AI in recruitment: a high-risk use of automated decision-making

AI tools are increasingly used to screen CVs, rank candidates, conduct video interviews, and automate shortlisting. These tools can process hundreds of applications in minutes, but they carry significant legal risk.

Recruitment AI makes decisions about people's livelihoods. Under UK data protection law and the Equality Act 2010, employers bear full legal responsibility for the outcomes of these tools, even when a third-party vendor supplies the software. If an AI system discriminates, it is the employer who faces enforcement action.

Understanding the equality risk

AI recruitment tools can embed and amplify bias in ways that are difficult to detect. A system trained on historical hiring data may learn to favour candidates who match the profile of previously successful applicants, indirectly discriminating against protected groups. This applies to all nine protected characteristics under the Equality Act 2010.

AI and equality: understanding bias risks

Detailed guidance on how AI tools can breach the Equality Act 2010, common sources of algorithmic bias, and how to assess equality impact.

Data protection: DPIA is mandatory

Using AI to process candidate data is high-risk processing under UK GDPR. A Data Protection Impact Assessment is not optional for recruitment AI. The ICO's guidance on AI and data protection makes clear that automated profiling and decision-making about individuals requires a DPIA before you begin processing.

DPIA requirements for AI recruitment tools

Your DPIA must assess the necessity and proportionality of using AI, identify risks to candidates, and document safeguards. If the DPIA identifies high residual risk, you must consult the ICO before proceeding.

A Data Protection Impact Assessment (DPIA) is mandatory for AI systems that process personal data in ways likely to result in high risk to individuals' rights and freedoms. The ICO provides AI-specific DPIA guidance.

When mandatory: AI processing involving profiling, large-scale processing of special category data, systematic monitoring of public areas, or automated decision-making with legal/significant effects
AI-specific considerations: Algorithmic fairness, training data quality and representativeness, model accuracy and error rates, explainability, automated decision safeguards, data minimisation in training
ICO risk toolkit: AI and data protection risk toolkit provides structured assessment framework for AI-specific DPIAs
Timing: Must be conducted before AI processing begins — not retrospectively
Consultation: Must consult the ICO if DPIA indicates high risk that cannot be mitigated
Review: DPIAs must be kept under review — reassess when AI system changes significantly (new training data, model updates, expanded use)

AI in recruitment and HR

Complete employer guide to using AI in hiring: lawful basis, DPIA process, ICO expectations, and practical compliance steps.

Transparency: telling candidates about AI

Candidates have a right to know when AI is involved in decisions about their application. Under UK GDPR Article 22, individuals have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Recruitment decisions clearly meet this threshold.

Transparency obligations for AI decisions

You must inform candidates that AI is being used, explain what data it processes, and provide meaningful information about the logic involved. Generic statements like 'we use technology to help assess applications' are insufficient.

Multiple UK regulatory frameworks require transparency about AI systems. The specific obligations depend on the context of AI use and which regulator has jurisdiction.

UK GDPR (ICO): Articles 13-14 require 'meaningful information about the logic involved' in automated decisions and their significance and envisaged consequences
FCA Consumer Duty: Firms must be able to explain AI-driven decisions to consumers and demonstrate good outcomes
Ofcom (OSA 2023): Platforms must be transparent about algorithmic recommendation systems used to prioritise content
ICO guidance: ICO 'Explaining decisions made with AI' guidance covers six explanation types: rationale, responsibility, data, fairness, safety/performance, impact
Privacy notices: Must describe AI use, logic involved in automated decisions, significance and consequences for the individual
ROPA: Records of Processing Activities must document automated decision-making processes

Human oversight: the right to contest

AI tools should support human decision-making, not replace it entirely. The Data Use and Access Act 2025 strengthens the right to contest automated decisions, requiring organisations to demonstrate meaningful human involvement in consequential decisions.

Human oversight and the right to contest

A human reviewer must have genuine authority and competence to override the AI recommendation. Rubber-stamping automated outputs does not constitute meaningful human oversight under DUAA 2025.

Several UK regulatory frameworks require human oversight of AI decisions and mechanisms for individuals to challenge AI-driven outcomes.

DUAA 2025 safeguards: From 5 February 2026: right to obtain human intervention in significant automated decisions, right to express point of view, right to contest the decision
FCA SM&CR: A named senior manager must be accountable for AI decisions — personal liability for outcomes
EU AI Act (if applicable): High-risk AI systems must be designed to allow effective human oversight as a core design requirement
EHRC contestability: Individuals can challenge AI-driven discrimination through Employment Tribunals and civil courts
FCA complaints: Consumers can escalate AI-driven financial decisions to the Financial Ombudsman Service
Implementation: Organisations should establish clear escalation routes, train staff to review AI decisions, and document human oversight processes

Testing for bias before and during use

Before deploying any AI recruitment tool, conduct an Algorithmic Impact Assessment to evaluate whether the system produces discriminatory outcomes. This is not a one-off exercise. You should test regularly using representative data and monitor outcomes by protected characteristic once the tool is in use.

Ask your vendor for documentation on how the model was trained, what fairness metrics were applied, and what testing was conducted. If they cannot provide this, reconsider whether the tool is fit for purpose.

Bias testing and fairness requirements

Bias testing should cover all protected characteristics and examine both direct and proxy discrimination. Statistical disparity in outcomes across groups is a strong indicator that further investigation is needed.

There is no UK statutory requirement for AI bias testing specifically. However, the Equality Act 2010 requires non-discriminatory outcomes, and ICO DPIA guidance includes fairness assessment. Several frameworks recommend structured bias testing.

Legal obligation: Equality Act 2010 prohibits discriminatory outcomes — businesses bear the burden of proving AI does not discriminate
ICO DPIA: ICO AI and data protection risk toolkit includes fairness assessment as part of AI-specific DPIA
GOV.UK recommendation: Responsible AI in Recruitment guide (March 2024) recommends Algorithmic Impact Assessments (AIAs) for AI recruitment tools
Public sector: Equality Impact Assessments (EIAs) required for public bodies deploying AI under Public Sector Equality Duty
EHRC guidance: EHRC guidance on AI bias focused on recruitment tools, facial recognition, and algorithmic decision-making
FCA expectation: FCA Consumer Duty requires firms to monitor for AI-driven unfair outcomes in pricing, underwriting, and service delivery

Verify your compliance

Use the AI compliance checklist to audit your recruitment AI against all current legal requirements. This covers data protection, equality, transparency, human oversight, and record-keeping in a single structured assessment.

AI compliance checklist

Structured checklist covering all legal requirements for AI systems, including recruitment-specific obligations.

AI governance framework

Broader governance guidance for organisations deploying AI across multiple business functions.

Using AI in recruitment safely

AI in recruitment: a high-risk use of automated decision-making

Understanding the equality risk

AI and equality: understanding bias risks

Data protection: DPIA is mandatory

AI in recruitment and HR

Transparency: telling candidates about AI

Human oversight: the right to contest

Testing for bias before and during use

Verify your compliance

AI compliance checklist

AI governance framework

Related journeys

AI compliance quick check

Start using AI responsibly in your business

Responding to an AI regulatory investigation

Prepare for EU AI Act compliance