The default should be no, with a tightly controlled exception
Do not give staff general permission to upload sickness records, fit notes, occupational health reports or return-to-work notes into an AI assistant. A narrowly defined use may be appropriate after an employment and data protection review, but an available upload button is not approval. The starting point is the business purpose, not the software.
There is a legitimate operational problem here. The Office for National Statistics estimated 148.8 million working days were lost to sickness or injury in 2025, averaging 4.4 days per worker. These are official statistics in development, with stated quality limitations. They explain why employers want better planning; they do not justify predicting an individual employee's future illness.
Separate three requests that often get bundled together: counting absence days, understanding general staffing pressure, and interpreting someone's medical circumstances. The first two may need only existing reporting. The third involves sensitive information and potentially serious consequences for a person. Ask whether the same decision could be made with fewer details, a conventional report or a conversation with the employee. If it could, uploading the clinical material is difficult to justify.
What permissions and legal checks are needed?
The ICO's guidance on workers' health information says identifiable health information is special category data. Processing it requires an Article 6 lawful basis and an Article 9 condition, with additional Data Protection Act 2018 requirements where applicable. A manager's permission is not a substitute for these checks.
Write down exactly what the AI would do, which fields it would receive, who would read the output and what action could follow. An existing basis for maintaining sickness records does not automatically authorise every new AI analysis. Review necessity, fairness, compatibility with the original purpose and the information given to workers. Assess whether a data protection impact assessment is required before introducing the proposed processing.
Do not solve this with a blanket consent form. Employment relationships can make genuinely free consent difficult. Seek specialist advice on the appropriate basis and condition rather than asking employees to waive their privacy. The ICO flags its guidance as under review following the Data (Use and Access) Act. Check the current position before deployment, especially for automated decisions. Regardless of technical design, a named employer representative must remain accountable for how the information is used.
Removing names is not enough in a small team
Imagine a hypothetical twelve-person business. A spreadsheet replaces names with employee numbers but still contains job titles, exact absence dates and a reference to a rare treatment. The owner can immediately recognise the person. That is not anonymous data merely because the name column has gone. It remains information about an identifiable worker.
Free-text notes are especially troublesome. They may describe medication, family circumstances, pregnancy, mental health, a grievance or somebody else's health. Asking an assistant to summarise the file can disclose much more than the staffing question needs. The summary can then travel into email, management meeting notes or a shared search index, creating new copies that are harder to control.
For capacity planning, prefer the minimum necessary totals prepared inside an approved system. Even grouped figures can identify someone where a department has one employee or a category contains one unusual case. Consider suppressing small groups, widening time periods and excluding narratives. Those are risk-reduction measures, not a guarantee of anonymisation.
Keep medical detail separate from ordinary scheduling information. A colleague arranging cover usually needs to know that someone is unavailable, not why. Before any AI trial, test whether the proposed output exposes a person indirectly, and ask who could combine it with other information already available in the business.
What should a supplier have to demonstrate?
A paid business account is not proof that a tool is suitable for employee health data. ChatGPT, Microsoft Copilot and Google Gemini cover different products and contractual arrangements; a familiar brand name does not settle the question. Evaluate the exact service, account type, features and configuration you intend to use, rather than assuming all versions have the same protections.
Ask the supplier to document its role, processing terms, retention, deletion arrangements, subprocessors, international transfers and whether prompts or outputs are used for training. Check connected applications, search indexes, diagnostic logs and support access as well as the chat interface. A promise about model training does not answer who can retrieve an uploaded file.
Permissions should match the existing HR boundary. A person entitled to see staffing totals should not gain access to occupational health reports through an assistant. Use business-owned accounts, restricted access and an audit trail; test with synthetic records before considering real information. Include a failure scenario where somebody asks for another employee's medical details.
Compare the proposed purchase with your current HR system's ordinary reporting, a restricted spreadsheet and support from an HR adviser or occupational health professional. These may meet the need without another AI service. Reject a supplier that cannot explain the data flow or demonstrate how access is withdrawn. Do not enter sensitive records simply to find out whether its controls work.
Why a useful-looking score can still be unfair
Do not let an assistant turn absence notes into a reliability ranking, a diagnosis or a recommendation about dismissal. A persuasive explanation can still omit medical context, misunderstand a date or confuse a planned treatment with an unplanned absence. A human approval button is not meaningful review if the manager cannot challenge the evidence behind the output.
Acas explains that reasonable adjustments can include changing absence triggers or recording disability-related absence separately. Its example of Leslie, who takes leave for cancer treatment, shows why treating every absence as equivalent can disadvantage someone. This is an illustrative example in official guidance, not a case study of our work.
The Equality Act 2010 applies in Great Britain; employers in Northern Ireland need to consider the different applicable equality framework. An automated pattern is not a defence for unlawful treatment. Get appropriate HR or legal advice before using any analysis in decisions affecting employment.
If a restricted assistant drafts a factual summary for an authorised professional, require comparison with the original record, a clear distinction between facts and inferences, and a route for correcting errors. Do not circulate unverified conclusions. A system that cannot abstain when information is incomplete is unsuitable for this job, however polished its wording appears.
When this is NOT right for you, and what to do instead
This is not an appropriate first AI project if your business lacks a clear absence policy, named HR responsibility, controlled records or access to specialist advice. It is also the wrong choice where the objective is to catch supposedly dishonest employees, predict diagnoses or avoid a difficult management conversation. Better software cannot make an unjustified purpose acceptable.
Start with the least intrusive alternative. Use existing absence totals for planning. Keep medical reports with authorised people. Give managers a consistent process for supportive conversations and reasonable adjustments. If all you need is arithmetic, use a spreadsheet formula or the reporting already included in your HR package. That may involve no additional software subscription, although staff time still has a cost.
For a clearly labelled hypothetical comparison, two hours of monthly manual reporting valued internally at £25 an hour is £50 of staff time. That is not a market quote or a promised saving. Compare any AI proposal against its complete review, procurement, support and correction costs, not just its licence price. There is no honest universal budget for an approved health-data workflow.
If a specific use still has a defensible benefit, have the appropriate advisers review it, approve the narrow scope and test the controls before using real records. Discussing the workflow first is sensible; purchasing an AI implementation before establishing whether the processing is appropriate is not.
Is This Right for You?
This guidance is for UK owners and managers deciding whether to approve AI access to employee sickness or health records. It is not permission to diagnose staff, rank their reliability or automate employment decisions.
A narrow, professionally reviewed use may be appropriate. If existing HR reports answer the question, or your access controls and absence processes are unclear, do not introduce health-data AI analysis.