Field note
AI recruitment safeguards for UK employers
Calling a tool decision-support does not make it so. Map who or what actually decides, then give candidates clear information and real recourse.
The Information Commissioner's Office published its Recruitment rewired findings on 31 March 2026 after speaking with more than 30 employers. Its key concern was not whether employers called a product “AI”. It was whether a system made a significant recruitment decision without meaningful human involvement.
The ICO found that many employers using automated recruitment were likely relying on solely automated decisions, while safeguards were weaker than they should be. It called for better candidate information, consistent human involvement and stronger monitoring for fairness and bias.
Map the real decision path
Draw the route from application to outcome. Include every score, threshold, ranking and filter.
For each stage, record:
- what personal information goes in;
- what the system produces;
- whether a candidate can be rejected or held back at that point;
- whether a person sees every case or only selected cases;
- what authority the reviewer has to disagree; and
- what explanation and challenge route the candidate receives.
A human reviewing only the candidates who pass an automated threshold is not human involvement in the rejected candidates' decision. A recruiter clicking “accept” on every recommendation without assessing the case is not automatically meaningful review either.
Update candidate information
The ICO expects employers to be clear when automated decision-making is used and explain how it works. Put the information where candidates will see it before the relevant assessment or filter, not only in a generic privacy notice.
Use plain language to explain:
- which stage uses automation;
- what categories of information are assessed;
- what the output influences;
- whether a person reviews the decision;
- how to challenge an outcome; and
- how to request human review.
Do not claim “all applications are reviewed by our team” if software rejects some applications before a person sees them. Avoid describing a behavioural score as objective unless the evidence supports that claim.
Make human review real
Where the process relies on human involvement, design for a reviewer who can change the outcome. The reviewer needs authority, time, relevant information and a route to record why they accepted or rejected the automated recommendation.
Check consistency. If one hiring manager reviews borderline cases while another accepts the score, candidates in the same stage are not receiving the same safeguard.
Track override rates, but interpret them carefully. A zero override rate may mean the tool is excellent; it may also mean reviewers are rubber-stamping it. Sample the underlying cases and ask reviewers what additional evidence they considered.
Test bias before and after launch
The ICO tells employers to test regularly for biased outputs, ask suppliers about their own testing and consider monthly bias reviews as good practice.
Before procurement, ask the supplier:
- which groups and outcomes it tests;
- which training and validation data the test represents;
- how customers can run their own tests;
- how model or threshold changes are announced;
- what audit data can be exported; and
- how a disputed decision can be reconstructed.
Your test should reflect the actual role, candidate population and selection stage. A vendor's global benchmark does not prove fairness in a UK graduate intake, a specialist technical role or an internal promotion process.
After launch, compare progression and rejection rates, investigate material differences and retain the evidence behind changes. Bias monitoring is not a one-off procurement questionnaire.
Build a recourse workflow
Telling candidates they can challenge a decision is not enough. Define:
- the inbox or form they use;
- the response time;
- who performs the new review;
- what information that reviewer receives;
- how the original automated result is isolated from the reconsideration; and
- how the final explanation is recorded.
Test the route with a sample candidate. If the request disappears into general recruitment support or returns to the same automated filter, the safeguard does not work.
Keep the legal reference current
The Data (Use and Access) Act 2025 changed the UK framework for solely automated significant decisions. The ICO's consultation on updated automated-decision guidance closed on 29 May 2026. As of 11 July 2026, its consultation page still describes the final update as forthcoming.
Use the ICO's current law summary and published recruitment expectations, but do not treat consultation wording as final guidance. The ICO says recruitment ADM is likely to require a Data Protection Impact Assessment and that employers need one where processing includes ADM. Complete it before deployment; seek qualified advice where special-category information or significant effects are involved.
For a first use, keep AI to drafting or organising information while a trained person makes the decision. The HR AI workflow shows how approved sources, sensitive-data exclusions and escalation can be designed before automation expands.