Editorial correction — 14 October 2026: We corrected the account of UK automated-decision rules, discrimination law, DPIAs and EU implementation dates, and removed unverified vendor recommendations and pricing. The original publication date is retained. This is a source-based overview, not legal advice or a guarantee that a recruitment process is compliant.
Commercial disclosure: An earlier version carried an affiliate-link disclosure. This corrected version links to official guidance and legislation and does not recommend a recruitment product.
What the ICO’s research establishes
The ICO’s Recruitment rewired report draws on voluntary engagement with more than 30 employers between March 2025 and January 2026. It was not an audit or investigation. Its findings raise concerns about significant solely automated decisions, transparency and safeguards; they do not measure the percentage of all UK employers breaking the law.
The related consultation closed on 29 May 2026. When checked on 14 October, the ICO’s detailed guidance still labelled its 31 March update as draft guidance. Treat that status explicitly rather than describing the consultation as open or the guidance as new legislation.
UK automated-decision rules are not an outright ban
The Data (Use and Access) Act amended the UK GDPR’s automated-decision framework. Its provisions commenced in stages; the entire Act did not start on one February date. The current ADM provisions are Articles 22A–22D, covering significant decisions based solely on automated processing and the applicable restrictions and safeguards.
The ICO’s scope guidance explains that meaningful human involvement requires real influence before a decision takes effect. The reviewer needs suitable competence and authority, and must consider the relevant evidence. A token approval or occasional spot-check does not make every candidate’s decision human-reviewed. There is no rule that an arbitrary proportion of outcomes must be reversed.
A lawful basis for processing remains necessary. Where decisions rely wholly or partly on special-category data, additional conditions and restrictions apply. Do not treat legitimate interests, a vendor contract or a human-review button as a universal permission for sensitive-data processing.
Article 22C safeguards include information about decisions, the ability to make representations, human intervention and a way to contest the outcome. These need a functioning process, rather than a claim in a sales presentation.
Other duties remain separate
A DPIA is mandatory for systematic and extensive significant automated decisions or profiling, and more generally where processing is likely to create high risk. The ICO recommends assessing ADM through a DPIA. This is more precise than saying every tool marketed as AI requires one irrespective of its processing.
Equality law also needs its own assessment. The earlier statement that indirect-discrimination liability is “absolute” was wrong: the objective-justification test considers whether a measure is a proportionate way to achieve a legitimate aim. This is not a blanket defence for using an algorithm. The Equality Act framework applies in Great Britain; Northern Ireland has separate discrimination legislation.
For EU-facing uses, assess territorial scope and high-risk classification, including exceptions and the distinction between provider and deployer duties. The revised Annex III application date is 2 December 2027; this does not suspend other existing obligations.
Practical procurement checks
Our recommendation is to map each hiring stage, identify who makes the decision, and test the actual challenge process before relying on it. Ask vendors about training reuse, retention, subprocessors, international transfers, access controls and bias evaluation. Review the contract and deployed configuration together. A product name, hosting location or generic compliance badge cannot establish that a particular employer’s hiring workflow is lawful.
