Automated Decision-Making in recruitment: the risks and how to handle them
Artificial intelligence is quickly becoming part of many everyday HR tasks, including recruitment. From screening CVs and ranking candidates, to analysing video interviews, AI can save HR teams valuable time and streamline hiring.
However, the Information Commissioner’s Office (ICO) has recently issued a clear warning: many employers are using AI recruitment tools without fully understanding their legal responsibilities.
Through its Recruitment Rewired initiative, the ICO reviewed how organisations are using automated decision-making in recruitment. The findings revealed common issues, including a lack of transparency with candidates, inadequate human oversight and insufficient checks for bias. The message is simple – if you’re using AI to make recruitment decisions, now is the time to review your processes.
AI isn’t the problem – how you use it is
Many employers think they’re simply using AI as a tool to support recruitment. However, if your software is automatically deciding which candidates progress to the next stage without meaningful human involvement, you could be carrying out automated decision-making under UK data protection law.
Following changes introduced by the Data (Use and Access) Act 2025 in February this year, employers can use automated decision-making more flexibly, but only if important safeguards are in place. Candidates must be told that AI is being used, be able to challenge decisions, and be able to request meaningful human review.
The central importance of human oversight
Human oversight must be more than a tick-box exercise. One of the ICO’s biggest concerns is ‘rubber-stamping’ AI decisions. Simply glancing at a shortlist generated by software isn’t enough.
HR professionals should ensure someone genuinely reviews the AI’s recommendations, understands how the decision was reached and has the authority to change the outcome where necessary. If challenged, employers should also be able to demonstrate that this oversight took place.
Privacy notices for candidates
Don’t overlook transparency. If AI forms part of your recruitment process, your privacy notice should say so.
Candidates should understand what technology is being used, what information is being analysed and how automated decisions affect their application. They should also know how to request a human review or challenge a decision if they believe the process was unfair.
Being transparent isn’t just about legal compliance – it also helps build trust with candidates.
The risk of bias
AI systems learn from existing data. If that data reflects historical recruitment patterns, the technology can unintentionally reproduce bias, potentially leading to discrimination claims under the Equality Act 2010.
Regular bias testing, asking suppliers about their safeguards and carrying out Data Protection Impact Assessments are all sensible steps to reduce this risk.
Possible avenues for discrimination claims
It is not just workers who are protected from discrimination under Equality Act 2010, candidates are covered too.This means that recruitment processes can be challenged as discriminatory.
Under the Equality Act 2010, indirect discrimination occurs where a provision, criterion or practice (PCP) puts a group sharing a protected characteristic at a particular disadvantage compared with others. An algorithm is, in substance, a set of rules – and those rules can constitute a PCP.
Where an AI tool is trained on historical data that reflects past imbalances – a workforce that was disproportionately male, from particular educational institutions, or from certain demographic groups – the tool’s outputs will encode those imbalances as criteria for future hiring. The employer may have no knowledge of this; the tool may have been purchased off the shelf. That absence of intent is no defence to an indirect discrimination claim.
Indirect discrimination can be objectively justified if the PCP is a proportionate means of achieving a legitimate aim. An employer defending a claim arising from AI-assisted recruitment would need to demonstrate not only that the aim of the tool is legitimate, but that its operation is proportionate – which, in practice, means showing that it has been tested, monitored and found not to produce unjustifiable disparate outcomes. This is yet another reason why the steps to minimise bias are so important.
Direct discrimination is also a potential risk. Employers must not discriminate against a person because of a protected characteristic when deciding whom to offer employment to. That obligation applies from the moment an application is received. A candidate rejected by an algorithm before any human has read their CV is, for the purposes of the Equality Act, a candidate about whom a decision has been made – and one who may have grounds for a claim.
What should HR teams do now?
The ICO has made it clear that AI in recruitment will remain an area of regulatory focus. Employers should take the opportunity to audit where AI is used within their recruitment process and address the issues highlighted above.
AI can undoubtedly improve efficiency, but it shouldn’t replace informed human decision-making. By taking a proactive approach now, HR teams can embrace the benefits of technology while remaining compliant and maintaining candidates’ confidence in a fair recruitment process.