Your AI Hiring 'Human Review' Probably Doesn't Count, ICO Signals
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
The ICO's draft guidance on automated decision-making and profiling, published 31 March with a consultation that closed 29 May, makes an uncomfortable point for any employer using AI to screen or rank candidates: if your human reviewer doesn't have the authority, information, competence, and time to genuinely overturn the machine's output, you're still making solely automated decisions. The distinction, as Anthony Guerriero writes for The Leveraged Years, 'turns on whether a person can and realistically would overturn the machine, not on whether a name appears at the end of the process.' The ICO's accompanying report draws on voluntary engagement with over 30 employers between March 2025 and January 2026, and a recurring finding was that many employers do not realise their AI screening amounts to automated decision-making at all. Final guidance is expected this summer, and while it doesn't create new legal duties beyond what the Data (Use and Access) Act and UK GDPR already impose, the ICO has signalled that enforcement attention will follow.
Why It Matters
This matters because the Data (Use and Access) Act 2025 replaced the UK GDPR's near-total ban on solely automated decisions with a safeguard-led, permissive regime — but the safeguards are the price of admission. Employers must now establish a valid lawful basis, complete a data protection impact assessment, inform candidates about automated processing, offer the right to human review, and ensure candidates can contest decisions. The ICO's guidance, while still in draft, is effectively a preview of how the regulator will audit and enforce. The practical problem for TA leaders is in the detail: in high-volume recruiting where thousands of profiles are algorithmically ranked, can you genuinely demonstrate that a human reviewer had the time and authority to reach a different conclusion for each one? If not, you're in solely-automated territory — and the safeguards become mandatory, not optional. As The Leveraged Years notes, 'employers should treat a clearly telegraphed ICO priority as close to an operating requirement.'
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your Data Protection Officer: If they haven't already flagged your AI screening tools as automated decision-making, ask why not — the ICO's position is that any tool scoring, filtering, or ranking candidates qualifies. Your TA operations lead: Map the actual workflow. At what point does a human intervene, and can they realistically say no? If the answer is 'the recruiter looks at the top 20 and occasionally skips one,' that's precisely the kind of token involvement the ICO is calling out.
Inspect
What to take a closer look at
Pick your highest-volume role from the past quarter. Trace every automated touchpoint from application to first human contact. For each one, answer: (1) Did the tool score, filter, or rank the candidate? (2) Was there a human in the loop before a rejection or advancement decision took effect? (3) Did that human have access to the full application, not just the AI's output? (4) Could they realistically have overturned the machine's recommendation? (5) Is there a record of their involvement? If you can't answer yes to questions 2-5 for every automated touchpoint, you have a gap the ICO's final guidance will likely call out directly. Also check whether your DPIA for each tool is current and recruitment-specific — the ICO has indicated many existing DPIAs lack sufficient detail.
Reflect
What to think about more deeply
If you had to stand in front of a regulator and explain exactly how your last 100 rejections were reached — who looked at what, when, and with what authority to disagree — could you do it? If the honest answer is no, then your 'human review' is probably a comfort blanket, not a safeguard.