How a CEO should set up an HR team in a small or growing company in 2026

How a CEO should set up an HR team in a small or growing company in 2026

On 25 September 2026 we went through every page of our own category index at trustlist.uk/categories and counted what it holds for human resources. On the services side there are 2,956 entries under Recruitment Agency, 237 under Human Resource Agency, 20 under Staffing Agency and one under Payroll Company: 3,214 in all. On the software side we found 23 HR software categories, from payroll and applicant tracking to background checks and time clocks, holding 301 product entries between them. A product can sit in more than one category, so the number of distinct products is lower.

Two things stood out. Recruitment firms outnumber every kind of HR software in our catalogue by roughly ten to one, and payroll bureaux barely appear. And the software side is split thinly: "HR Software" holds 2 entries and "Human Resource Software" holds 15, the same thing filed twice, while "Performance Management Software" holds 2 and "Performance Appraisal Software" 9. The first point fits how small companies tend to buy HR: as a service from an agency, a bureau or an adviser, long before they hire anyone. The second is a weakness in our catalogue and a warning about the market: vendors describe the same product in different words, so a category name is a poor way to shortlist. This guide sets out how to build the function, what to buy, what to keep, and what the 2026 rules mean for each choice.

What our count does and does not tell you

The counts show what we list, not how many HR firms or products exist, and parts of our catalogue are old: 9,620 live company listings were last updated in December 2020. Treat any directory listing, ours included, as a starting point, and confirm a firm's services and prices on its own website. The same goes for vendor claims about AI screening; the questions to ask follow below.

What changed for employers in 2026

A CEO does not need to know employment law in detail, but should know the calendar, because it decides when you need specialist help. These dates come from the UK government's timetable for the Employment Rights Act 2025, updated on 25 August 2026, plus two other rules that affect hiring.

Date	Change
6 April 2026	Day-one paternity leave and unpaid parental leave; Statutory Sick Pay loses its waiting days and lower earnings limit; whistleblowing protection covers reports of sexual harassment
7 April 2026	The Fair Work Agency is set up
1 October 2026	Time limit for most employment tribunal claims rises from three to six months (9 November 2026 for Scottish breach of contract claims)
1 October 2026	Revised Home Office right to work guidance comes into force
30 October 2026	Employers must take "all reasonable steps" to prevent sexual harassment, and must not permit harassment by third parties
1 January 2027	Unfair dismissal qualifying period falls to six months, for dismissals from that date; compensatory award cap removed
January 2027	Fire and rehire protections
During 2027	Guaranteed hours, stronger protection for pregnant women and new mothers, and other measures, dates to be set
2 December 2027	EU AI Act rules for stand-alone high-risk AI, including recruitment and HR tools, apply (postponed from August 2026)

The government says future dates remain subject to parliamentary processes and may change, so give a named person the job of checking the timetable each quarter.

From 1 January 2027 an employee can claim unfair dismissal after six months' service rather than two years. Probation, performance management and dismissal need a written process that someone actually follows, and the six-month tribunal window from October 2026 means records must be kept and findable for longer.

Generalist first, specialists later

The CIPD describes the model most large employers use as three parts: a shared service for administration, casework and payroll; centres of expertise in areas such as reward, learning and talent; and business partners who advise line managers. It also says context matters and that what works in one organisation may not suit another. A company of 40 cannot staff three teams, but it can separate routine work from advice and decide which of each to do itself.

The first HR hire in a small company should be a generalist: an HR manager or senior advisor who can write contracts and policies, run a disciplinary or grievance fairly, set up onboarding, own the HR system and manage outside suppliers. Avoid hiring a recruiter first because hiring is the loudest problem. A recruiter fills roles; they do not stop you dismissing someone unlawfully, and from January 2027 that risk arrives at six months' service.

Specialists come later, in a predictable order:

1. Talent acquisition, when you hire more than about two people a month and agency fees become a real budget line.
2. HR operations or people systems, when the HR system, payroll inputs and reporting take more than a day a week.
3. Reward, when pay bands, bonuses or share options need an owner, and when gender pay gap reporting becomes due (employers with 250 or more employees on the snapshot date must report).
4. Learning and development, when managers are promoted faster than they are trained.
5. Employee relations, when casework is constant enough that the generalist cannot also plan.

Each of these can be bought as a service before it is hired as a person.

What to outsource: payroll, legal advice and recruitment

Payroll. HMRC requires a Full Payment Submission on or before each payday, covering all employees whatever they earn. Pension duties start with your first employee: staff aged 22 to State Pension age, earning at least £10,000 a year and normally working in the UK must be enrolled, and newly eligible staff enrolled and written to within six weeks. A payroll bureau or an accountant running payroll software handles this well for most small companies. Keep approval of each pay run inside the company: someone who is not the processor signs off totals, starters, leavers and pay changes.

Employment law advice. Buy it on a retainer before you need it; it costs less than one badly handled dismissal. Ask for contract templates, a handbook and disciplinary and grievance procedures updated for the 2026 and 2027 changes, and a named adviser who takes the call when a manager wants to dismiss someone.

