AI recruitment UK: what must employers do before launch?

AI recruitment in the UK is legal, but there is no single UK AI hiring law: your process must meet the Equality Act 2010 and UK GDPR requirements. The automated decision-making changes fully in force from February 5, 2026 require safeguards for significant decisions made without meaningful human involvement.

I'd start with the hiring workflow, not the supplier's description of its technology. Write down what information enters the tool, what it produces and who decides what happens to the applicant. Then use the checks below to assess each stage.

Where AI enters a UK hiring process

Assess sourcing, screening and interviews separately. Do not approve an entire platform because you are comfortable with one feature.

Stage	What to map	Main risk to examine	Prelaunch checklist
Sourcing	Where candidate information comes from, which profiles are selected and what gets stored	Collecting unnecessary information or excluding people through unjustified search criteria	Approve sources and fields; review filters; assign responsibility for candidate privacy information; set retention periods.
Screening	Which application details affect scores, rankings or progression	Applying discriminatory criteria or treating missing evidence as a proven failure	Document job-related rules; inspect supporting evidence; test exclusions; identify who reviews unfavorable outcomes.
AI interviews	What audio, video, transcripts or answers are processed and how outputs affect progression	Disadvantaging applicants through the assessment format or relying on an unexplained recommendation	Plan adjustments; explain the assessment; specify what reviewers inspect; provide a route to question the outcome.

For each stage, ask: What happens to a candidate if nobody opens the underlying record? If they disappear from consideration, investigate that decision path rather than relying on the label “decision support.”

For hiring outside the UK, use the AI candidate screening guide for the separate NYC and EU checks.

The UK rules that apply to AI recruitment

Screening criteria and indirect discrimination

Under section 19 of the Equality Act 2010, a provision, criterion or practice that disadvantages people sharing a protected characteristic can be indirect discrimination unless it is a proportionate means of achieving a legitimate aim. Applying a screening rule through software does not stop it being an employer's criterion.

For each proposed rule, record:

• The job requirement it supports.
• Why the criterion is necessary rather than merely convenient.
• Who it might disadvantage.
• Whether another way of assessing the requirement would work.
• Who approves changes and reviews disputed outcomes.

Do not treat a hiring manager's preference as sufficient justification for an automatic exclusion.

Reasonable adjustments before assessment

Section 20 of the Equality Act 2010 requires reasonable steps to avoid substantial disadvantage to disabled people, including providing an auxiliary aid where needed. The government's recruitment guidance specifically recommends planning reasonable adjustments before an AI tool goes live.

Decide how candidates can request an adjustment, who responds and what alternative assessment you can offer. For an AI interview, review the format as well as the questions. Do not leave recruiters to improvise after an applicant reports difficulty.

Automated decision-making safeguards

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D. A decision is solely automated where there is no meaningful human involvement in taking it.

For significant solely automated decisions, Article 22C requires safeguards that let the person receive information about the decision, make representations, obtain human intervention and contest it. Article 22B restricts such decisions involving special category data.

Treat automatic rejection as a separate approval decision, not a convenient setting. Map the data involved, the decision's significance and the safeguards before enabling it. A human-reviewed workflow also needs scrutiny: name the reviewer and specify what they actually evaluate.

What the ICO's recruitment audits mean for buyers

The ICO's audits of AI recruitment tools found tools that allowed filtering by protected characteristics and providers that inferred gender, ethnicity or other characteristics from applications or names. The ICO said inferred information was not accurate enough for effective bias monitoring and was often processed without a lawful basis or candidates' knowledge.

The audit report also identified excessive collection and unclear responsibilities, including providers wrongly describing themselves as processors rather than controllers, sometimes under vague contracts.

For buyers, the practical response is to inspect the actual configuration, data flow and contract. Ask the supplier to demonstrate what a recruiter can filter, what information the provider retains and what it does with that information beyond delivering your recruitment service.

An AI recruitment supplier checklist

Use the ICO's six procurement questions as a supplier review agenda. The evidence below is what I'd request, not a substitute for assessing your own use.

ICO question	What a good answer looks like	What to challenge
Have you completed a data protection impact assessment (DPIA)?	An assessment of your intended workflow, with data flows, risks, controls, owners and unresolved issues. The supplier provides information needed to complete it.	A generic statement that the product is compliant, with no assessment of your configuration.
What is your lawful basis for processing personal information?	A documented basis for each purpose, including sourcing, screening and any training or development use. Special category data use receives specific review.	One unexplained basis covering every activity, or uncertainty about secondary uses.
Have you documented responsibilities and set clear processing instructions?	Clear roles for the employer, agency and provider where relevant, with instructions matching what each party actually does.	Calling the supplier a processor without examining its own purposes for using the data.
Have you checked that the provider has mitigated bias?	Relevant testing, known limitations, controls you can configure and a plan for investigating harmful results.	A claim that AI is objective, or demographic guesses presented as reliable bias evidence.
Is the AI tool being used transparently?	Candidate-facing explanations of inputs, output logic and training, testing or development use, with a named party responsible for delivering them.	A technical policy that never explains how applicants are assessed.
How will you limit unnecessary processing?	An approved list of data fields and sources, defined retention periods and a workable deletion process.	Collecting everything available or keeping candidate information indefinitely.

