Job references written or checked with AI: UK rules

References are moving onto software. Managers ask chatbots to draft them, and recruiters use platforms that collect referee answers and turn them into scores or summaries. The law on references in Great Britain was not written with AI in mind, but several existing rules apply directly. This page explains them for workers, former employers writing references and employers receiving them.

The short answer: a former employer must not discriminate against or harass someone in a reference where that would have been unlawful during the job (Equality Act 2010, section 108). A candidate's right to see their personal data does not extend to a reference given in confidence for employment purposes, but other data protection duties still apply. If a significant hiring decision is taken solely by automated processing, including an automated reference score, the UK GDPR requires safeguards such as the right to human intervention.

Discrimination does not stop when the job ends

Section 108 says a person must not discriminate against or harass another where it arises out of and is closely connected to a relationship that used to exist between them, and the conduct would have breached the Act during the relationship (Equality Act 2010, s108). A reference is a common example. The duty to make reasonable adjustments can also apply (s108(4)). So a reference that mentions sickness absence linked to a disability, or a maternity leave period, needs care whether a person or a tool wrote it. An AI drafting tool given raw HR data may pick up exactly those details, so the person signing off should check what went in and what came out. See UK equality law and AI.

Confidential references and the right of access

Schedule 2, paragraph 24 of the Data Protection Act 2018 says the listed UK GDPR provisions do not apply to personal data consisting of a reference given, or to be given, in confidence for the purposes of the person's education, training or employment, or prospective employment, among other purposes (DPA 2018, Sch 2 para 24). The listed provisions are the transparency duties in Articles 13 and 14, the right of access in Article 15, and the matching parts of the Article 5 principles (Sch 2 para 18). In practice, a worker cannot rely on a subject access request to see a confidential reference. The exemption is limited to those provisions: the rest of the UK GDPR still applies, including the accuracy principle and the right to have inaccurate data corrected (UK GDPR, Article 16). For access requests generally, see how to request the data AI systems hold on you.

Automated reference checks and scores

Since 5 February 2026, Articles 22A to 22D of the UK GDPR govern automated decisions. A decision is based solely on automated processing if there is no meaningful human involvement, and it is significant if it has a legal or similarly significant effect on the person (UK GDPR, Article 22A). Where a significant decision based on personal data is taken solely by automated processing, the controller must have safeguards that give the person information about the decision, let them make representations, let them obtain human intervention and let them contest it (Article 22C). Stricter limits apply where special category data, such as health data, is involved (Article 22B).

So if a platform turns referee answers into a score and an employer rejects candidates automatically on that score, the employer needs those safeguards in place. A recruiter who reads the summary and makes a real decision is a different case, but the human involvement has to be meaningful, not a click through. See automated decisions about workers under UK data law and AI in hiring.

Practical steps

• Writing a reference with AI help: give the tool only what the reference needs, such as dates, role and agreed facts. Do not feed it absence records, grievances or health data. Read the draft line by line, remove anything you cannot stand behind, and check it against the person's record.
• Receiving references: know whether any tool scores or filters them, keep a person in the decision, and tell candidates how references are used and how to challenge a decision.
• Workers: if you are leaving under a settlement, an agreed reference can be part of the deal; see UK settlement agreements. If you think a reference was discriminatory, note the time limit for a claim and seek advice early.

Recruitment agencies placing people in work with vulnerable people have their own duty to obtain two references; see recruitment agency rules.

This page covers England, Wales and Scotland for the Equality Act; the Data Protection Act 2018 and UK GDPR apply across the UK. It is general information, not legal advice.