Recruitment. Use agencies for roles you hire rarely or where the market is tight. Do not let them set your process: interview stages, scoring criteria, right to work checks and offer approval stay with you.

Fractional HR. HR consultancies and part-time HR directors fill the gap before the first hire or above a junior team. Give them a list of deliverables and a monthly limit on hours.

HR software: what to buy and in what order

Most companies need three systems, bought in this order.

1. Payroll. Your bureau's or your own. It must file to HMRC in real time and handle pension enrolment.
2. An HR information system (HRIS). The single record of who works for you, on what terms, with what absence, holiday, contracts, right to work evidence and training, with permissions over who sees what.
3. An applicant tracking system (ATS). It records every candidate, stage and decision. Buy one once you hire more than a handful of people a year: the record is your defence if a rejected candidate says the process was unfair.

Our catalogue has 19 entries under Payroll Software, 21 under Applicant Tracking Software and 15 under Human Resource Software, among others. Rather than trust the label, ask each vendor:

• Where is employee data stored, who at the vendor can see it, and which sub-processors do you use?
• Can we export all our data in a standard format if we leave, and at what cost?
• Which features use AI, are any on by default, and can we switch them off?
• How much notice do you give of changes? Our news desk logged 28 vendor changes with a notice date in September 2026: median notice was 31 days, six gave a week or less, and four switched a feature on by default for existing customers.
• Is the price you quote current? Prices on directory listings, including ours, go out of date.

AI in hiring: what the law allows

AI now appears at every stage of hiring: writing adverts, sourcing candidates, screening CVs, scoring assessments and transcribing interviews. It saves time, and carries more legal risk than anything else HR buys, because it shapes decisions about people.

The UK regulator has looked closely. Between August 2023 and May 2024 the Information Commissioner's Office audited developers and providers of AI recruitment tools, publishing the outcomes on 6 November 2024. It made 296 recommendations and 42 advisory notes; 97% of recommendations were accepted and the rest partly accepted. Some tools let recruiters filter out candidates with certain protected characteristics. Some inferred gender or ethnicity from an application or just a name, which the ICO said is not accurate enough to monitor bias and was often done without a lawful basis or the candidate's knowledge. Some collected far more personal information than needed, including profiles scraped from job networking sites and social media. Several providers wrongly called themselves processors rather than controllers, under vague contracts that pushed responsibility onto the recruiter.

UK data law has moved. The Data (Use and Access) Act 2025 relaxes the old restriction on solely automated decisions, but only with safeguards: the person must be able to make representations, get meaningful human intervention and contest the decision. The ICO says its employment guidance is under review because of the Act, and it has started work on a statutory code of practice on AI and automated decision-making. Until that exists, expect it to ask for what its audit report already recommends. The government's own guide to responsible AI in recruitment, from March 2024, adds impact assessments, bias audits, performance testing and reasonable adjustments for disabled candidates.

If you hire in the EU. Annex III of the EU AI Act lists as high-risk AI used to recruit or select people (targeted job adverts, filtering applications, evaluating candidates) and AI used for promotion, termination, task allocation or monitoring performance. In May 2026 EU lawmakers agreed to postpone the high-risk rules for stand-alone systems like these to 2 December 2027. Postponed is not cancelled: tools you buy now will still be in use when the rules apply.

If you hire in New York City. Local Law 144 has been enforced since 5 July 2023. An employer using an automated employment decision tool needs a bias audit done within the past year, a published summary of the results, and notice to candidates ten business days before the tool is used.

The rule we would adopt: use AI to draft, sort and summarise, but never let it reject a candidate without a person reviewing the decision, and record who reviewed it.

Right to work checks and employee data

Right to work. Every UK employer must check a worker's right to work before they start. The Home Office's employer guide allows three methods: a manual check of original documents, the Home Office online check with a share code, or a certified digital verification service provider. People with an eVisa can only prove their right through the online service. A check done as prescribed, with records kept for the employment and two years afterwards, gives you a statutory excuse. Without one, the civil penalty is up to £60,000 per illegal worker, and knowingly employing an illegal worker can bring up to five years in prison.

The Home Office republished its guide in draft on 11 September 2026. The new version comes into force on 1 October 2026 and covers people engaged under worker's contracts, as individual sub-contractors, or through online matching platforms, not just employees. Employers cannot insist on a particular method of proof and must treat candidates consistently, so make the check a standard step in your ATS or onboarding flow.

Employee data. HR holds the most sensitive data in the company: health records, disciplinary files, bank details, sometimes criminal records checks. The ICO's guidance on monitoring workers sets the basics. Be clear about your purpose and choose the least intrusive means. Carry out a data protection impact assessment before any monitoring likely to cause high risk, such as keystroke logging or biometrics. Tell workers what you collect and why. Covert monitoring needs senior management authorisation and a suspicion of crime or gross misconduct.

For a small company that means three rules. Give HR data its own access permissions, separate from shared drives. Set a retention schedule and check the HRIS deletes on time; the ICO audit found most providers left the retention period to the recruiter. And switch on no monitoring or productivity feature until you have done the assessment and told staff.

