Using AI in recruitment in the UK: what the ICO found and a safe set-up

Independent: no vendor pays for coverage · ICO and UK law sources linked · Not legal advice · AI-assisted research, human-checked · How we test · Edited by Annie Vane

You can use AI to sift CVs, schedule interviews and draft job adverts in the UK, but you stay legally responsible for every decision it makes or shapes. The main risks are discrimination under the Equality Act 2010, collecting more candidate data than you need, and rejecting people with no meaningful human review, which now falls under the automated-decision rules in UK GDPR Articles 22A to 22D. The ICO has already audited AI recruitment tools and made 296 recommendations. This guide covers what it found, what to tell candidates, and a safe set-up for a small employer.

Last checked: 31 October 2026 · Written by Annie Vane, editor · Evidence: Documentation review + worked example
Prepared with AI assistance for research and drafting; every legal reference and source was checked by me before publishing. How we test

Key facts

• ICO audit (November 2024): 296 recommendations and 42 advisory notes to AI recruitment providers and developers, all accepted in full or in part.
• What went wrong: tools that let recruiters filter by protected characteristics, tools that inferred gender or ethnicity from a candidate's name, and more data collected than needed.
• Automated rejection: allowed since 5 February 2026 under Articles 22A–22D, but only with four safeguards, and never solely automated on special category data (such as health or disability) without a narrow condition.
• Equality Act: you're liable for discriminatory outcomes, even if a supplier's tool caused them.
• Candidates can complain: since 19 June 2026 you must have a data protection complaints process and acknowledge within 30 days.

Where AI is used in hiring

Our AI for small business guide puts recruitment at the high-risk end for good reason: "anything deciding about people" needs a human decision-maker.

What the ICO's audit found

In November 2024 the ICO published the outcomes of audits of AI tools used in recruitment. It made 296 recommendations and 42 advisory notes; providers accepted 97 per cent in full and the rest in part. The problems it found are the ones to check your own supplier for:

• Filtering by protected characteristics. Some tools let recruiters screen out candidates with particular characteristics.
• Inferring characteristics. Some estimated gender, ethnicity or other traits from a candidate's name or profile, instead of asking, which can be inaccurate.
• Collecting too much. Tools scraped or kept more personal data than the job needed, sometimes indefinitely.
• Unclear roles. Contracts didn't say who was controller and who was processor, so nobody owned candidates' rights.
• No accuracy or bias testing before use.

Alongside its draft guidance on automated decisions (31 March 2026), the ICO reported that employers routinely underestimate when a tool is deciding rather than assisting. If a recruiter accepts the tool's ranking by default, the decision is effectively automated. Track the ICO's latest in our ICO AI guidance tracker.

The Equality Act risk

The Equality Act 2010 protects candidates against direct and indirect discrimination on nine protected characteristics, including age, disability, race, sex and religion. An AI tool trained on past hiring can reproduce past bias, for example by penalising career gaps (which can disadvantage women and disabled people) or certain postcodes or universities (which can track race). "The software did it" isn't a defence: the employer is liable.

Two practical consequences:

1. Reasonable adjustments. If you use timed games, video or voice analysis, offer a non-AI alternative and say so in the advert.
2. Monitor outcomes. Compare who the tool passes and rejects against your applicant pool. If one group drops out disproportionately, stop and investigate.

Automated rejection after the Data (Use and Access) Act

Since 5 February 2026, Article 22 of UK GDPR has been replaced by Articles 22A to 22D. A rejection is a "significant decision". It can now be solely automated, but only if you:

1. tell the candidate that the decision was automated,
2. let them make representations,
3. offer human intervention, and
4. let them contest the decision.

If the decision draws on special category data (health, disability, ethnicity and so on), it can't be solely automated except in narrow cases such as explicit consent. And "human review" must be meaningful: done by someone trained to understand the tool's outputs and limits, with authority to overturn it. A recruiter who clicks "approve all" doesn't count. The full article-by-article table is in AI agents and UK GDPR.

What to tell candidates

Put this in your candidate privacy notice and link it from every advert.

Worked example: privacy notice wording (adapt for your firm)

How we use AI in recruitment. We use [tool name], provided by [supplier], to [rank CVs against the essential criteria in the job description / schedule interviews]. A member of our hiring team reviews every application before anyone is rejected; the tool does not make the final decision. We do not use AI to assess your personality, voice or facial expressions. The tool processes your CV and application answers only. [Supplier] processes this data for us under a contract and does not use it to train its models. We keep unsuccessful applications for [6 months] and then delete them. You can ask for a human-only review, ask how a decision was reached, or ask for an alternative format at any stage: email [address]. You can also complain to us at [address], and then to the ICO.

A safe set-up for a small employer

1. Write the essential criteria first, in the job description, and score against those only.
2. Choose a business plan or recruitment tool with a DPA and no training on your data. Use the supplier checklist.
3. Turn off anything that infers characteristics or analyses video, voice or faces.
4. Use AI to rank, not reject. A trained person reviews every "no".
5. Do a DPIA before you start (free template).
6. Update your candidate privacy notice (wording above).
7. Check outcomes after each round: who passed, who didn't, any pattern?
8. Delete on schedule, and keep a log of what the tool recommended and what the human decided.

Questions to ask a recruitment AI vendor

• Has the tool been tested for bias, on what data, and can we see the results?
• Can recruiters filter or sort by any protected characteristic, directly or by proxy?
• Does it infer anything about candidates that they didn't tell us?
• Who is controller and who is processor, in writing?
• Can we export the score and the reasons for any candidate who asks?

Frequently asked questions

Is it legal to use AI to screen CVs in the UK?

Yes, if you have a lawful basis, tell candidates, avoid discrimination and keep meaningful human review of rejections, or meet the Articles 22A–22D safeguards if a decision is solely automated.

Can AI reject a job applicant automatically?

Since 5 February 2026, yes in principle, but only with the four safeguards (tell, representations, human intervention, contest), and not on special category data except in narrow cases.

Do I need a DPIA for AI recruitment?

Almost certainly. The ICO's draft guidance says you'll usually need one for automated decision-making, and recruitment is high risk.

Who is liable if the AI discriminates?

The employer, under the Equality Act 2010. You may have a claim against the supplier under your contract, but candidates claim against you.

Sources

• ICO, AI in recruitment outcomes report (November 2024)
• UK GDPR Articles 22A–22D, as inserted by the Data (Use and Access) Act 2025
• Equality Act 2010, legislation.gov.uk
• ICO draft guidance on automated decision-making and profiling (31 March 2026), via our ICO AI guidance tracker

This page explains UK law and regulator guidance in plain English, checked against legislation.gov.uk and ico.org.uk on 31 October 2026. It is general information, not legal advice, and the law may have changed since. For a decision that affects people's jobs, or if a candidate complains, speak to an employment solicitor or a qualified data protection professional. Spotted something out of date? Tell me.