Record the evidence location, reviewer, unresolved questions and approval decision alongside each answer. An unanswered question needs an owner, not a reassuring sales call.

A candidate notice paragraph you can copy

The ICO says recruiters must explain what information AI processes and how, the logic behind outputs, and how information is used to train, test or develop the AI. Contracts must identify who provides this privacy information. Retention periods should appear in contracts, privacy information and a retention schedule.

The paragraph below is a starting point for a genuinely human-reviewed process, not a complete privacy notice. Replace every placeholder and verify every statement against the actual workflow.

We use [tool and provider] to help [source applicants / screen applications / conduct an initial interview] for [role]. It processes [specific information and sources] and assesses [job-related evidence] against [criteria] to produce [scores, rankings, summaries or recommendations]. [Explain how the checks affect the output, including how missing information is treated.] A member of [team] reviews [underlying information and AI output] and decides [the next step]; the tool does not make that decision on its own. [Explain whether and how your information is used to train, test or develop AI, and by whom.] We retain [record types] for [retention periods]. Our recruitment privacy notice at [location] explains the lawful basis, responsibilities and further details. To request an adjustment or alternative assessment, correct information, or ask for human review, contact [monitored channel].

I'd show this explanation before the AI-assisted stage, not only in an outcome message. Test the contact route yourself.

Do not use the human-decision sentence if it is untrue. For significant solely automated decisions, build the notice and review route around the applicable automated decision-making safeguards, with data protection advice.

What meaningful human involvement looks like day to day

The UK GDPR definition turns on meaningful involvement, not simply whether a person appears somewhere in the workflow. I'd give reviewers an explicit checklist:

• Open the relevant application evidence or interview record, not just the score.
• Check the criterion against the approved job requirements.
• Distinguish “not evidenced here” from “does not meet the requirement.”
• Consider corrections and adjustment requests before deciding progression.
• Have authority to change the proposed outcome and pause a faulty rule.
• Record the reason for the decision, rather than copying the AI recommendation.
• Route challenges to someone able to reconsider the assessment.

In Alfa AI, each candidate profile shows the screening checks and evidence behind the score. Only evidence on the application counts. Lisa sorts applicants into Suitable and Not Suitable, but never rejects anyone; placing someone in Not Suitable sends no email. The hiring team can move candidates to Suitable or Shortlisted themselves.

That supports review, but your operating process still matters. Do not leave the Not Suitable group permanently unread and assume that the absence of a rejection email establishes meaningful involvement.

For interviews, specify which record the reviewer examines and how they resolve unclear answers. Give them a route to seek clarification rather than forcing a choice between accepting the output and rejecting the applicant.

A 30-day rollout plan for AI recruitment in the UK

The government's Responsible AI in Recruitment guide covers procurement and deployment. It recommends measures including impact assessments, bias audits, performance testing, piloting, training, monitoring and feedback routes. It is guidance, not legal advice.

This is a proposed operating schedule, not a legal deadline. If a control is unresolved, extend the pilot rather than forcing a launch.

1. Days 1–5: map the workflow and assign owners. List every AI-assisted stage, its inputs, outputs and effect on progression. Name the hiring owner, data protection reviewer and person who can pause use. Document who makes each decision, including any client decisions in an agency workflow.

2. Days 6–10: complete supplier and data checks. Work through the supplier table, assess the proposed use through a DPIA and resolve responsibilities, lawful basis, training use and retention. Keep unresolved questions visible. Do not approve a feature whose data flow you cannot explain.

3. Days 11–15: approve rules, notices and adjustments. Review every exclusion criterion for its job-related purpose and potential disadvantage. Finalize the candidate explanation and adjustment route. Test your ATS workflow, including what a status change triggers and whether a ranking becomes an action elsewhere.

4. Days 16–20: run a controlled pilot. Compare outputs with an independent human assessment against the same criteria. Inspect weak evidence, missing information and unfavorable recommendations. Log disagreements, investigate their causes and retest changed rules before relying on them.

5. Days 21–25: train reviewers and rehearse challenges. Ask reviewers to explain an output, identify unsupported evidence and change a recommendation. Test an adjustment request, a correction request and a contested outcome. Confirm that messages reach someone with authority to act.

6. Days 26–30: make a documented go-live decision. Review unresolved risks, pilot findings and the candidate-facing process. Set owners and triggers for monitoring, including rule changes, unexpected exclusions and complaints. Record how you will pause the workflow and reassess affected applicants if a problem appears.

Your launch record should contain approved criteria, the data assessment, supplier evidence, candidate notice, adjustment process, reviewer instructions and monitoring plan. If a critical item is missing, keep the workflow out of live selection until the gap is resolved.