Org shapes at 20, 100 and 400 staff

These are starting points. Adjust for how fast you hire, how many sites you run and whether you employ people abroad.

	About 20 staff	About 100 staff	About 400 staff
In-house HR	None, or a part-time HR or office manager	HR manager plus one HR advisor or administrator	Head of People; two or three HR business partners; HR operations team of two or three; talent lead with two or three recruiters; reward and learning specialists
Outsourced	Payroll bureau; employment law advice line; fractional HR a few days a month	Payroll bureau; employment law retainer; agencies for hard roles	Employment law panel; benefits broker; specialist agencies
Systems	Payroll, simple HRIS	Payroll, HRIS, ATS	Payroll, HRIS with self-service, ATS, learning system
CEO's time	High: approves every hire, pay change and dismissal	Medium: owns pay and senior hiring, reviews casework monthly	Lower: sets policy and pay budget

At 20 staff the risks are missing contracts and right to work evidence; at 100, inconsistent managers and an unwritten hiring process; at 400, regulatory duties with no owner. Finance faces its own changes at that size, covered in our companion guide on how to structure an accounting team.

What the CEO keeps

Delegating HR does not mean delegating everything. These stay with the CEO at every size:

• The pay budget and its principles. Who decides a salary, how bands are set, what happens on promotion.
• Senior hiring and senior dismissals. Your direct reports, and any dismissal that could become a claim.
• The rules on AI and monitoring. Which tools may make or shape decisions about people, and whether any monitoring is allowed.
• Complaints about leaders. A grievance about a director cannot go to someone who reports to that director.
• The harassment duty. From 30 October 2026 the employer must take all reasonable steps to prevent sexual harassment; someone at the top must own what those steps are.

The same logic applies to technology teams, covered in our guide on how CEOs and CTOs should structure technology teams.

A first-90-days plan

For a new HR lead, or a CEO taking HR seriously for the first time, in a company of 20 to 150 people.

Days 1 to 30: find out what you have.

1. List everyone who works for you, on what contract, from what date. Mark who will pass six months' service before 1 January 2027.
2. Check every file for a signed contract and right to work evidence; redo any missing or faulty check.
3. Confirm payroll files to HMRC on or before each payday and pension enrolment is current.
4. List every system holding employee data, and who can access it.
5. List every tool that uses AI on candidates or staff, including features inside systems you already pay for.

Days 31 to 60: fix the rules.

1. With your employment law adviser, update contracts, the handbook and the disciplinary, grievance and probation procedures for the 2026 and January 2027 changes.
2. Write a sexual harassment prevention plan before 30 October 2026: training, reporting routes, third-party harassment.
3. Set a retention schedule for candidate and employee records that allows for the six-month tribunal window.
4. For each AI hiring tool, get written answers: is the vendor controller or processor, what data does it use, how is bias tested, can a person review every rejection. Switch off what you cannot answer for.

Days 61 to 90: build the routine.

1. Confirm the HRIS and ATS, and move right to work checks and onboarding into them.
2. Write a one-page hiring process: stages, who scores, who approves the offer, where the record lives.
3. Train every manager on probation, performance conversations and the new dismissal rules.
4. Agree with the CEO what stays at the top, using the list above.
5. Diary a quarterly review of the government's employment law timetable and the Home Office right to work guide.

After 90 days you should be able to answer three questions about any person in the company within five minutes: what are their terms, can they legally work here, and what decisions about them has any system made. If you can, the function is working.

Sources

• TrustList category index: HR service and software category counts. TrustList, counted 25 September 2026.
• Plan to Make Work Pay and Employment Rights Act: timeline update: Employment Rights Act 2025 dates. UK government, updated 25 August 2026.
• Right to work checks: an employer's guide: methods, eVisas, records, penalties, draft in force 1 October 2026. Home Office, updated 11 September 2026.
• AI tools in recruitment: audit outcomes report: audit period, recommendations and findings. Information Commissioner's Office, 6 November 2024.
• Data protection and monitoring workers: DPIAs, transparency, covert monitoring. Information Commissioner's Office (read 25 September 2026).
• One year on: the Data (Use and Access) Act: planned code of practice on AI and automated decisions. Information Commissioner's Office, 23 June 2026.
• Responsible AI in recruitment guide: assurance steps for AI hiring tools. Department for Science, Innovation and Technology, 25 March 2024.
• EU agrees to simplify AI rules: high-risk rules for stand-alone systems from 2 December 2027. European Commission, 7 May 2026.
• AI Act, Annex III: text of point 4, employment. Future of Life Institute AI Act Explorer (read 25 September 2026).
• Automated employment decision tools: Local Law 144. NYC Department of Consumer and Worker Protection (read 25 September 2026).
• Business partnering factsheet: three-part HR operating model. CIPD, 25 September 2025.
• Running payroll: reporting to HMRC: Full Payment Submission timing. HMRC (read 25 September 2026).
• Workplace pensions: what employers must do: auto-enrolment criteria. GOV.UK (read 25 September 2026).
• Who needs to report their gender pay gap: 250-employee threshold. GOV.UK (read 25 September 2026).