UK Information Commissioner Puts AI Hiring Tools on Notice: 'Human in the Loop' Is No Longer Enough
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
On 31 March 2026, the UK's Information Commissioner's Office (ICO) issued a stark warning to the recruitment industry: if you use AI to hire, you need to prove that a human — not an algorithm — is actually in charge. The regulator's report, Recruitment Rewired, based on a year of observing how over 30 UK companies use AI in hiring, found a massive disconnect between what employers believe they are doing and what the law requires.
Most employers believe they are using AI as a helpful 'assistant,' the ICO found, but in legal terms they are running automated decision-making (ADM) systems under UK GDPR Article 22A. The core test is not whether a human looks at a shortlist, but whether that person has the information, authority, and genuine capacity to overrule the AI's decision. If the workflow strips away the ability to intervene — no visibility into who was filtered out, no time to dig into methodology, no easy way to pull an excluded candidate back — then the AI is making the call, not the human.
Concerns about AI-driven hiring are not limited to the UK. The EU AI Act, New York City's Local Law 144, and the UK's Data (Use and Access) Act 2025 all mandate varying levels of bias audits, candidate disclosures, and human oversight. Colin Minto, writing for Recruiting Headlines, noted that lawsuits against HR tech vendors are currently in US discovery, with courts signalling that AI vendors can be held directly liable for discriminatory outcomes.
Why It Matters
For TA leaders, this is not a UK-only issue. If you recruit in multiple jurisdictions, these laws layer on top of each other: an AI workflow that passes the UK's ADM test may not satisfy EU requirements. The ICO's intervention forces a fundamental question: does your 'human in the loop' actually have the authority and information to overrule the algorithm, or are they rubber-stamping AI decisions? The report recommends auditing every stage of your hiring process where an automated tool scores, ranks, filters, or flags a candidate, and documenting what human review looks like in practice, not just in policy.
The deeper strategic question the ICO raises is whether your reliance on AI screening is compensating for a broken front-end attraction process. If you need an algorithm to triage thousands of applications, perhaps the bottleneck isn't the screening — it's that you're casting too wide a net without enough precision in your sourcing.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your legal and compliance team — Ask them to map your organisation's AI hiring tools against the ICO's ADM framework and assess whether your 'human in the loop' processes would pass regulatory scrutiny in the UK, EU, and any US state where you recruit.
Your head of TA operations — Commission a complete audit of every automated decision point in your hiring funnel, documenting which specific ATS features or AI tools are scoring, ranking, or filtering candidates and what information reviewers actually see.
Your vendor management lead — Request bias audit documentation and explainability reports from every AI hiring vendor you use, and verify that their contracts include provisions for regulatory compliance across the jurisdictions where you operate.
Inspect
What to take a closer look at
Audit your hiring pipeline this week to identify every point where an automated tool scores, ranks, or filters a candidate, then interview three recruiters or hiring managers about their last AI-generated shortlist. Specific tool to look at: Your ATS's screening, ranking, or 'fit score' module — review how candidates are filtered before a human sees them and whether rejected candidates can be retrieved.
Reflect
What to think about more deeply
The most interesting question isn't 'Are we compliant with AI hiring regulations?' — it's 'If the ICO is right that most AI screening is just rubber-stamping, what would it look like to design a hiring process where human judgement genuinely adds value rather than formalising an automated decision?' And would that process still meet your hiring volume targets?