If you run a small business, you need to see this: the government has opened a consultation on the AI tools that watch your staff, and a third of UK organisations are already using something that would fall inside it.

We spend most of our time in this newsletter talking about AI that helps a small business grow. This one is different. It is about AI that a lot of small businesses have already quietly switched on, usually through a time-tracking app or a “productivity” dashboard bundled into project management software, without realising it now sits inside a live policy debate with a closing date three weeks away.

What the consultation actually covers

On 8 July 2026 the Department for Business and Trade opened a consultation on workplace monitoring technologies, part of the wider Employment Rights Act 2025 reform programme. It closes on 30 September 2026.

The definition is broad on purpose. It covers any digital tool that collects, tracks or analyses information about workers, including systems that use automated decision-making or algorithmic management to act on that data. That is not just call-centre keystroke loggers. It is login and logout tracking, browser history tools, email scanning, GPS on a company van, and scheduling software that quietly scores staff on speed. If your business uses any tool that watches how your team works and feeds that into a decision, this consultation is about you, not just the big employers with dedicated HR teams.

The government is weighing three options, from non-statutory guidance at the light end through to a statutory code of practice, up to new legislation that would require employers to consult staff before introducing certain monitoring tools, backed by financial penalties for firms that skip the process.

A third of firms are already doing this

This is not a hypothetical problem for a handful of logistics firms. Research from the Chartered Management Institute, covering more than 900 UK managers, found that a third of UK organisations already deploy some form of “bossware” to monitor staff activity, split fairly evenly across onsite, hybrid and remote teams. The most common methods were login and logout tracking (39%), browsing history (36%) and email monitoring (35%).

The uncomfortable number sitting underneath that is trust. The same body of research found that roughly the same proportion of managers admitted they did not actually know what monitoring their own organisation carried out. That is not a small business problem specifically, but it is exactly the kind of gap a small business cannot afford: if you cannot say precisely what your monitoring software collects, you cannot show a member of staff, a tribunal or a regulator that it is proportionate.

The rules that already apply, before any new law lands

Here is the part worth acting on now rather than waiting for the consultation to close. Monitoring workers is already covered by data protection law, and it has been since well before this consultation existed. The Information Commissioner’s Office’s guidance on monitoring workers sets out that any monitoring has to be lawful, necessary, proportionate and transparent under UK GDPR, and that anything higher-risk needs a Data Protection Impact Assessment before it goes live, not after a complaint lands on your desk.

We have sat with small business owners who installed a monitoring feature because it shipped free inside the software they were already paying for, never told the team it was switched on, and had no answer when someone asked what it recorded. That is the exact scenario both the ICO’s existing rules and this new consultation are aimed at. New legislation, if it arrives, will not be inventing an obligation from nothing. It will be putting teeth behind one that already exists.

What we would check before the consultation closes

Whatever the government decides, three questions are worth answering for your own business this month, not after the rules change:

• Do you actually know what every tool in your stack collects about your staff, including features bundled quietly into scheduling, HR or project software you did not choose for monitoring in the first place?
• Have you told your team, in plain language, what is tracked and why, rather than burying it in a contract clause nobody reads?
• If a member of staff asked you tomorrow what data you hold on their working patterns, could you answer in five minutes, or would you need to phone your software provider first?

None of that requires new legislation to start. It requires an audit, and most small businesses can do a basic one in an afternoon: list every tool that touches staff activity, check its settings against the ICO checklist, and write down, in one page, what you monitor and why. If the answer to “why” is “because the software does it by default”, that is the line item to switch off.

Where this is heading

The consultation closes on 30 September 2026, and the government’s response could take the form of guidance, a statutory code, or binding legislation with a duty to consult staff before introducing new monitoring tools. Whichever way it lands, the direction is the same: less “install and forget”, more “explain and document”. Small businesses that get transparent now, while it still counts as good practice rather than a legal minimum, will not be scrambling when the rules formally change.

AI is genuinely useful for understanding how a small team is spending its time. The problem was never the technology. It was switching it on without telling anyone, and that is the one habit worth breaking before the rules make you.