Automated decision-making in recruitment: what the ICO’s latest report means for employers

Automated decision-making (ADM) tools are routinely used by many employers in the recruitment process to sift CVs, assess candidates and manage high volumes of applications. While the tools improve efficiency and consistency they also create risks for candidates and regulatory exposure for employers.

Recruitment has become a particular focus for the Information Commissioner’s Office (ICO). Between March 2025 and January 2026, the ICO reviewed the use of ADM in recruitment across more than 30 organisations.

In the report, the ICO has set out where it is seeing problems in practice and what it expects employers to do differently.

Why is recruitment a regulatory priority?

The ICO’s focus on recruitment reflects its wider concerns about the inherent risks that arise from the use of AI tools in decision-making, including limited human involvement and the potential for bias and unfairness, as discussed below.

There is also significant public concern. Research cited by the ICO in its AI and biometrics strategy shows that 64% of people are concerned that employers will rely too heavily on AI, and 61% are concerned it will perform worse than human decision makers when assessing individual circumstances.

This combination of inherent practical risk and heightened public concern underpins the ICO’s focus on recruitment as an area of focus.

Background

UK GDPR regulates certain types of ADM where decision making is “solely automated” (i.e., where there is no human involvement in the decision-making process) and is based entirely or partly on personal data and the decision has a legal or similarly significant effect. These rules were updated in February 2026 as part of amendments to UK GDPR under the Data (Use and Access) Act 2025 and are set out in Articles 22A to 22D.

Where such ADM is used, organisations must implement certain safeguards, including providing information on decision making, enabling the data subject to make representations about such decisions, obtain human intervention and to contest such decisions.

In addition, organisations can use special category data in ADM where they have the consent of the data subject, the decision is necessary for a contract between that person and the organisation, or it is otherwise required or authorised by law and there is a substantial public interest.

Outside of Articles 22A to 22D, employers will also be subject to general data protection principles in relation to fairness, lawfulness and transparency. Employers must also carry out a data protection impact assessment where the processing is likely to result in a high risk to people’s rights and freedoms. These principles will apply even if the ADM is not subject to Article 22.

What the ICO’s report found: common issues in recruitment processes

• Solely automated decisions

One of the ICO’s key concerns was the use of solely automated decisions without meaningful human involvement. The ICO’s investigation indicated that while many employers thought their use of automated recruiting tools supported decisions made by humans, in practice the evidence suggested that the tools were being used to make solely automated decisions, with no meaningful human involvement.

For example, the ICO refers to the use of tools that profile candidates with a “fit” score that is then used by hiring managers. The ICO expressed concern that employers could not demonstrate how they were mitigating the risk that hiring managers placed disproportionate reliance on these scores, particularly when dealing with large numbers of applications.

• Bias and unfairness in ADM tools

The ICO reiterated the risk that ADM tools can introduce or reinforce bias in recruitment. Profiling‑based tools, including behavioural or algorithmic assessments, may disadvantage certain groups if they rely on biased training data that fails to reflect real-world diversity. Without careful design, testing and ongoing monitoring, these tools risk embedding unfairness at scale, producing outcomes that may be discriminatory and difficult for candidates to understand or challenge.

What the ICO expects employers to do

The ICO has made clear that compliance requires more than a general awareness of data protection principles. Employers using ADM in recruitment should be able to demonstrate practical safeguards in operation.

In particular, the ICO expects employers to focus on the following areas:

1. Be transparent with candidates

Candidates should be informed when ADM is used as part of a recruitment process. This should include:

• confirmation that automated tools are involved;
• an explanation of the role those tools play in decision‑making; and
• clarity on how the outcome may affect the candidate.

Transparency is a core requirement under data protection law and plays a key role in building trust in recruitment processes.

2. Actively monitor for bias and fairness

Employers should move beyond one‑off checks and adopt ongoing monitoring of ADM systems. This includes testing for bias, assessing outcomes across different groups and ensuring systems continue to operate fairly over time.

The ICO expects fairness considerations to be built into system design and governance from the outset, rather than addressed only once issues arise.

3. Explain and enable rights of challenge

Candidates must be told about their rights in relation to automated decisions. Where Article 22 applies, this includes the right to request human intervention, express their point of view and contest a decision.

These rights must be meaningful in practice. Employers should ensure that review and escalation mechanisms are clear, accessible and genuinely capable of influencing outcomes.

In order to do this, employers will need to ensure that they properly understand the recruitment tools they are deploying, what personal data they process, and how these tools will be used. As part of this, employers should ensure that they conduct a DPIA to assess the lawfulness and risks of using the tool and then implement appropriate internal guardrails and policies, together with training.

Employers should also think about the diligence they carry out on tools prior to purchase, including asking the vendor questions about how the tool has been developed and trained, ongoing testing and monitoring for bias, how the tool is intended to be deployed and how employers can review and interrogate decisions that are made with tool.

What happens next

The ICO is currently consulting on draft guidance on ADM and profiling. The Government has also recently laid regulations in Parliament requiring the ICO to prepare a code of practice on AI and ADM, signalling that regulatory scrutiny of ADM in recruitment is likely to increase. Employers using automated tools should take this opportunity to review their recruitment workflows, governance arrangements and candidate‑facing information.

If you would like to discuss the use of ADM in recruitment or in any other sector, please contact Martin Sloan, Julie Keir or your usual Brodies contact.