Algorithmic management and the planner: what the rules now expect
As soon as software decides who works when, who is flagged for absence, or who is told they are off-schedule, a planning tool has become a system that makes decisions about people. The law is catching up, and planners are often the people who own those systems without having been told. This article is general information, not legal advice; confirm specifics with your data protection officer or counsel.
The EU: a delay, but not a reprieve
The EU’s AI Omnibus (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force on 27 July. Its headline effect was to push the application date for stand-alone high-risk systems under Annex III from 2 August 2026 to 2 December 2027. Employment is one of the Annex III areas, and in the Act’s wording it reaches systems used to make decisions affecting the terms of work relationships, to allocate tasks based on individual behaviour or personal traits, and to monitor and evaluate workers’ performance and behaviour. Whether a given scheduling or adherence tool falls inside that depends on what it actually does, which is a question for your legal team.
Two things did not move. The transparency obligations in Article 50 still apply from 2 August 2026, including telling people when they are interacting with an AI system, which matters for any bot in front of your queues. And the duty to support staff AI literacy has applied since February 2025. A fifteen-month delay on the high-risk rules is time to prepare, not a reason to wait: documentation, human oversight and impact assessments take longer to build than most teams expect.
The UK: ADM rules rewritten, monitoring under review
In the UK, the Data (Use and Access) Act 2025 replaced the old automated decision-making provisions with new Articles 22A to 22D of the UK GDPR. The framework is more flexible and risk-based than before, but it keeps the safeguards that matter in practice: meaningful human intervention, transparency, and the right to contest a decision.
Alongside that, the government published a consultation on workplace monitoring technologies in July 2026, which closed on 30 September. It floated eight principles for responsible use: purpose, transparency, worker engagement, fairness, necessity and proportionality, human oversight, wellbeing, and accuracy and review. No policy has followed yet, and the ICO’s own guidance on monitoring is still in draft following the Act. The practical reading is that existing data protection duties apply now, including justifying monitoring as necessary and carrying out a data protection impact assessment where the risk is high, and the direction of travel is towards more explicit expectations, not fewer.
Which planning decisions count?
Attendance and absence management and the monitoring of worker activity are the standard examples of automated decision-making in the employment setting, and they sit squarely in the planner’s patch. Think through the list: shift allocation and rota generation, automatic approval or refusal of swaps and leave, absence-trigger alerts, adherence and conformance flags that feed performance conversations, intraday reassignment of agents between skills, and any composite “performance score” built from those inputs.
Not all of them carry the same weight. A schedule suggestion a planner reviews is different in kind from an automated refusal of a leave request, and different again from a flag that triggers a disciplinary step. The question regulators care about is the effect on the individual and how much real human judgement sits between the system and that effect.
A decision register you can start this week
The most useful single thing a planning team can do is write down every automated or semi-automated decision about people. For each one, record what the system decides, what data it uses, who can see and override the result, how quickly, and how staff are told. Then classify it: informational, recommendation, or decision with a significant effect on the person.
The register does three jobs. It shows you where human oversight is nominal (a person technically approves, but there are four hundred a day and no time to look). It gives your data protection officer something to assess instead of a blank page. And it makes the conversation with staff representatives easier, because “here is how schedules are generated and here is how you challenge one” is a reassuring thing to be able to say. The same instincts underpin people analytics that serves decisions, not surveillance, and the customer-side duties in what Consumer Duty means for planners and planning for vulnerable customers.
Shadow AI is part of the picture
One risk sits outside the platform altogether. Deloitte’s UK survey of around 25,000 people, as reported in September 2026, found nearly one in three British workers using generative AI at work without their employer’s knowledge. Planners handle forecasts, headcount and sometimes individual-level data, and pasting any of it into a public tool is a data protection incident waiting to happen. An approved tool, a one-page data rule and a short training session cost far less than the alternative.
The closing thought
Good practice and compliance point the same way here: know what your systems decide, keep a real human in the loop where the effect on a person is significant, and be able to explain it. The final part turns from risk to the team itself: skills, careers and a ninety-day plan.
See also
- CC AI risk & compliance — engaged, not bolted on
- People analytics — serving decisions, not surveillance
- The operating model your AI capability deserves
- Building an AI-ready planning team: skills, careers and the first 90 days
Sources and further reading
External sources used in researching this article, accessed October 2026. Vendor-authored and trade-press material is identified as such; figures are quoted as reported and have not been independently verified.