ICO Tells UK Employers: If You're Using AI to Filter Candidates, You're Probably Doing ADM
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
The Information Commissioner's Office has published findings from its investigation into automated decision-making (ADM) in UK recruitment, based on evidence from over 30 employers and public perceptions research. Its central finding is stark: most employers using AI to filter, score, or rank candidates believe they are using 'decision support' tools, but in practice the systems are making solely automated decisions with no meaningful human involvement. The ICO defines meaningful involvement as active, not performative — a human must have the authority, discretion, and competence to alter a decision before it's applied. Simply having a recruiter click 'approve' on an AI-generated shortlist does not meet the standard. Under the Data (Use and Access) Act 2025, which reframes ADM as a right of challenge with safeguards rather than a prohibition, employers now have two paths: implement genuine human oversight for every candidate decision, or acknowledge ADM and implement transparency, bias monitoring, right-to-review, and contestability safeguards. The ICO's draft guidance on ADM closed for consultation in May 2026, with final guidance expected this summer.
Why It Matters
The ICO's report is significant because it shifts the burden of proof onto employers: if you claim your process has 'meaningful human involvement,' you need to demonstrate it — consistently, for every candidate, at every stage. The report also highlights a growing enforcement appetite. The ICO is actively engaging with 11 major AI foundation model developers and has positioned ADM in recruitment as a key regulatory priority under its AI and biometrics strategy. For TA leaders in the UK, the practical implication is that many current AI screening workflows — particularly those processing high volumes where human review of every rejection is operationally impractical — may already be non-compliant. The window for getting ahead of this before enforcement action begins is narrowing.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your Data Protection Officer: Review every AI tool in the recruitment stack and classify whether it involves solely automated decision-making under the ICO's 'meaningful human involvement' test. If it does, ensure DPIAs are current and specific — the ICO found most existing DPIAs lacked the detail required.
Your head of recruitment operations: For any ADM tool you continue to use, document the candidate-facing transparency mechanism. When does a candidate learn AI was used? Can they request human review? A privacy policy buried in the careers page does not meet the ICO's expectations.
Inspect
What to take a closer look at
Pick one high-volume role your organisation hired for in the last quarter. Trace every AI touchpoint in that hiring process — CV screening, chatbot pre-qualification, assessment scoring, video interview analysis. For each touchpoint, ask: would a rejected candidate know AI was involved? Could they contest the decision? If the answer is no to either, that touchpoint needs immediate attention. Document your findings; the ICO's enforcement appetite will not wait for final guidance.
Reflect
What to think about more deeply
The ICO's position is that 'meaningful human involvement' must be applied consistently to every candidate. But at high volumes — thousands of applicants for a single role — genuine human review of every AI rejection is operationally impossible. Is the ICO asking employers to do something that the economics of modern recruitment simply cannot sustain?