can exclude basic salary, and a new-starter webhook. For Ciphr we found no public API documentation, so we would ask Ciphr first.

• Payroll

  Xero's Payroll UK API uses OAuth 2.0 and covers employees, leave, statutory sick leave, timesheets, pay runs and payslips. Where payroll takes a file instead, we produce it and keep a copy.

• Starter to payroll in one flow

  From signed offer to first payslip: the right to work check by the right route, its copy filed with a deletion date two years after leaving, follow-up checks diarised, the principal statement issued on day one, and the starter written once to the HR system and payroll.

• Absence that reaches payroll

  Sickness logged once and sent to payroll with SSP from the first day. Fit notes are read, dated and filed apart from the absence record, open only to those who need them. Return-to-work meetings go to the line manager as tasks.

• A file for every case

  Each disciplinary or grievance moves through the Acas Code steps with dates, from investigation to appeal, with notes and letters in one restricted file. If you run Ciphr, its case management may already do this, and we would build around it.

• A subject access desk

  Logs each request and runs its clock, paused while you wait for clarification. It searches the HR system, case files and mailboxes, queues documents for redaction review, and acknowledges data protection complaints within 30 days.

• Immigration, Asylum and Nationality Act 2006

  A prescribed check before employment starts gives a statutory excuse, kept by follow-up checks where permission is time-limited. Copies are kept for the employment plus two years, then destroyed. Using a digital provider leaves the duty with the employer. The civil penalty is up to £60,000 per illegal worker.

• UK GDPR Articles 22A to 22D

  They replaced Article 22 on 5 February 2026, under the Data (Use and Access) Act 2025. A significant decision, such as a dismissal or pay change, taken with no meaningful human involvement needs safeguards: information, representations, human intervention and a way to contest it. Health data restricts it further.

• Data (Use and Access) Act 2025: access requests and complaints

  Since 5 February 2026, the month to answer a subject access request pauses while you wait for clarification you reasonably need, and complex or numerous requests allow two more months, by notice within the first month. Searches must be reasonable and proportionate. From 19 June 2026, data protection complaints must be acknowledged within 30 days.

• Acas Code of Practice on disciplinary and grievance procedures

  Tribunals take it into account and can adjust an award by up to 25% for unreasonable failure to follow it (Trade Union and Labour Relations (Consolidation) Act 1992, section 207A). Acas consulted on an updated Code until 23 September 2026 and expects it in 2027.

• Employment Rights Act 2025

  Day-one paternity and unpaid parental leave from 6 April 2026; six-month limits for most tribunal claims about acts from 1 October 2026; all reasonable steps to prevent sexual harassment from 30 October 2026; a six-month qualifying period for unfair dismissal, for dismissals from 1 January 2027.

• AI automation
• Business automation and integrations
• Bespoke software development

Other industries: Recruitment agencies, Law firms.

Sources

Every rule, date and figure on this page comes from the sources below, checked on 31 October 2026. Rules change: check anything that matters with the source or your adviser.