Is Your AI Tool Supporting Recruitment or Deciding Who to Hire?

In the ICO’s recently-published draft guidance on using automation in recruitment finds that employers use automated decision-making (ADM) / AI tools as the main decision-maker in recruitment. By misunderstanding what “human in the loop” means, they are ill-prepared for their GDPR responsibilities towards candidates. I look at what this means for both HR and data protection teams, plus consider if the regulator expectations are realistic.

@kiwihug on Unsplash

Why Responsible AI in Hiring Matters

AI is already making hiring decisions about real people, including scoring CVs, analysing speech patterns, predicting personality types. Most employers using these tools believe a human is still in charge. The ICO's Recruitment Rewired* report suggests otherwise.

This matters beyond compliance. Employers risk losing trust (and talent) if candidates don't understand how hiring decisions are being made. Trust in AI varies widely, and companies using it need to be able to explain the logic behind those decisions, which isn't always straightforward. And the stakes are high: some roles are already being replaced by AI, with graduates currently bearing the brunt.

The report is detailed and long; the main key points are:

1. Employers are using ADM for various steps of the recruitment process.

   Scoring and assessing skills from CVs, interviews, written responses, gamified scenarios, as well as evaluating language and tone from speech in video interviews, deciding on personality types.

2. Most employers have misread where the human involvement actually sits.

   In many cases it is effectively superfluous — the AI has already decided, and a human is simply confirming it. This falls short of the UK GDPR safeguards that kick in when decisions are solely automated.

3. Data protection due diligence is incomplete or inadequate.

   Privacy notices are unclear, lawful bases are wrong, and DPIAs are missing or poor. This is partially due to point 2 but also more generally.

Employers need to do one of two things: (1) build genuine human oversight into their process, or (2) acknowledge they are running solely automated decisions and meet the safeguards required under Article 22C.**

For HR Teams – How to Tell if You or the AI is in Charge

What is “Human in the Loop”?

Meaningful human involvement for the ICO is a person who checks the AI’s homework for each decision, about each candidate, at each stage of the process. A human in the loop weighs up all documentation themselves. They also have real influence, the authority and the skills to do so.

Compare and contrast this with approving what the AI has already decided with just a click. This will not suffice and the ICO calls it “rubber stamping”. This is especially problematic when you are rejecting a candidate because the AI says so.

Whether HR teams can achieve this, is another question. Companies that have decided to use AI tools are likely to have a big number of applications for open roles. You can argue that going through each slows the down the process the tool was procured to speed up.

However, I’d like to think that that’s not the case. The tool could have still streamlined and structured the process in a way that can make the human review quicker and more efficient. Note that this is only possible if the human takes everything with a pinch of salt and doesn’t assume the machine is always right (which is a known human limitation).

Some AI questions you can ask every time:

1. At what point does a human first see a candidate? If AI has already filtered them out, that's ADM.

2. Can recruiters override the AI — and do they? Capability on paper isn't the same as genuine discretion in practice.

3. What does your vendor actually say the tool does? Many market themselves as "AI-assisted" while functioning autonomously.

4. Are candidates being told? Organisations need to be clear with candidates if ADM is being used, explain how it works, and tell candidates how to exercise their right to challenge a decision and request a human review.

5. Has your team been trained to push back on AI outputs? Passive review is not meaningful oversight.

For DPO Teams – Working Towards UK GDPR Compliance

Data protection teams have to work with HR and other teams to explain the AI logic, ensure transparency with privacy information that’s easily accessible, and support with building those individual data safeguards.

Lawful Basis for AI Recruitment

UK controllers could now use legitimate interests as their lawful basis for using AI on personal data, with some conditions (the safeguards). If you’re using special category data like health, there is still a general use prohibition unless an exception applies.***

In a normal context, I can’t see another lawful bases being applicable for personal data. The ICO says that employers have told them they rely on contract or consent, but here’s why they don’t work:

• Contract doesn’t work because there is still no employment contract between the employer and the candidate. This is still the application process. Even if there was, AI recruitment wouldn’t be necessary to enter into the contract – the employer could review the application in another way.

• Consent doesn’t work because the candidate doesn’t have a real choice and isn’t presented with an equal genuine alternative. If they want to apply to that company, AI selection is forced on them.

The team will have to do a legitimate interest assessment and a Data Protection Impact Assessment Assessment (DPIA). I have explained DPIAs simply in another post.

Use the DPIA well. The ICO have found employers either didn’t do them, didn’t finish them, they were written and signed off by Legal only, or had unmitigated risks and didn’t consult the ICO before proceeding, which is a compliance red card.

Tool Classification

As part of your overall recording keeping (ie Record of Processing Activities, ROPA), map your entire recruitment tech stack – job boards, assessment platforms, video interview tools – and formally classify each as decision-making or decision-support. This will help everyone decide whether you need ADM safeguards or give HR managers more time to assess AI decisions.

Vendor Due Diligence

Due diligence includes asking developers about their own bias testing when procuring tools and considering bias reviews on a rolling basis. This needs to be a requirement, not a courtesy question. The tool should have a way for the HR team to report concerns while in use as well.

Is this an unrealistic requirement? The extent of cooperation from the provider may vary but a reputable vendor should be open to these questions and at least try to address this with clients. I wouldn’t rush to pay a company that is evasive about data used to train their models.

Fix Transparency with Privacy Information

The theory is clear here:

• A brief reference buried within a general privacy notice is unlikely to meet this standard.

• Employers must provide meaningful details about the AI logic at the time of application.

• You may want to consider an AI section in your Candidate Privacy Statement and in your job ad so that people are aware from the start ADM is probably involved.

• Providing your AI recruitment tool provider’s privacy notice is not enough – you as the organisation using it are responsible for it.

In practice, it’s worth asking:

• Is your privacy statement easy to read to begin with?

• Is the UX of your job page good enough?

• Can you actually understand the AI logic behind the hiring decisions?

• How will you handle candidate challenges?

The Report isn’t Anti-AI but Anti-Unawareness

The ICO doesn't discourage the use of AI per se. What the report does critique is a rushed and poorly-considered roll-out — one that hasn't fully accounted for individual rights, AI reliability, or the safety of new technologies in high-stakes decisions like hiring.

Using ADM for recruitment is definitely easier in the UK since the Data (Use and Access) Act, but the UK GDPR still applies. Organisations riding the technology wave have to make sure they don't get swept up by regulatory attention which, in the area of AI and recruitment, is already high and can only increase.

* https://ico.org.uk/about-the-ico/what-we-do/recruitment-rewired/ accessed 20.04.2026

** UK GDPR, Safeguards when using ADM: (a) provide the person with information about ADM decisions; (b) enable the person to make representations about such decisions; (c) enable the person to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions.

*** See UK GDPR, Article 23B